IP and Domain Reputation Checker
About Spamhaus  |  FAQs  |  News Blog   
Frequently Asked Questions (FAQ)
General Questions
Hacked... Here's help
ISP Spam Issues
Legal Questions
Marketing FAQs
Online Scams
Spamhaus BCL
Spamhaus CSS
Spamhaus DBL
Spamhaus HBL
Spamhaus PBL
Spamhaus SBL
Spamhaus XBL
Spamhaus DROP
 » BGPf FAQs
 » Datafeed FAQs


What is ROKSO?
How does one get listed on ROKSO?
What effect does a ROKSO listing have?
Are all the ROKSO listed entities spammers?
Are all the ROKSO listed spammers cybercriminals?
How do I get off ROKSO?
How long do ROKSO records last?
There's a mistake in my ROKSO listing, will you fix it?
How many ROKSO spam operations are there?
What extra ROKSO information is available to Law Enforcement?

What is ROKSO?
The Register of Known Spam Operations (ROKSO) is a register of spam senders and spam services that have been thrown off Internet Service Providers 3 times or more in connection with spamming or providing spam services, and are therefore repeat offenders. Spamhaus believes that these known determined professional spam operations are responsible for approximately 80% of spam on the Internet.

The ROKSO database collates information and evidence on each spam operation to assist ISP Abuse Desks and Law Enforcement Agencies.

The existence of these known professional spammers, the aliases and shell companies they use to obtain ISP accounts, their methods and history is vital need-to-know information for the protection of internet networks.

The current list of ROKSO spammers is located at this webpage.

How does one get listed on ROKSO?
ROKSO is a "3 strikes" register. We do not list first-time, inadvertent spammers or inexperienced marketing companies spamming 'by mistake'. To get to 3 strikes (3 terminations for spam offences such as emailing spam, hosting spammers, selling spamware) requires a very determined spam outfit.

Being thrown off an ISP (newtork, provider or webhost) takes a lot of doing, very few customers are thrown off an ISP without having been given warnings or chances to stop violating the ISPs Terms of Service. Being thrown off ISPs *twice* for spam offences means the spammer is determined, knows the consequences, and has actually signed up to a new ISP with the specific intention of breaking the ISPs Terms of Service. Being thrown off *three* ISPs for spam offences means the spammer is a committed hard-line spam operation that regards ISPs as simply throwaway resources.

A termination (strike) is assigned to a spam operation when any account for Internet services used by the spam operation or any entity acting on behalf of or in concert with it is terminated for abuse by the host or upstream provider.

What effect does a ROKSO listing have?
Once listed on ROKSO, all IP addresses determined to be used by or under the control of the listed entity are preemptively listed in the Spamhaus Block List (SBL), regardless of whether spam is emanating from them or not. All domains determined to be under the control of the listed entity are preemptively listed in the Domain Block List (DBL).

Timeouts for ROKSO SBL records become indefinate (the ROKSO listing overides any expiry/timeout of the SBL record). SBL records belonging to ROKSO spammers appear in Yellow "(ALERT)" tags in SBL listings pages and are prioritised for urgent attention by ISPs.

Many Internet networks use ROKSO to vet prospective customers or check if suspicious customers are listed before granting connectivity and IP space. ROKSO is an invaluable tool for Abuse Desks and legal departments of ISPs looking for information linking spams reported to the spammers behind them.

In addition many Internet networks nowadays include clauses in their Acceptable Use Policies/Terms Of Service which specify that being listed on ROKSO is grounds for termination of the customer's account (specific clauses visible here).

Are all the ROKSO listed entities spammers?
No. We also list spam-supporting groups or companies. Thus the use of the word "Operations" in ROKSO (Register of Known Spam Operations).

In our policies, the enabling of abusive behavior by supporting it by providing hosting or tools is considered the same as the spamming or related direct abusive activities. Most internet users feel spamming of any type is wrong and should be stopped. We work to empower them to this achieve goal.

Are all the ROKSO listed spammers cybercriminals?
No. The spammers and spam-support groups listed in ROKSO may be breaking laws, but in some nations there are no laws against spamming and in other nations the laws are weak and allow spamming in some forms.

The Spamhaus project is not in any way a law-enforcement entity, we provide information and advisories to our users and to visitors of our website. Most internet users feel spamming is wrong and should be stopped, criminal or not. We work to empower them to this achieve goal.

