Datasets
See where the 31,563 emails come from.
MailWeft’s data is 31,563 real emails, 10,205 phishing and 21,358 legitimate, plus 4,816 constructed notification emails. Of the real emails, 2,194 from 2026 are kept for a final test that has not been run yet. The emails are not stored in the repository; a script downloads the public ones and checks their hashes.
Sources
| Source | Label | Years | Emails | License |
|---|---|---|---|---|
| Nazario phishing corpus | Phishing | 2015–2025 | 3,013 | CC BY 4.0 |
| Phishing Pot | Phishing | 2019–2026 | 7,192 | CC BY-NC 4.0 |
| SpamAssassin public corpus | Legitimate | 2002 | 4,098 | Senders keep copyright |
| Enron-derived mail | Legitimate | Undated | 14,803 | CC BY-SA 4.0 |
| Team inbox, automated mail only | Legitimate | 2023–2026 | 2,457 | Private |
| Constructed notification pairs | Both | — | 4,816 | Built from open source templates |
Counts are emails kept after removing empty messages, exact copies and near copies, with at most 5% of inbox mail from any one sender domain.
About a quarter of Phishing Pot is commercial spam rather than phishing. The Enron-derived mail is body text only, with no headers. The inbox mail is private, and only its counts are published.
Split by date
Models train on older mail and are tested on newer mail, so the test looks like mail they would meet next.
| Use | Years |
|---|---|
| Train the text models | Nazario 2015–2023, SpamAssassin, Enron-derived |
| Fit B3 | Phishing Pot up to 2023, inbox 2023–2024, half of the notification pairs |
| Choose models | Nazario and Phishing Pot 2024, with legitimate mail |
| Set the alert lines | Kept-aside legitimate mail, inbox 2025 |
| Test | Nazario, Phishing Pot and inbox 2025 (1,132 emails) |
| Final test, scored once | Phishing Pot and inbox 2026 |
Near copies are grouped so that no group crosses from training into a test.
Notification pairs
Each pair is the same service notification, such as a password reset from Supabase or Discourse, with and without an inserted scam request. The 4,816 emails are 2,240 with a scam and 2,576 without. Notifications from Discourse are kept out of training to test an unseen provider.
Scam memory
The memory on this site holds Phishing Pot and Nazario emails and 28 emails from public security-team reports (13 from UC Berkeley, 12 from Stanford University IT and 3 from SANS ISC), each kept with its source link.