The Spamhaus Project - ROKSO

80% of spam received by Internet users in North America and Europe can be traced via aliases and addresses, redirects, hosting locations of sites and domains, to a hard-core group of around 200 known spam operations ("spam gangs"), almost all of whom are listed in the ROKSO database. These spam operations consist of an estimated 500-600 professional spammers with ever-changing aliases and domains. The vast majority of those listed here operate illegally and move from network to network (and country to country) seeking out "spam-friendly" Internet Service Providers ("ISPs") known for lax enforcing of anti-spam policies.

These are the spammers you definitely do NOT want on your network.

Many of these spam operations pretend to operate 'offshore' using servers in Asia and South America. Those who don't pretend to be 'offshore' pretend to be small ISPs themselves, claiming to their providers the spam is being sent not by them but by non-existent 'customers'. When caught, almost all use the age old tactic of lying to each ISP long enough to buy a few weeks more of spamming and when terminated simply move on to the next ISP already set up and waiting.

ROKSO is a "3 Strikes" register. To be placed on the ROKSO list a spammer must first be terminated by a minimum of 3 ISPs for AUP violations. Once listed in ROKSO, IP addresses under the control of ROKSO-listed spammers are automatically and preemptively listed in the Spamhaus Block List (SBL).

For qualified Law Enforcement Agencies Spamhaus provides a special version of this ROKSO database which gives access to records with evidence, logs and information on illegal activities of many of these gangs, too sensitive to publish here.

Spamhaus also publishes a weekly TOP 10 "Worst ROKSO Spammers" chart.