Every community has its own heroes and villains. For those in the trenches of email delivery, cybersecurity, and abuse prevention, the latter were often found on a simple, no-frills webpage: the Register of Known Spam Operations (ROKSO) from Spamhaus. I would often tell folks “follow that approach and end up on ROKSO”. But as Chuck Helstein recently shared in a poignant LinkedIn post, that page is now gone.
Chuck, a leading voice in cybersecurity and risk, penned a powerful farewell to ROKSO, calling it the internet’s “Most Wanted” list. Rightly stating wasn’t slick or modern; it was a simple, public list of names, aliases, and networks. But as Chuck notes, it was “a beacon” for anyone battling junk mail and online abuse.
For investigators and abuse desk managers, ROKSO was often an useful data point. Offering some transparency, a source of education, and an important tool for many,
Why did it go away? As Chuck explains, the reasons are multifaceted: legal pressures, counterintelligence risks, and the commercialisation of threat intelligence. The data is still out there, but it’s increasingly locked behind paywalls, walled gardens and private feeds, leaving a void where a shared, public resource once stood.
In a world that is becoming more and more fragmented, the loss of ROKSO is a significant one. We’ve lost a public face of accountability and a shared entry point for small operators and professionals alike. It was a cultural artifact of the early internet, a simple “Ten Most Wanted” board that brought clarity to a complex problem.
Chuck Helstein’s reflection is a powerful reminder of what we lose when public resources are replaced by private ones. The villains haven’t vanished, but the public poster on the wall has. And as Chuck concludes, the irony is that all we’re left with is a “200 OK” – for many that may ready simply as the digital equivalent of a shrug.
