System Status
Real-time health of vspam.org services and processing pipeline.
Infrastructure
Processing Pipeline
Verdict Engine
The Verdict Engine evaluates community votes using a weighted consensus algorithm. Reports are automatically confirmed or rejected based on the following thresholds:
| Condition | Result |
|---|---|
| 1 Trusted reporter confirms | Confirmed Phishing |
| 2 Contributor+ reporters confirm | Confirmed Phishing |
| 3 community members confirm | Confirmed Phishing |
| 1+ confirms (below threshold) | Under Review |
| Majority rejects (2+ total votes) | False Positive |
AI Analysis Pipeline
Every submission is automatically analyzed by our threat intelligence pipeline:
Resolves A, AAAA, MX, NS, TXT records. Identifies hosting provider and IP geolocation.
Looks up domain registrar, creation date, expiry, and registrant. Calculates domain age — newly registered domains are flagged as higher risk.
Scores URLs based on suspicious TLD, path entropy, brand impersonation patterns, homograph detection, and known phishing keywords.
Checks if reported URLs are still live, redirecting, or taken down. Tracks time-to-takedown metrics.
Captures page screenshots via headless browser. Detects login forms, brand logos, and urgency language for phishing classification.
Fingerprints HTML structure to identify known phishing kits. Clusters similar phishing pages across submissions.
About vspam.org system status
This page provides real-time health monitoring for all vspam.org services. Each component is polled every 30 seconds and displays current latency, uptime percentage, and error state. All timestamps are UTC.
Monitored services
- REST API — the primary interface for all IOC queries, report submissions, and account management at api.vspam.org.
- PostgreSQL database — stores all IOC records, user accounts, votes, and trust tier data.
- Redis cache — handles rate limiting, session state, and frequently accessed IOC lookups.
- DNSBL (PowerDNS) — the DNS-based blocklist that mail servers query in real-time to block phishing senders.
- Feed generation worker — background process that regenerates STIX, CSV, and JSON threat feeds on a scheduled interval.
Incident reporting
If you are experiencing issues not reflected on this page, contact support@vspam.org. For integrators, the API returns a health check at GET /health that can be used in your own monitoring pipeline. See the API documentation for details.