This article presents UnSpoof, an ultrawideband localization system that can detect and localize distance-spoofing tags with a few collaborative passively receiving anchors. We propose novel formulations that enable passively receiving anchors to deduce their time-of-flight (ToF) and time-difference-of-arrival (TDoA) just by overhearing standard two-way ranging messages between the tag and one active anchor. Our ToF formulation can be used to precisely localize an honest tag, and to detect a distance-spoofing tag that falsely reports its timestamps. Additionally, our TDoA formulation enables spoofing deterrent localization, which can be used to track down and apprehend a malicious tag. Our experimental evaluation shows a 30-cm percentile error for ToF-based honest tag localization and a submeter error for TDoA-based localization for spoofing tags. We demonstrate successful detection of distance reduction and enlargement attacks inside the anchors' convex hull and graceful degradation outside. In addition, we show the effects of a nonregular geometry of anchors and invite researchers and practitioners to experiment with anchor topologies of interest to them via our open source modeling software.