diff --git a/thesis/appendix.tex b/thesis/appendix.tex
index d463f958d712dc3a5d0951c56b526fcf5a37e9b9..2322bf46d3a7b8fad354d0408ec6ee14fe2b6400 100644
--- a/thesis/appendix.tex
+++ b/thesis/appendix.tex
@@ -73,6 +73,21 @@ The purpose of the coding was to gain insight into the specific tasks filters ar
     \hline
     \multirow{2}{*}{religiously\_motivated} & Disruptions on topics related to religion\\
                                      & Examples: 131 "Removal of controversial images" (see content; however this could fall under "image\_vandalism" as well)\\
+    \hline \hline
+        \multicolumn{2}{|l|}{Spam/malware/etc.} \\
+    \hline
+    \multirow{2}{*}{malware} & Malware is explicitely mentioned in the filter's name \\%TODO maybe combine phishing and malware
+                                     & Examples: 243 "WikiMedia Viewer possible malware"; 429 "Possible malware attack" <-- only two instances\\
+    \hline
+    \multirow{2}{*}{phishing} & Probably stuff that had "phishing" in their name\\
+                                     & Examples: 870 "nowiki phishing" <- only instance\\
+    \hline
+    \multirow{2}{*}{spam} & There is a "Spam" type of vandalism in the Wikipedia Vandalism Typology. However, I've got the feeling that I'm mostly labeling the cases listed there as "self promotion" or similar (although maybe not; This is the def: "    Adding text to any page that promotes an interest that benefits the user, except in user space in a manner allowable under Wikipedia's guidelines
+  Alternative: inserting links to promotional content, often not related to the content being edited (from chapter 5)
+    Adding external links to site(s) that promote an interest from which the user benefits
+    Adding external links to site(s) that have ads from which the user benefits, even if the site has information relevant to the article");
+  I've so far labeled "spam" foremost filters which contain the word in their name\\
+                                     & Examples: 862 "Arabic string spam";  523 "Page creation spammer";\\
     \hline \hline
         \multicolumn{2}{|l|}{General vandalism} \\
     \hline
@@ -117,21 +132,6 @@ Note: according to Wikipedia this behaviour constitutes harassment: "Posting ano
   Filter contains "sock", "sockpuppets", "sockpuppetry" or similar in their name ('af\_public\_comments') or maybe notes ("af\_comments"); expected to be mostly hidden filters (which may have been made public upon deletion or being disabled for example)
   Sockpuppetry is often long term abuse, but not necessarily all long term abuse involves sock puppetry \\
                                      & Examples: 16 "Prolific socker I"; 114 "sleeper socks";\\
-    \hline \hline
-        \multicolumn{2}{|l|}{Spam/malware/etc.} \\
-    \hline
-    \multirow{2}{*}{malware} & Malware is explicitely mentioned in the filter's name \\%TODO maybe combine phishing and malware
-                                     & Examples: 243 "WikiMedia Viewer possible malware"; 429 "Possible malware attack" <-- only two instances\\
-    \hline
-    \multirow{2}{*}{phishing} & Probably stuff that had "phishing" in their name\\
-                                     & Examples: 870 "nowiki phishing" <- only instance\\
-    \hline
-    \multirow{2}{*}{spam} & There is a "Spam" type of vandalism in the Wikipedia Vandalism Typology. However, I've got the feeling that I'm mostly labeling the cases listed there as "self promotion" or similar (although maybe not; This is the def: "    Adding text to any page that promotes an interest that benefits the user, except in user space in a manner allowable under Wikipedia's guidelines
-  Alternative: inserting links to promotional content, often not related to the content being edited (from chapter 5)
-    Adding external links to site(s) that promote an interest from which the user benefits
-    Adding external links to site(s) that have ads from which the user benefits, even if the site has information relevant to the article");
-  I've so far labeled "spam" foremost filters which contain the word in their name\\
-                                     & Examples: 862 "Arabic string spam";  523 "Page creation spammer";\\
     \hline \hline
         \multicolumn{2}{|l|}{} \\
     \hline \hline