Frequently Asked Questions
Answers to common questions about vspam.org. Can't find what you need? Contact us or check the API docs.
General
What is vspam.org?
A community-driven phishing intelligence clearinghouse. Submit, verify, and share IOC threat data via API, DNSBL, and STIX/TAXII feeds.
What types of IOCs can I report?
URLs, domains, IP addresses, and email addresses associated with phishing, spam, malware distribution, or C2 infrastructure.
Is vspam.org free?
Yes for non-commercial use — researchers, sysadmins, and open-source projects. Commercial use requires a license. Contact licensing@vspam.org.
Reporting & Voting
How does community voting work?
Registered users vote to confirm or reject reports. When enough trusted users confirm a report, it becomes confirmed and enters the DNSBL. This reduces false positives.
What are trust tiers?
New (default), Contributor (consistent accurate submissions), Verified (established track record), Trusted (highest tier — votes carry more weight). Tiers are earned through accurate reporting.
Can I submit reports anonymously?
Yes, but anonymous submissions are rate-limited to 10 per hour per IP and do not earn reputation points.
What happens after I submit a report?
It is enriched automatically (WHOIS, DNS, hosting lookup), then enters community review. Confirmed reports are published to the DNSBL and threat feeds.
DNSBL
How do I use the DNSBL?
Configure your mail server to query dnsbl.vspam.org. See our integration guides for Postfix, Exim, rspamd, and SpamAssassin. Integration guides
How do I check if I'm listed?
Use our lookup tool or query via DNS: dig <reversed-ip>.dnsbl.vspam.org TXT DNSBL Lookup
How do I get delisted?
Submit a removal request. Ensure the underlying issue is resolved before requesting removal. Request delisting
How often is the DNSBL updated?
Confirmed IOCs are synced to the DNSBL zone within minutes of confirmation.
API & Integration
Do I need an API key?
Public endpoints (lookup, search) do not require authentication. Submitting reports and accessing feeds requires an API key or JWT token.
What feed formats are available?
STIX 2.1, CSV, JSON, and TAXII 2.1.
Is there a rate limit?
Public endpoints are cached with reasonable limits. Authenticated users get higher quotas based on their trust tier.
Data & Privacy
How do you handle false positives?
Community voting filters bad reports. Reports rejected by the community are marked as false positives and removed from the DNSBL.
Can I appeal a listing?
Yes. Visit /delist to submit a removal request with evidence that the issue is resolved.
What data do you collect?
See our privacy policy for a full breakdown of what we collect, how we use it, and your rights. Privacy Policy
Still have questions?
Browse the documentation or reach out directly.