---
title: Datasets · MailWeft
description: See where the 31,563 emails come from.
---

MailWeft's data is 31,563 real emails, 10,205 phishing and 21,358 legitimate, plus 4,816 constructed notification emails. Of the real emails, 2,194 from 2026 are kept for a final test that has not been run yet. The emails are not stored in the repository; a script downloads the public ones and checks their hashes.

## Sources

| Source | Label | Years | Emails | License |
| --- | --- | --- | --- | --- |
| [Nazario phishing corpus](https://monkey.org/~jose/phishing/) | Phishing | 2015–2025 | 3,013 | CC BY 4.0 |
| [Phishing Pot](https://github.com/rf-peixoto/phishing_pot) | Phishing | 2019–2026 | 7,192 | CC BY-NC 4.0 |
| [SpamAssassin public corpus](https://spamassassin.apache.org/old/publiccorpus/) | Legitimate | 2002 | 4,098 | Senders keep copyright |
| [Enron-derived mail](https://huggingface.co/datasets/renemel/compiled-phishing-dataset) | Legitimate | Undated | 14,803 | CC BY-SA 4.0 |
| Team inbox, automated mail only | Legitimate | 2023–2026 | 2,457 | Private |
| Constructed notification pairs | Both | — | 4,816 | Built from open source templates |

Counts are emails kept after removing empty messages, exact copies and near copies, with at most 5% of inbox mail from any one sender domain.

About a quarter of Phishing Pot is commercial spam rather than phishing. The Enron-derived mail is body text only, with no headers. The inbox mail is private, and only its counts are published.

## Split by date

Models train on older mail and are tested on newer mail, so the test looks like mail they would meet next.

| Use | Years |
| --- | --- |
| Train the text models | Nazario 2015–2023, SpamAssassin, Enron-derived |
| Fit B3 | Phishing Pot up to 2023, inbox 2023–2024, half of the notification pairs |
| Choose models | Nazario and Phishing Pot 2024, with legitimate mail |
| Set the alert lines | Kept-aside legitimate mail, inbox 2025 |
| Test | Nazario, Phishing Pot and inbox 2025 (1,132 emails) |
| Final test, scored once | Phishing Pot and inbox 2026 |

Near copies are grouped so that no group crosses from training into a test.

## Notification pairs

Each pair is the same service notification, such as a password reset from Supabase or Discourse, with and without an inserted scam request. The 4,816 emails are 2,240 with a scam and 2,576 without. Notifications from Discourse are kept out of training to test an unseen provider.

## Scam memory

The memory on this site holds Phishing Pot and Nazario emails and 28 emails from public security-team reports (13 from UC Berkeley, 12 from Stanford University IT and 3 from SANS ISC), each kept with its source link.