How do I get off ROKSO?
To be removed from the ROKSO database you need to cease any spam activities you are engaged in. Spam-related activities include spamming, providing spam support services, servers or spamware to other spammers.

You then need to remain unconnected with the spam industry for at least 6 months. Spamhaus is constantly updating spammer profiles with information from many sources, including sources inside the spam industry. Any new information linking you with spamming, or with other known spammers, extends the life of your ROKSO record for a further 6 months.

If 6 months have passed since your last involvement in spam-related activities and you have honestly and permanently ceased any connection with spam activities, you can request a review of your ROKSO records by emailing the ROKSO Review Team at: rokso-reviews(at)spamhaus(dot)org. In your request you must confirm to us that you are no longer connected with the spam industry in any way.

How long do ROKSO records last?
ROKSO records are not permanent. If no new information is added to a spammer's records after a period of 6 months, all of that spammer's ROKSO records are made "dormant" (removed from public view).

For spammers, or spam-support operations, this means that if you decide you want to stop spamming or supporting it and build a legitimate career for yourself before you permanently ruin your name and future career on the Internet, all information about you in ROKSO will disappear from public view 6 months after we are certain you have stopped any spam related activities.

If you resume spamming or related activities, any new information on you submitted to ROKSO (such as a spam sample or anything even remotely connected to you) automatically makes all of your "dormant" records "live" again for another 6 months, and so on.

There is an exception to this regarding spammers who have been incarcerated or indicted, or are otherwise under ongoing investigation by a law enforcement agency. We find that most spammers in jail or prison, or on trial, are parts of larger criminal organizations and keeping their records visible to legal entities helps complete investigations.

There's a mistake in my ROKSO listing, will you fix it?
We do our best to ensure that data submitted to ROKSO is correct, comes from a public domain source, and that any errors are corrected as soon as we are made aware of them.

However, correcting what a spammer claims is an 'error' is not as straight forward as it may seem, since spammers are people not known for honesty. Spamhaus regularly receives letters from spammer's lawyers attempting to claim that all of a spammers records are in error and demanding all therefore be removed. We naturally pay little attention to such requests. A request by a spammer for correction of a record must point to exactly what information is in error and must include verifiable proof that the error is indeed an error.

How many ROKSO spam operations are there?
For several years the number of known professional spam operations in the ROKSO List has been in the range of 100 to 150 outfits.

Each 'spam operation' consists of one or more spammers working together with partners ("partner-in-spam"), associates, affiliates or spam-friendly host operators and therefore "100" spam operations can consist of roughly 1000 individuals. Each spam operation has ever-changing aliases, domains, and hosting as spammers attempt to disguise their operations.

The "100" number tends to remain steady over the years due to the turnover of ROKSO spam operations that are either put out of business, or who, through lack of networks willing to host them due to their ROKSO history, or through genuine change of direction, decide to quit the spam business.

Since January 2000, over 500 former spam operations have spent time in and been removed from ROKSO. The vast majority of these have never been heard of again. Encouragingly, some have gone on to become responsible bulk email marketing firms and we wish them well.

What extra ROKSO information is available to Law Enforcement?
The ROKSO registry contains some evidence records that are not made available to the public. These records might include sensitive personal information or evidence of criminal activities. These 'classified' records are made available to law enforcement and other investigative agencies through a secure portal.

Agencies with password-protected access to a secure 'classified' version of ROKSO include:
    (UK) NCA, National Cyber Crime Security Centre (GCHQ)
    (USA) NCFTA, the FBI, the USSS, the US Marshal's Service, the FTC, the IRS, the USPIS, the U.S. Army, the DOE, + various State AG offices.
    (Nederlands) OPTA
    (Australia) ACMA
    (New Zealand) DIA
    (Switzerland) Cybercrime Coordination Unit (CYCO)

Spamhaus is a member of the international network of anti-spam Regulatory And Enforcement Authorities; UCENet; The Unsolicited Communications Enforcement Network (formerly known as The London Action Plan - LAP) and therefore works with and exchanges data with all UCENet member agencies.

For qualified Law Enforcement Agencies we are happy to arrange access to the classified parts of ROKSO. To obtain access, contact Spamhaus (you must contact us from a LEA email address).

© 1998-2022 The Spamhaus Project SLU. All rights reserved.
Legal  |  Privacy