The Spamhaus Project - Frequently Asked Questions (FAQ)

The Register of Known Spam Operations (ROKSO) is a register of spam senders and spam services that have been thrown off Internet Service Providers 3 times or more in connection with spamming or providing spam services, and are therefore repeat offenders. Spamhaus believes that these known determined professional spam operations are responsible for approximately 80% of spam on the Internet.

The ROKSO database collates information and evidence on each spam operation to assist ISP Abuse Desks and Law Enforcement Agencies.

The existence of these known professional spammers, the aliases and shell companies they use to obtain ISP accounts, their methods and history is vital need-to-know information for the protection of internet networks.

The current list of ROKSO spammers is located at this webpage.

How does one get listed in ROKSO?

ROKSO is a "3 strikes" register. We do not list first-time, inadvertent spammers or inexperienced marketing departments spamming 'by mistake'. To get to 3 strikes (3 terminations for spam offences such as emailing spam, hosting spammers, selling spamware) requires a very determined spam outfit.

Being thrown off an ISP takes a lot of doing, very few customers are thrown off an ISP without having been given warnings or chances to stop violating the ISPs Terms of Service. Being thrown off ISPs *twice* for spam offences means the spammer is determined, knows the consequences, and has actually signed up to a new ISP with the specific intention of breaking the ISPs Terms of Service. Being thrown off *three* ISPs for spam offences means the spammer is a committed hard-line spam operation that regards ISPs as simply throwaway resources.

A termination (strike) is assigned to a spam operation when any account for Internet services used by the spam operation or any entity acting on behalf of or in concert with it is terminated for abuse by the host or upstream provider.

What effect does a ROKSO listing have?

Once listed on ROKSO, all IP addresses determined to be under the control of the listed entity are preemptively listed in the Spamhaus Block List (SBL), regardless of whether spam is emanating from them or not. Timeouts for ROKSO SBL records become indefinate (the ROKSO listing overides any expiry/timeout of the SBL record). SBL records belonging to ROKSO spammers appear in Yellow "(Alert)" in SBL listings pages and are prioritised for urgent attention by ISPs.

A listing on ROKSO means that the spammer or spam gang's activites are brought to the attention of Cybercrimes units of Law Enforcement Agencies Spamhaus works with in the spammer's country. Many Law Enforcement Agencies have specially-arranged access to 'classified' non-public ROKSO records and use ROKSO data to help track down and bring to justice spammers violating any number of laws when spamming.

Many Internet networks use ROKSO to vet prospective customers or check if suspicious customers are listed before granting connectivity and IP space. ROKSO is an invaluable tool for Abuse Desks and legal departments of ISPs looking for information linking spams reported to the spammers behind them.

In addition many Internet networks nowadays include clauses in their Acceptable Use Policies/Terms Of Service which specify that being listed on ROKSO is grounds for termination of the customer's account (specific clauses visible here).

How long do ROKSO records last?

ROKSO records are not permanent. If no new information is added to a spammer's records after a period of 6 months, all of that spammer's ROKSO records are made "dormant" (removed from public view).

For spammers, this means that if you decide you want to stop spamming and build a legitimate career for yourself before you permanently ruin your name and future career on the Internet, all information about you in ROKSO will disappear from public view 6 months after we are certain you have stopped any spam related activities.

If you resume spamming, any new information on you submitted to ROKSO (such as a spam sample or anything even remotely connected to you) automatically makes all of your "dormant" records "live" again for another 6 months, and so on.

There is an exception to this regarding spammers who have been incarcerated or indicted. We find that most spammers in jail or prison, or on trial, are parts of larger criminal organizations and keeping their records visible to legal entities helps complete investigations.

How do I get off ROKSO?

To be removed from the ROKSO database you need to cease any spam activities you are engaged in. Spam activities include spamming, providing spam support services, servers or spamware to other spammers.

You then need to remain unconnected with spamming for at least 6 months. Spamhaus is constantly updating ROKSO with information from many sources, therefore any new information linking you with spamming extends the life of your ROKSO record for a further 6 months.

If you have honestly and permanently ceased any connection with spam activities, you can request a review of your ROKSO records by emailing the ROKSO Review Team at: rokso-review(at)spamhaus.org.

There's a mistake in my ROKSO listing, will you fix it?

We do our best to ensure that data submitted to ROKSO is correct, comes from a public domain source, and that any errors are corrected as soon as we are made aware of them.

However, correcting what a spammer claims is an 'error' is not as straight forward as it may seem, since spammers are not people known for honesty; in fact they are almost all con men, fraudsters and chronic liars. Spamhaus regularly receives letters from spammer's lawyers attempting to claim that all of a spammers records are in error and demanding all therefore be removed. We naturally pay little attention to such requests. A request by a spammer for correction of a record must point to exactly what information is in error and must include verifiable proof that the error is indeed an error.

How many ROKSO spam operations are there?

For several years the number of known professional spam operations in the ROKSO List has been in the range of 100 to 150 outfits.

Each spam operation consists of one or more spammers working together with partners ("partner-in-spam"), associates, affiliates or spam-friendly host operators and therefore "100" spam operations can consist of perhaps 1,000-1,500 individuals. Each spam operation has ever-changing aliases, domains, and hosting as spammers attempt to disguise their opperations.

The "100" number tends to remain steady over the years due to the turnover of ROKSO spam operations that are either put out of business, or who, through lack of networks willing to host them due to their ROKSO history, or through genuine change of direction, decide to quit the spam business.

Since January 2000, over 450 former spam operations have spent time in and been removed from ROKSO. The vast majority of these have never been heard of again. Encouragingly, some have gone on to become responsible bulk email marketing firms and we wish them well.

What extra ROKSO information is available to Law Enforcement?

In addition to the records visible on the 'public' ROKSO site, ROKSO has 'classified' sections on many of the listed spammers which contain information too sensitive to be published. These 'classified' records include data on criminal activities and evidence for use in prosecution.

Agencies with password-protected access to a secure 'classified' version of ROKSO include:

Spamhaus is a member of the international forum for anti-spam enforcement authorities; London Action Plan (LAP) and therefore works and exchanges data with all LAP member agencies.

For qualified Law Enforcement Agencies we are happy to arrange access to the classified parts of ROKSO. To obtain access, contact Spamhaus (you must contact us from a LEA email address).

UK Data Protection Act 1998 Compliancy
	ROKSO is a free-access public register maintained by a non-profit organization and as such is exempt from notification under the UK Data Protection Act 1998.