Methodology
vspam.org is designed as operator-grade reputation with community input. The core scoring path is deterministic and explainable: domain-first for phishing, IPv6-first for infrastructure, and ASN-aware for provider context. Community reports, trust tiers, votes, and delist requests still matter, but they do not act alone — blocking, watch, and context feeds are intentionally separated so operators can map each output to the right workflow.
Phishing URLs are collapsed to canonical domains at ingest. Short-lived path, redirect, and form signals are retained only as enrichment evidence.
Exact IPv6 hosts are scored separately from /64, /56, and /48 neighborhood context to avoid blanket overlisting across large allocations.
ASN reputation is a supporting signal that helps prioritize investigation and contextualize abuse density without becoming a sole blocking authority.
Reporter trust, voting, and delist workflows influence review and confidence, but deterministic evidence and historical context carry the main detection load.
A high score with narrow corroboration is not the same finding as a high score with broad corroboration. The pair decides which feed an artifact publishes to.
Scoring flow
Steps 01–03 deterministic · 04–05 review and policyNormalize the submission into the artifact we actually score. Domains are first-class phishing artifacts. IPv4, IPv6 exact hosts, email indicators, and ASNs retain their native forms.
Collect DNS, registrar, hosting, ASN, redirect, brand, and related infrastructure context. Observations are stored so repeated sightings improve score quality over time.
Combine direct evidence, historical observations, domain history, reporter quality, IPv6 neighborhood evidence, and ASN context into an explainable score and confidence value.
Community votes, manual review, and delist handling resolve low-confidence or disputed cases. Review affects publication state and future trust, not just a single report row.
Each feed family declares its publication thresholds, artifact scope, and recommended action so operators can separate block decisions from watch and context signals.
Publication policy by feed family
Feed catalog →Publication thresholds and recommended actions are exposed in the feed catalog and export metadata. The table below describes the intended use of the main operator-facing families.
| Feed family | Primary evidence | Recommended action | Intent |
|---|---|---|---|
| Domain high-confidence phishing | Strong deterministic score, corroborating domain history, and enough confidence for direct enforcement. | Direct block or active quarantine. | direct_block |
| IPv6 exact-host malicious | Exact /128 evidence plus bounded infrastructure context. Neighbor signals can help, but they do not outweigh weak direct evidence. | Direct block of the exact host only. | direct_block |
| IPv6 prefix watch | Elevated /64, /56, or /48 neighborhood risk, sparse exact-host history, or recurring abuse patterns within a larger allocation. | Investigate, prioritize review, or use as a local policy hint. Not a blanket blocklist by default. | watch |
| ASN reputation | Recent abuse density, recovery behavior, and historical provider context derived from scored artifacts and enrichment. | Use for prioritization, routing policy, throttling, or analyst context. Do not block solely on ASN reputation. | context |
| Policy and context feeds | Operator-tunable policy inputs, deltas, or context datasets that are intentionally separate from threat verdict feeds. | Use according to your own local policy and change control process. | policy |
Confidence, review, and appeals
High score with low confidence should not be treated the same as high score with broad corroboration. vspam uses score and confidence together to decide whether an artifact belongs in a blocking, watch, or context feed.
Reporter trust and community review remain part of the product because operators need a path for human correction, consensus building, and post-publication refinement.
Appeals and delist requests are treated as first-class quality signals. They matter both for the current listing decision and for future trust in the same reporter, artifact, prefix, or ASN.
Removal is driven by events, not by a clock. A listing ends when the site checker observes the content taken down, when a delist request is approved, or when community dispute or an admin override overturns it. There is no maximum age. A phishing domain that is still serving is still dangerous however long it has been listed, and expiring entries on a timer would quietly unlist live threats — so an entry stays until something establishes that it should not. The cost of that choice falls on re-registered domains, which is what delisting exists for: no account, no fee, reviewed by a person.
Use the right surface
If you are integrating vspam into mail or abuse operations, start with feed metadata and recommended actions rather than assuming every export is a direct blocklist.
See publication thresholds, recommended actions, and artifact scopes.
Use score-aware lookups, search filters, and feed endpoints in automation.
Inspect why a domain, IPv6 host, or ASN was scored the way it was.
Request removal when an artifact has recovered or was listed incorrectly.