Clickable URL hides a base64-encoded recipient email

Phishing kits stamp the target's email into the landing URL so the page pre-fills and tracks the credential form per recipient. When the address is base64- or URL-encoded (in a query parameter or the #fragment, which never reaches origin-side logs) it is deliberately hidden from plain-text inspection. Unlike PDF_QR_RECIPIENT_PERSONALIZED_LINK this does not require an image-heavy lure, so it catches links delivered behind URL-security rewrites (secure-web) or open-redirect wrappers with ordinary text. The decoded token must be a valid email and the host generated/disposable or lure-keyworded, so ordinary tracking parameters do not match.