Frequently asked questions

An operator-grade phishing and abuse reputation platform with community input. Submit, review, and share domain, IPv6, ASN, IP, and email intelligence through the API, DNSBL, and feeds.

Domains, IP addresses, IPv6 hosts, ASNs, and email addresses associated with phishing, spam, malware distribution, or C2 infrastructure. URL submissions are normalized to canonical domains for long-term phishing scoring.

Yes for non-commercial use — researchers, sysadmins, and open-source projects. Commercial use requires a license. Contact licensing@vspam.org.

Registered users can confirm or dispute reports, and trusted users carry more review weight. Voting helps refine status and reduce false positives, but publication decisions increasingly also depend on deterministic scoring and feed policy.

New (default), Contributor (consistent accurate submissions), Verified (established track record), Trusted (highest tier — votes carry more weight). Tiers are earned through accurate reporting.

Yes, but anonymous submissions are rate-limited to 10 per hour per IP and do not earn reputation points.

It is normalized, enriched automatically (WHOIS, DNS, hosting, ASN, and related context), then scored and reviewed. High-confidence artifacts can be published to the DNSBL and threat feeds according to the feed family's publication policy.

Configure your mail server to query dnsbl.vspam.org. See our integration guides for Postfix, Exim, rspamd, and SpamAssassin. Integration guides

Use the operator lookup for domains and ASNs, or use the exact-host IP RBL lookup for IPv4 and IPv6. DNS queries remain useful for direct DNSBL checks on infrastructure hosts. Operator Lookup

Submit a removal request for an active DNSBL-listed artifact. Ensure the underlying issue is resolved before requesting removal. Contextual ASN and prefix-watch signals are handled through review policy, not direct self-service delist. Request delisting

Confirmed IOCs are synced to the DNSBL zone within minutes of confirmation.

Public endpoints such as operator lookup, IP RBL checks, and public search do not require authentication. Submitting reports and accessing authenticated feeds requires an API key or JWT token.

STIX 2.1, CSV, JSON, and TAXII 2.1.

Public endpoints are cached with reasonable limits. Authenticated users get higher quotas based on their trust tier.

False positives are handled through review, confidence thresholds, and delist workflows. Community voting helps, but removal decisions also consider deterministic evidence and current publication policy.

Yes. Visit /delist to submit a removal request with evidence that the issue is resolved. Approved appeals remove active DNSBL publication and mark the listing as false positive in review history.

See our privacy policy for a full breakdown of what we collect, how we use it, and your rights. Privacy Policy