Cracked-software download doorway (base64-obfuscated)

TCPDF-generated SEO doorway PDFs that rank for software-piracy searches and funnel users to fake crack/keygen download pages. Unlike the plaintext link-farm lure, the pirated-software title is base64-encoded inside a single URL's path/query (never in visible text), which evades the visible-text and multi-link plaintext rules. The rule fires on the exact 'download|' doorway-template marker or on a base64 URL segment that decodes to piracy vocabulary (crack, keygen, serial key, torrent, patch), both of which a legitimate document effectively never produces. The PDF carries no parser exploit — the risk is the linked crack-download destination, so it is capped at suspicious on its own.