new phishing rules (no more eval), add usage histogram recording end point