About oopspam
We've been fighting spam since 2017
oopspam is a small, independent team building spam and fraud protection that works without CAPTCHAs and respects your visitors' privacy. It started as a cybersecurity research project at a university in Rome. Today it protects millions of websites from our home in Minnesota.
- Founded in 2017
- Bootstrapped and independent
- No logs by default
- GDPR compliant
3.5M+
Protected websites
1B+
Spam messages caught
350M+
Emails and IPs in our blocklist
9 years
Stopping spam
Our story
From a thesis project to a product people rely on
Written by Onar Alili
Co-founder & Engineer
I started oopspam in 2017, while I was finishing my Master's degree at Sapienza University of Rome. My thesis was in cybersecurity, as part of PANOPTESEC, a research project funded by the European Commission.
oopspam began as a school project, and I published it as an open-source tool for anyone to use. Soon after, an agency asked for a few extra features and offered to pay for them. That first customer led to our first commercial release on RapidAPI in 2018. A year later we moved the API onto our own infrastructure, and oopspam turned from a side project into a real product.
The company began to take shape. Daniella Attinella joined as co-founder and created the oopspam brand you see today. And I learned far more about marketing than I ever expected to as a software engineer.
Today oopspam is based in Minnesota, along the Mississippi River. We are still a small, bootstrapped team. That means we answer to our customers rather than investors, and we can keep privacy at the centre of everything we build.
How we got here
Nine years of stopping spam
-
2017
A university project, released as open source
oopspam starts as a cybersecurity project at Sapienza University of Rome and is published as a free, open-source spam filter.
-
2018
The first commercial release
An agency asks for extra features and pays for them. The oopspam API launches commercially on RapidAPI.
-
2019
Our own infrastructure and the WordPress plugin
We start serving the API from our own infrastructure. The oopspam Anti-Spam plugin brings it to WordPress sites, with no CAPTCHA for visitors to solve.
-
2020–2021
Support for popular form plugins
The plugin adds support for Gravity Forms and Contact Form 7, followed by many more form and ecommerce plugins.
-
2024
Our first Annual Spam Report
We publish what we see across our network in the 2024 Annual Spam Report, and research card-testing attacks targeting WooCommerce checkouts.
-
2025
Context-aware spam detection
The API learns to judge a message against what your website is for, catching off-topic submissions that look human. The 2025 Annual Spam Report follows.
-
2026
OOPVulns
We launch OOPVulns, a WordPress plugin that scans your site for known security vulnerabilities.
Research
Built on research, not guesswork
oopspam grew out of academic cybersecurity work, and we still approach spam the same way: as a problem to measure, not just block. No single check catches every kind of spam, so the API combines several signals and weighs them together.
- Machine learning models that read the content of each message
- A blocklist of 350M+ known spammer emails and IP addresses
- Context-aware checks against what your website is for
- Detection of VPNs, proxies and data-center IP addresses
- Disposable and fake email address detection
- Language and country filters you control
Report
2025 Annual Spam Report
The largest card-testing attack wave we've seen, residential proxy threats and the spam trends behind them.
Report
2024 Annual Spam Report
Top spam sources, the industries most targeted, and practical ways to fight back.
Research
Card testing through WooCommerce checkout
How attackers abuse block-based checkout to test stolen cards, and how to stop it.
What we stand for
How we build oopspam
No CAPTCHAs
Puzzles annoy real people, shut out people using assistive technology, and cost you sign-ups. Our checks run on the server, so your visitors never see them.
Privacy by default
We don't log the messages we check unless you turn logging on. oopspam is GDPR compliant, with a Data Processing Agreement for every customer.
Independent
We're bootstrapped. No investors push us to grow at any cost, so we can price fairly and keep building what our customers actually ask for.
The team
The people behind oopspam
Onar Alili
Co-founder & Engineer
Onar builds the detection behind the oopspam API and plugins. He studied cybersecurity at Sapienza University of Rome, and writes and reviews the technical guides on our blog.
And the people who help us
Beyond the two of us, oopspam is built with help from a small group of collaborators. If you think your skills could help us fight spam, we'd love to hear from you.
Try oopspam on your own forms
Start with free spam checks. No credit card required.
