Data Card — Phishing Email Corpus

Auto-generated by data_prep.py on 2026-07-07T14:12:01.160069+00:00 (seed 42).

Source

Combined public phishing/legitimate email corpus (Kaggle naserabdullahalam/phishing-email-dataset) — CEAS_08, Ling, Nazario, Nigerian_Fraud, SpamAssassin — plus a raw re-download of Enron (wcukierski/enron-email-dataset, sampled to 15,070 rows, seed 42) that replaces the packaged Enron file.

Files are merged by column name (column order differs between files). The packaged aggregate phishing_email.csv and the old flattened Enron.csv are excluded (leakage + destroyed casing/punctuation).

Size & class balance (Track A, after cleaning/dedup)

Final rows: 67,472. Label convention: 0 = legitimate, 1 = phishing.

source	rows	legit	phishing
Enron_raw	15,070	15,070	0
CEAS_08	38,947	17,274	21,673
Ling	2,856	2,401	455
Nazario	1,539	0	1,539
Nigerian_Fraud	3,272	0	3,272
SpamAssasin	5,788	4,077	1,711

Splits (stratified 70/15/15 by label, seed 42)

Track B = Track A minus Ling (see bias note), same split assignments.

Track A	Track B
	split	rows	legit	phishing
	train	47,230	27,175	20,055
	val	10,120	5,823	4,297
	test	10,122	5,824	4,298

Track B: train 45,246 / val 9,680 / test 9,690.

Cleaning applied

HTML stripped only when tags present; leaked email-header remnants, mbox separators and forwarding banners removed; whitespace normalized. Casing and punctuation preserved (they are urgency/tone signal, not noise). Dropped: 82 noise row(s), 1 empty-after-clean, 964 near-duplicates.

Known limitations & biases

• Ling is still flattened (lowercased/punct-stripped in the packaged data). It is kept in Track A but excluded from Track B, which is the only track used to calibrate casing/tone/punctuation features.
• Enron_raw legit baseline is corporate American English (~2000–2002) with signature blocks and trading acronyms — may not generalize to consumer/personal email. Its uppercase ratio runs slightly high for this reason (genuine, not an artifact).
• Source correlates with label: Nazario & Nigerian_Fraud are 100% phishing; Ling & SpamAssassin are legit-heavy. Always report per-source metrics so the classifier isn’t just learning “corporate Enron style = legit”.
• HTML is largely pre-stripped → anchor-text-vs-href link mismatch is mostly not extractable; live URL reputation is out of scope.
• The urls column in some sources is a has-URL 0/1 flag, not a label.