Activity

Submissions, confirmations, and community votes in order — the same event stream the API emits.

Polling

Interpret activity carefully

Activity is a live operations signal, not a blocklist. A new submission, vote, or confirmation should usually trigger a pivot into the IOC detail, shadow score, confidence, and feed family before you enforce on a domain, IPv6 host, prefix, or ASN.

Events shown

Consume the stream

This page connects with a browser session. Scripts and integrations authenticate the same endpoint with an API key instead — no JWT or query-param token needed.

bash

curl -N -H "X-API-Key: $VSPAM_API_KEY" \
  "https://api.vspam.org/api/v1/events"

Each line is event: <type> followed by a data: line of JSON — the same three event types shown on the left: report:new, report:status, vote:new.

Reading the stream

A submission is a claim, not a verdict. Only a confirmation changes what an operator should act on — check the IOC detail before you enforce.