Blacklist service SORBS shutting down in July 2009

25Jun09

Update: SORBS was sold to a new owner at an unspecified price. Details at bottom of post: updated 1st August 2009.

On Monday, 22 June, it was announced by Michelle Sullivan, owner of SORBS (IP: 203.15.51.39 at ASN2764 AAPT), on the SORBS homepage that she would shut the blacklisting services down by July 21st. Apparently the University based in Australia that was hosting SORBS decided not to renew the contract. Webhosting and support for SORBS is apparently costly because it is a the number of DNS queries it handles as a busy DNSBL, hosts DNS of other Blacklist providers and offers other services to ISPs, such as Feed Back Loops. According to some casual users on Slashdot, SORBS hosting could easily exceed 5000 USD a month. Also keep in mind, DNSBLs are sometimes DDoSed by angry cybercriminals, or even some people who just get angry with blocklistings. DOS (Denial of Service) attacks can be very costly if they are sustained, so sometimes the target site has to pay for bandwidth overages if this occurs. In fact, I have heard of some overages costing many thousands of US Dollars a month, so attacks like this could quickly bring down any serious anti spam effort.

The following day, the SORBS story was posted on the “News for Nerds” site, Slashdot, which resulted in many posts with an angry tone by slashdot participants. The anti-spam groups, mail admins and ISP operators were abuzz about how much most of them disliked SORBS’ tactics. There were only a few defenders of the DNSBL.

One of the more kinder comments from Slashdot:

“Such a shutdown could slow or disrupt anti-spam efforts for large numbers of mail hosts worldwide. ”

You’re kidding, right?

They have done more to give legitimate anti-spam efforts a black eye than ANY legislative attempts to ‘solve’ the problem ever could.

I -used- to believe that ‘collateral damage’ was a legitimate ‘tactic’ in the fight against spammers. I’ve grown up since then.

or this post:

A lot of people have had their lives turn into a living hell because of some listing on SORBS. Thus if it wasn’t me who chewed you out, somebody else probably would have

🙂 […]

Another insightful blog entry about SORBS is by anti spam expert Al Iverson titled: “SORBS Information Roundup.

According to Iverson, SORBS owner was angry that her DNSBL was criticized by Iverson in his earlier studies of its ineffectiveness as a DNSBL in comparison to some others. Iverson believes that some retaliation tactics were then done against him and/or some of his associates by SORBS as a result. Assuming this is all the case, it futher creates a solid picture for the profound lack of professionalism of SORBS and paints a picture of vindictive vigilantism.

Ken Magill of Direct Mag also wrote up about SORBS closing down and made this interesting comment:

However, SORBS is far more controversial than Spamhaus.

A Google search on June 22 for “SORBS sucks”—in quotes to make sure only references to that exact phrase appear—brought back 3,280 results. Clicking on a random selection of the results revealed tales of people claiming to have been unjustly listed by SORBS and being unable to reach anyone to resolve the problem.

To be fair, a June 22 search on Google for “Spamhaus sucks” brought back 2,130 results.

Despite the very strong criticism of SORBS by mail admins, ISP admins, collateral damage (small webhosters caught in the middle of the vaious SORBS blocklistings, there is talk in someone or some organisation taking on the task to host SORBS (or purchase it), but at the time of this post, it is unclear that this will be done. At the time I post this on 24/6/09, Michelle Sullivan said this posted on SORBS homepage:

Initial contact regarding “Buy out” have been received from large anti-spam vendors.

60+ Offers of hosting have been received, unfortunately most whilst generous are impossible to use in the short time available. SORBS cannot move to new hosts in the time available. SORBS, does need short term 42RU hosting to consider moving to other hosts.

SORBS has had 2 offers of hosting within the Queensland/North New South Wales area, one of which is by a top hosting company in Australia.

The result is at this present time I, Michelle Sullivan, feel that SORBS will not close on the date specified, though there maybe some small outages around this time.

All offers are welcome, and all offers will receive a response.

Thank you for your continuing support.

Michelle Sullivan

This is one of the more recent updates by SORBS at the time of this post, is it is possible SORBS may not be shutdown, but the general consensus of those in the spam fighting realms, that SORBS is extremely unpopular and many prefer to see it laid to rest.

Some have suggested that the list did more damage to the anti-spam movement because it was aggressive in blocking entire ISP netblocks. One of the biggest complaints was that SORBS charged money for getting IPs delisted. There have been two sides to this story, that some said they forcd people to pay while others who worked in ISPs said that was not the case and they did not pay for removals.

It could be hard for some people who are not very familiar with the anti-spam movement to know how damaging SORBS behaviour appears to have been on minimizing spam. The ones who understand this better are either those who work regular with blacklists and or employees of (ESPs-Email Service Providers) . Such people work at ISPs, run mail servers and or volunteer for organisations as operators also have a good idea about SORBS and many have been quite vocal in their disapproval of SORBS.

The biggest complaint by many who dealt with SORBS over the years was its apparent inconsistency in responses, unrealistic high demands of ISPs to stop spam 100%, lack of professionalism (profane language used in email exchanges by SORBS operators) and other trollish behavior of some of the volunteers at SORBS. One hopes that if a new owner does take over, the SORBS of the past will be put aside and that its efforts could be salvaged, but at this point it is very hard to say.

Ultimately, despite the good and bad things one reads about SORBS, I believe the interest in purchasing SORBS data is because there are obviously some anti spam researchers could find the data to be a treasure dove for spam analysis. So given the more recent updates with SORBS, it is possible it may continue to be online, but with some outages right after the shutdown.

This post will be updated as more information becomes available: last edit: 1/8/09.

Update 1/8/09 According to Michelle Sullivan, owner and operator of SORBS, SORBS will stay online. The information is now posted on sorbs.net’s homepage. Apparently a vendor has purchased SORBS. Let us hope this new owner will operate the RBL more appropriately than it has been in the past.

Filed under: blacklist, blocklist, cybercrime, rogue networks, spam   |  1 Comment
Tags: Al Iverson, anti spam movement, au.sorbs.net, Australia, BL, blacklist, blocklist, cats and coffee, dnsbl, isp, Ken Magill, mail admins, Matthew Sullivan, Michelle Sullivan, nanae, netblocks, RBL, retaliation, slashdot, SORBS, SORBS shutdown, spam, spam reports, spamhaus, spammed, spammers, sysadmins, unprofessionalism