Download Work - 840 -2024- Bengla -www.mazabd.click... -

# ---- Build dict --------------------------------------------------------- return { "n_tokens": n_tokens, "n_chars": n_chars, "avg_token_len": avg_token_len, "upper_ratio": upper_ratio, "digit_ratio": digit_ratio, "stop_ratio": stop_ratio, "has_action_verb": int(has_action), "has_suspicious_kw": int(has_suspicious), "hyphen_cnt": hyphen_cnt, "ellipsis": int(ellipsis), "numeric_pattern": int(numeric_pattern), "domain_present": int(bool(domain)), "registered_domain": registered, "tld": tld, "subdomain_cnt": subdomain_cnt,

suspicious_word_list = "download","click","open","update","verify","invoice","account", "password","login","security","confirm" Download WORK - 840 -2024- Bengla -www.mazabd.click...

# ---- URL / domain cues -------------------------------------------------- # Grab anything that looks like a domain (very permissive) domain_match = re.search(r'([a-z0-9-]+\.)+[a-z]2,', subject, re.I) domain = domain_match.group(0) if domain_match else '' ext = tldextract.extract(domain) registered = f"ext.domain.ext.suffix" if ext.suffix else '' tld = ext.suffix or '' subdomain_cnt = domain.count('.') - 1 if domain else 0 hyphen_in_domain = '-' in ext.domain | |15| Domain Reputation Score | Public blacklists

# ---- Textual cues ------------------------------------------------------- upper_ratio = sum(c.isupper() for c in subject) / max(n_chars, 1) digit_ratio = sum(c.isdigit() for c in subject) / max(n_chars, 1) avg_token_len = np.mean([len(t) for t in tokens]) if tokens else 0 has_action = any(v in subject.lower() for v in "download","click","open","update","verify") has_suspicious = any(v in subject.lower() for v in suspicious_word_list) stop_ratio = sum(t.lower() in stop_words for t in tokens) / max(n_tokens, 1) hyphen_cnt = subject.count('-') ellipsis = subject.endswith('...') numeric_pattern = bool(re.search(r'\b\d3,\s*-\s*\d4\b', subject)) | Encode TLD as categorical (one‑hot) or assign

| # | Feature | Why it matters | Extraction | |---|---------|----------------|------------| |13| | www.mazabd.click is a new TLD ( .click ) frequently used by malicious actors. | tldextract.extract(subject).registered_domain | |14| Domain Age (in days) | Newly registered domains are riskier. | Use WHOIS API → creation_date → today - creation_date . | |15| Domain Reputation Score | Public blacklists (VirusTotal, Google Safe Browsing) give a numeric trust rating. | Query API → reputation_score . | |16| Top‑Level‑Domain (TLD) Popularity | .click , .xyz , .top are over‑represented in phishing. | Encode TLD as categorical (one‑hot) or assign risk weight (e.g., .com =0, others=1). | |17| Number of Sub‑domains | More sub‑domains → higher chance of URL‑shortening or obfuscation. | subject_url.count('.') - 1 . | |18| Presence of Hyphens in Domain | Hyphens are often used to mimic legitimate names ( mazabd ). | '−' in domain (boolean). | |19| URL Length | Very long URLs are suspicious. | len(url) | |20| URL Entropy | Randomly generated strings boost entropy. | Same entropy formula as above, applied to url . | |21| IDN / Punycode | Internationalised domain names can hide malicious domains. | url.startswith('xn--') . | |22| SSL Certificate Validity | Self‑signed or expired certs are a warning sign (if you later fetch the URL). | Use ssl / requests to check cert.notAfter . | |23| IP‑Address in URL | Direct IP links are uncommon in legitimate business mail. | re.search(r'\b\d1,3(?:\.\d1,3)3\b', url) . | 3. Structural / Formatting Features | # | Feature | Why it matters | Extraction | |---|---------|----------------|------------| |24| Number of Hyphens ( - ) | Overuse of hyphens often separates “spammy” tokens. | subject.count('-') | |25| Pattern of Numeric Tokens | The sequence 840 -2024 is a “number‑dash‑year” pattern typical of fake invoice titles. | Regex: r'\b\d3,\s*-\s*\d4\b' → boolean | |26| Presence of Ellipsis ( ... ) | Indicates truncation; spammers often hide the rest of a malicious URL. | subject.endswith('...') | |27| Bracket/Parentheses Ratio | Unbalanced punctuation is a heuristic for malformed messages. | subject.count('(') != subject.count(')') | |28| Whitespace Anomalies (multiple spaces, tabs) | Spam generators sometimes add extra spaces to bypass simple filters. | re.search(r'\s2,', subject) | |29| Encoding Flags (e.g., =?UTF-8?B?…?= ) | MIME‑encoded subjects can hide malicious strings. | Detect with email.header.decode_header . | |30| Subject Prefix / Tag Count | Tags like [Urgent] , [Notice] can be abused. | re.findall(r'\[.*?\]', subject) → count. | 4. Aggregated / Meta‑Features You can combine the raw values into risk scores :