{"success":true,"data":{"id":"plaintext-body-base64-cte","label":"Structural evasion: plain-text body encoded with base64 Content-Transfer-Encoding","description":"Structural evasion technique: the email uses Content-Transfer-Encoding: base64 for a plain-text body with no HTML counterpart. Legitimate plain-text email uses 7bit or quoted-printable encoding — base64 on a plain-text body is a deliberate choice by evasion toolkits to bypass keyword scanners that operate on raw MIME bytes. Only fires when the decoded body also contains 2+ bulk/marketing patterns (unsubscribe, limited time, click here, etc.) to avoid false positives on unusual but legitimate CTE choices. Score: +2.","tier":"danger","category":"other","isThin":false}}