I'm working on a little project trying to see if I can predict the likelihood that an email is in fact a security risk (phishing, spam, social engineering, etc).

I order to do this I need to have a lis of examples I could use to understand "spam", "phishing" or "social engineer" language.

I'm planning to focus on english language emails.

Are there any databases that contain examples of:
- spam email (my spam box is very mixed, and I might have some valid emails in there.
- phishing emails (or spear phishing)
- emails marked as social engineering attacks.

  • Hi Florin - it's always worth having a quick search to see if your question has already been asked...
    – Rory Alsop
    Commented Mar 15, 2016 at 13:58
  • 1
    @RoryAlsop, I did look around. I'm not interested in targeted attacks like the other post. I am interested in anything.
    – sir_k
    Commented Mar 15, 2016 at 14:52

1 Answer 1


Assuming you're using some sort of machine learning (and even if you're not), you'll need an up-to-date distraction corpus as well (in the anti-spam industry, we call desired mail "ham" because it's easier to say than "non-spam"), and that will –by far– be your biggest challenge.

One starting point on your road to attracting spam could be this old Stack Overflow request for a Publicly Available Spam Filter Training Set or this old Stack Overflow Brainstorm: How to quickly create a honeypot for mass spam? (deleted; see archived copy). While both are off-topic for Stack Overflow, that might not be the case here.

Another starting point is the SpamAssassin public corpus, though at this point it's 10+ years old.

There are other techniques for attracting spam and ham, too. Search for seeding a spam trap and you'll find tons of advice from anti-spam experts and email service providers.

Generally speaking, it's a lot of effort to collect a good corpus that will help you predict how to filter new spam. It's significantly harder to collect proper samples of phishing, advance-fee fraud, and other targeted spam. I've already mentioned that collecting non-bulk ham will also be a challenge, but if you're trying to calibrate to catch phishing, you'll need to make sure your ham corpus contains lots of legitimate non-marketing mail related to finance and account maintenance.

Your best bet is to team up with somebody in the industry who already has good data.

This could include free software communities like that of SpamAssassin. If you can instantiate your work as a logical combination of regular expressions (SpamAssassin rules), you can get the SpamAssassin QA system to run your combinations against its own corpora. This will require licensing your work as Apache License v2 so that it can be used by SpamAssassin itself.

The Anti-Phishing Working Group (APWG) has lots and lots of phishing samples, though you may have to pay for them (unless you're working on a paper for their eCrime Symposium?)

Project Honeypot also has a good collection of spam (though they won't have ham). You might be able to work with them.

Not the answer you're looking for? Browse other questions tagged .