Credential lure linking only to a throwaway host

The image-only carrier already correlated its lure with link reputation (PDF_IMAGE_LURE_NONREPUTABLE_LINK); the text carrier did not, so a phishing document that spells its lure out in real text scored on the lure alone and stayed under the malicious threshold. Measured examples: a Spanish 'confidentiality agreement' share notice pointing at spai.secureddocz.workers.dev scored 24 (CLEAN), and an SSA impersonation pointing at an Okta-lookalike path on a tenant subdomain scored 52. Neither half convicts alone — lure wording is common in genuine workflow documents, and throwaway hosts are common in developer previews — but a lure whose only destinations are non-reputable, with at least one on disposable infrastructure, is the phishing carrier shape. HIGH so conviction still rests on two independent signals.