Phishing infrastructure, made visible
vspam.org is an operator-grade phishing and abuse reputation platform for mail operators, sysadmins, and security researchers. Deterministic enrichment, historical evidence, reporter reputation, and community review produce domain, IPv6, IPv4, ASN, and email intelligence you can act on.
Make phishing infrastructure visible and actionable — without letting community voting become the sole source of truth. Enrichment decides what is provable; people decide what is disputed.
How it works
ingest → publish, four stagesURL submissions collapse to canonical domains at ingest. Exact IPv4 and IPv6 host reports keep their infrastructure precision — nothing is widened to a prefix.
DNS, WHOIS, hosting, brand, redirect, ASN, and history signals feed a deterministic model that outputs a verdict with explicit confidence and stated reasons.
Reporter trust, community review, and an open delist path catch novel abuse while pulling back false positives. Delisting needs no account.
High-confidence domains and exact hosts publish for blocking. IPv6 prefix and ASN output ships as watch and reputation feeds — deliberately not as block lists.
Trust tiers
earned by accuracy, not tenure| Tier | Vote weight | Requirements | Perks |
|---|---|---|---|
| New | 1× | Account created | Submit reports, cast votes — free rate-limit tier |
| Contributor | 2× | 100+ points (5/submit, 2/vote, +10 confirmed) | Verified rate-limit tier |
| Trusted | 4× | 500+ points — highest tier earned automatically | Trusted rate-limit tier |
| Verified | 5× | Manually vetted | Trusted rate-limit tier |
| Expert | 6× | Manually vetted | Trusted rate-limit tier |
| Admin | 8× | Platform staff | Full API scope |
Higher tiers carry more weight in review and get higher rate limits. They do not carry a veto: feeds and blocking recommendations are never decided by votes alone, and no single vote confirms an IOC.
Threat data is free for non-commercial use by researchers, sysadmins, and open-source projects. Commercial use requires a license. The platform core is AGPL-3.0 — you can run your own instance.
Infrastructure costs are covered by sponsors so the data stays free for the people who need it most.
A non-profit project funded by donations and sponsorship. No sponsor, at any amount, can add a listing, remove one, or see a verdict before the public does. Querying the list is free for everyone, with no registration and no fee.
No actor attribution. No country blaming — map geography is hosting location, a routing fact. No numeric threat score published per artifact. If a question needs data we don't measure, we say so instead of guessing.
Loading…
Report what your mail filter catches, review the queue, or help with code and docs. Volunteers do most of the review work — there is no paid analyst team behind the curtain.
Learn more
How scoring, confidence, feeds, and review decisions are made.
Step-by-step guide to submitting reports and integrating the API.
Configuration guides for Postfix, rspamd, SpamAssassin, Fail2Ban, and more.
Common questions about reporting, voting, DNSBL usage, and API access.