january/february 2007 looks like the time the list jumped from a few hundred to tens of thousands of sites.

That was the normal volume of manually identified sites at the time. Before 2007 there weren’t a lot of participants because it was in beta.

Malware may be easier to catch, but for phishing, it was fairly small (under 150k) until around 2016 where it starts growing linearly.