| { | |
| "model_name": "phish-structural", | |
| "analysis_version": "phish-0.1.0", | |
| "seed": 3, | |
| "n_train": 160, | |
| "features": [ | |
| "reply_to_mismatch", | |
| "return_path_mismatch", | |
| "from_display_addr_mismatch", | |
| "auth_results_present", | |
| "spf_header_present", | |
| "dkim_header_present", | |
| "received_hop_count", | |
| "url_count", | |
| "unique_domain_count", | |
| "ip_url_count", | |
| "punycode_url_count", | |
| "userinfo_url_count", | |
| "shortener_url_count", | |
| "display_href_mismatch_count", | |
| "lookalike_domain_count", | |
| "brand_domain_mismatch", | |
| "credential_lexicon", | |
| "urgency_lexicon", | |
| "money_lexicon", | |
| "attachment_count", | |
| "html_form_present", | |
| "hidden_text_hint", | |
| "subject_len", | |
| "body_len", | |
| "persian_char_ratio", | |
| "mixed_script", | |
| "has_html", | |
| "missing_from", | |
| "missing_message_id" | |
| ], | |
| "split": "campaign / sender / template", | |
| "never_outputs": [ | |
| "safe", | |
| "benign" | |
| ] | |
| } |