{"success":true,"data":{"id":"subject-base64-blob","label":"Long base64-like blob in subject — classifier-evasion / tracking token fingerprint","description":"The subject line contains a 30+ character contiguous blob of base64 character set (`[A-Za-z0-9+/=]`) with at least 3 uppercase and 3 lowercase letters. This is a classifier-evasion pattern: spammers and phishing-campaign tools embed these blobs as tracking tokens or per-recipient salt so every subject line tokenizes to a unique fingerprint, defeating frequency-based spam filters that watch for subject-line repetition across a campaign. The 30-char length floor and 3-of-each-case requirement are calibrated to reject false positives: git commit SHAs are 40 hex chars but pure lowercase (fail the uppercase-count check); UUIDs have dashes that break the contiguous-blob match AND are typically all lowercase; Salesforce IDs are 15-18 chars (below length floor); JIRA tickets are short and dash-broken; CI build IDs are usually below 30 chars and single-case. Weight: +3 — moderate. Some niche legit systems (calendar invites with long opaque IDs, certain auto-generated notification mailers) may occasionally cross the threshold, so the signal pairs with other evidence rather than solo-triggering.","tier":"danger","category":"subject","isThin":false}}