vspam.org vs PhishTank
PhishTank is a long-running community phishing database centered on URL submissions and verification. vspam.org is built for mail operators and abuse teams, with domain-first phishing intelligence, IPv6-first infrastructure handling, score-aware feeds, and operator workflows. Both benefit from community input, but they model artifacts and publishing decisions very differently.
What vspam is optimized for
Phishing URLs are normalized into canonical domains for long-term scoring and feed publication.
Exact hosts and prefix-watch signals are kept separate so large allocations are not over-blocked.
Provider reputation supports analyst and scoring decisions without overwhelming direct artifact evidence.
Feeds expose thresholds and recommended actions so operators can distinguish direct blocklists from watch and context outputs.
Feature comparison
9 Features| Feature | vspam.org | PhishTank |
|---|---|---|
| Primary phishing artifact | Domain-first (URLs normalized to domains) | URL-first |
| Infrastructure scope | Domains, IPv4, IPv6, ASNs, emails | Phishing URLs |
| IPv6 exact-host and prefix context | Yes | Not a primary public workflow |
| DNSBL integration | Native DNSBL and mail-agent workflows | Not available |
| Feed policy transparency | Explicit thresholds and recommended actions | Community verification, no operator feed taxonomy |
| STIX/TAXII | Yes | No |
| Community review model | Trust-weighted review plus deterministic scoring | Community verification |
| Operator tooling | Lookup, feeds, firewall surfaces, mail agent | URL checks and feed/API access |
| Open source platform | AGPL-3.0 | No |
vspam.org strengths
PhishTank strengths
Choose vspam.org when you need operator-grade phishing handling beyond raw URLs: domain-first intelligence, IPv6-aware infrastructure context, score-aware feeds, and direct mail or firewall integration.
Choose PhishTank when your workflow is primarily URL-centric and you want a long-established community source for phishing URL lookups.
org is the better fit when your real operational question is whether to block, watch, or investigate a domain or related infrastructure. The two can coexist, but they are optimized for different decisions.