Frequently Asked Questions
Answers to common questions about vspam.org. Can't find what you need? Contact us or check the API docs.
General
What is vspam.org?
An operator-grade phishing and abuse reputation platform with community input. Submit, review, and share domain, IPv6, ASN, IP, and email intelligence through the API, DNSBL, and feeds.
What types of IOCs can I report?
Domains, IP addresses, IPv6 hosts, ASNs, and email addresses associated with phishing, spam, malware distribution, or C2 infrastructure. URL submissions are normalized to canonical domains for long-term phishing scoring.
Is vspam.org free?
Yes for non-commercial use — researchers, sysadmins, and open-source projects. Commercial use requires a license. Contact licensing@vspam.org.
Reporting & Voting
How does community voting work?
Registered users can confirm or dispute reports, and trusted users carry more review weight. Voting helps refine status and reduce false positives, but publication decisions increasingly also depend on deterministic scoring and feed policy.
What are trust tiers?
New (default), Contributor (consistent accurate submissions), Verified (established track record), Trusted (highest tier — votes carry more weight). Tiers are earned through accurate reporting.
Can I submit reports anonymously?
Yes, but anonymous submissions are rate-limited to 10 per hour per IP and do not earn reputation points.
What happens after I submit a report?
It is normalized, enriched automatically (WHOIS, DNS, hosting, ASN, and related context), then scored and reviewed. High-confidence artifacts can be published to the DNSBL and threat feeds according to the feed family's publication policy.
DNSBL
How do I use the DNSBL?
Configure your mail server to query dnsbl.vspam.org. See our integration guides for Postfix, Exim, rspamd, and SpamAssassin. Integration guides
How do I check if I'm listed?
Use the operator lookup for domains and ASNs, or use the exact-host IP RBL lookup for IPv4 and IPv6. DNS queries remain useful for direct DNSBL checks on infrastructure hosts. Operator Lookup
How do I get delisted?
Submit a removal request for an active DNSBL-listed artifact. Ensure the underlying issue is resolved before requesting removal. Contextual ASN and prefix-watch signals are handled through review policy, not direct self-service delist. Request delisting
How often is the DNSBL updated?
Confirmed IOCs are synced to the DNSBL zone within minutes of confirmation.
API & Integration
Do I need an API key?
Public endpoints such as operator lookup, IP RBL checks, and public search do not require authentication. Submitting reports and accessing authenticated feeds requires an API key or JWT token.
What feed formats are available?
STIX 2.1, CSV, JSON, and TAXII 2.1.
Is there a rate limit?
Public endpoints are cached with reasonable limits. Authenticated users get higher quotas based on their trust tier.
Data & Privacy
How do you handle false positives?
False positives are handled through review, confidence thresholds, and delist workflows. Community voting helps, but removal decisions also consider deterministic evidence and current publication policy.
Can I appeal a listing?
Yes. Visit /delist to submit a removal request with evidence that the issue is resolved. Approved appeals remove active DNSBL publication and mark the listing as false positive in review history.
What data do you collect?
See our privacy policy for a full breakdown of what we collect, how we use it, and your rights. Privacy Policy
Still have questions?
Browse the documentation or reach out directly.