{
  "model_name": "phish-structural",
  "analysis_version": "phish-0.1.0",
  "seed": 3,
  "n_train": 160,
  "features": [
    "reply_to_mismatch",
    "return_path_mismatch",
    "from_display_addr_mismatch",
    "auth_results_present",
    "spf_header_present",
    "dkim_header_present",
    "received_hop_count",
    "url_count",
    "unique_domain_count",
    "ip_url_count",
    "punycode_url_count",
    "userinfo_url_count",
    "shortener_url_count",
    "display_href_mismatch_count",
    "lookalike_domain_count",
    "brand_domain_mismatch",
    "credential_lexicon",
    "urgency_lexicon",
    "money_lexicon",
    "attachment_count",
    "html_form_present",
    "hidden_text_hint",
    "subject_len",
    "body_len",
    "persian_char_ratio",
    "mixed_script",
    "has_html",
    "missing_from",
    "missing_message_id"
  ],
  "split": "campaign / sender / template",
  "never_outputs": [
    "safe",
    "benign"
  ]
}