I run CloudCracker, so I can add some color. 'English' dictionary jobs use dynamic models built by password compromises from english speaking users, augmented by the results of our own jobs (as well as occasional brute force jobs we run against a sample of handshakes which didn't crack).
The smaller 'English' dictionaries focus tightly on that. The larger 'English' dictionaries include the longer curve of those passwords, but also start to mix in the hot spots from other models, such as valid NANP numbers (which is what got this example).
The smaller 'English' dictionaries focus tightly on that. The larger 'English' dictionaries include the longer curve of those passwords, but also start to mix in the hot spots from other models, such as valid NANP numbers (which is what got this example).