EndSpam
A community-run phone-number reputation service for Australia, built so that no single report can harm anyone.
Role — Product, design, engineering and operations
3+
Approved reports, from at least two independent people, before a number gets its own public page
0–100
Risk score you can inspect — report volume, independent reporters, recency and category
Keyed hash
Looked-up numbers are identified by a keyed hash — a lookup never saves the full digits
The problem
When a scam call arrives, the official advice is to report it — to Scamwatch, the ACMA or your telco. Those reports matter, but they disappear into aggregate statistics: the next person the same number calls can't see that it has already been reported. Caller-ID apps fill part of that gap, but behind installs, accounts and closed data, with patchy coverage of Australian numbers.
What we built
EndSpam is a free public register. Anyone can look up a number in a browser before calling back, and anyone who received an unwanted call or text can report it — no account required. Each public number page shows its evidence: how many independent people reported the number, what they reported it as, what they said in their own words, the carrier and area the number is allocated to, and practical steps to block it. Editorial guides cover the Australian scam-call landscape, from spotting a scam to what to do after being scammed.
Most of the engineering went into not getting it wrong. A community register can hurt a legitimate business or expose a private person, so the publication rules are structural rather than editorial. Nothing is published from a single report. A public page needs several independent reporters and a written description, and a verified owner claim or an upheld dispute takes the page down immediately.
Engineering notes
- A TypeScript API on Fastify and PostgreSQL, and a React site prerendered to static pages so number and guide pages load fast and can be indexed. It runs on Azure, with the infrastructure defined as code.
- Moderation runs before anything counts. Card numbers and one-time codes are blocked outright, other personal details and abuse go to a moderator, and Azure AI Content Safety adds a second check.
- Disclosure thresholds are enforced in code: a number shows only its last four digits until enough independent people have reported it, and only qualifying numbers reach the sitemap.
- Privacy is built in: numbers are normalised and identified by a keyed hash, and looking one up doesn't save its full digits.
- Reports from the same person or device count once, and the risk score weights recent reports more, so stale accusations fade.
- A native SwiftUI companion app that loads the moderated list into iOS call-blocking extensions is in development.
Screenshots
EndSpam on iPhone — number lookup above an explanation of how community reports work. 
EndSpam on iPhone — the About page explaining why the service exists. 
EndSpam on iPhone — a guide to identifying scam calls in Australia.
