Guys, A retired SARE Ninja is autogenerating SA phishing rules on https://sourceforge.net/projects/sare/. Too bad that atm, the phish corpus is very small so its hit rate will be limited until there's more samples to use for rule generation. If you can contribute with pristine phishing samples on a regular basis, please contact me offlist. Thanks Alex