System Status
Real-time health of vspam.org services and the scoring, review, and publication pipeline.
Infrastructure
Scoring & Publication Pipeline
Current Report Workflow
Report status transitions still use weighted community review and manual actions. Feed publication and blocking recommendations now also consider score-aware policy, but the workflow thresholds below remain the current report-status rules:
| Condition | Workflow status |
|---|---|
| 1 Trusted reporter confirms | Confirmed |
| 2 Contributor+ reporters confirm | Confirmed |
| 3 community members confirm | Confirmed |
| 1+ confirms (below threshold) | Under Review |
| Majority rejects (2+ total votes) | False Positive |
Scoring Policy
Core publication decisions are deterministic and explainable. The main evidence stages are:
Convert submissions into a stable artifact. Domains are the primary phishing artifact; URL path and query detail are kept only as short-lived enrichment evidence.
Resolve records, registrar, age, ASN, hosting provider, redirects, and related domain context for each artifact.
Score direct evidence, historical observations, domain risk, IPv6 neighborhood context, and ASN reputation with explicit reasons and confidence.
High-confidence domains and exact hosts can be listed for blocking. IPv6 prefix and ASN feeds are published primarily as watch or reputation context.
Reporter trust, voting, manual review, and delist requests help resolve ambiguous cases and prevent persistent false positives.
About vspam.org system status
This page provides real-time health monitoring for all vspam.org services. Each component is polled every 30 seconds and displays current latency, uptime percentage, and error state. All timestamps are UTC.
Monitored services
- REST API — the primary interface for all IOC queries, report submissions, and account management at api.vspam.org.
- PostgreSQL database — stores all IOC records, user accounts, votes, and trust tier data.
- Redis cache — handles rate limiting, session state, and frequently accessed IOC lookups.
- DNSBL (PowerDNS) — the DNS-based blocklist that mail servers query in real-time to block phishing senders.
- Feed generation worker — background process that regenerates STIX, CSV, and JSON threat feeds on a scheduled interval.
Incident reporting
If you are experiencing issues not reflected on this page, contact support@vspam.org. For integrators, the API returns a health check at GET /health that can be used in your own monitoring pipeline. See the API documentation for details.