Image lure linking to an SEO redirector (free-download phishing)

The 'free ebook / solution-manual / document download' SEO-phishing family ships a tiny image-only (or image + filler-text) PDF whose single clickable /URI is a search-keyword gateway — a multi-word utm_term/keyword redirector (the natural-language phrase the page ranks for) or a FeedBurner-proxied feedproxy.google.com/~r/.../uplcv hop abusing a trusted Google host. The PDF carries no exploit; the payload lives on the linked destination. The broader PDF_SEO_DISPOSABLE_LINK_FARM detector requires many links and does not cover single-link variants. ClamAV and the ML model may also miss variants padded with a few text pages. Pairing the redirector with an image lure produces a HIGH finding regardless of text-page count or ClamAV/ML results. The redirector alone (no image lure) is surfaced at LOW as an IOC only.