The Spam and Open Relay Blocking System (SORBS), a long-time source of information on known sources of spam, widely used to create blocklists, has been shut down by its owner, cyber security software vendor Proofpoint. SORBS provided free access to a DNS-based Block List (DNSBL) that lists over 12 million host servers known to disseminate spam, phishing attacks and other email nasties. The service states its list "typically includes email servers suspected of sending or relaying spam, servers that have been hacked and hijacked, and those with Trojan infestations." Over 200,000 organizations use SORBS data, and the service is highly rated for its accuracy. The service is over twenty years old and was created by Michelle Sullivan, who oversaw it as a Proofpoint employee working from Australia.
Proofpoint sent the following explanation: "The decision to sunset a product is never an easy one and was made after thorough consideration of various factors impacting the service's sustainability. We can confirm that SORBS was decommissioned on 5 June 2024, and the service no longer contains reputation data. Given the wide range of potential replacement solutions in the market, Proofpoint cannot make recommendations nor endorse any specific replacement product; this is dependent on an organization's needs."
Decommissioning SORBS saw its "Zones," 18 lists, each devoted to a different class of spam-related server; emptied of information. Some researchers believe that restoring SORBS information to the Zones requires a trivial amount of work, and that the service's code base is intact. Restarting the service would therefore not be difficult. News of SORBS's demise has sparked conversation in the anti-spam community about a possible acquisition.
When Ms. Sullivan created the service, it was hosted on an infrastructure owned by the university she worked for at the time. SORBS's impact on the university grew to the point at which it was no longer welcome, leading software vendor GFI to acquire the service. A couple of years later, GFI offloaded SORBS to Proofpoint, which has owned it and employed Ms. Sullivan ever since. It is being reported that the service's hosting and operating costs are at a level that make it infeasible for an individual to take over.
Trusted sources told The Register that offers to acquire SORBS are certain to arrive from spammers who have over the years expressed an interest in controlling the service for their own infamous ends.
The anti-spam community is understandably hopeful legitimate parties will commit to operating SORBS. While Proofpoint is correct in saying alternatives exist, SpamCop and Spamhaus are the most prominent. SORBS's transparent operating practices have earned it many plaudits over its lifetime.
Transparency in blocklist operations is paramount, because blocklist operators could with the stroke of a pen make life very hard for those who send email for a living. SORBS operated a support ticket system and staff who discussed listings, documented those discussions, and archived them. The service therefore had years' worth of records documenting its decisions and decision-making process a body of work that proved SORBS was neither capricious or vengeful.
This article is presented at no charge for educational and informational purposes only.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. Our services can help detect cyber threats and vulnerabilities. For questions, comments, or assistance, please get in touch with the office directly at 1-844-492-7225 or feedback@redskyalliance.com
Reporting: https://www.redskyalliance.org/
Website: https://www.redskyalliance.com/
LinkedIn: https://www.linkedin.com/company/64265941
Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefings
https://register.gotowebinar.com/register/5378972949933166424
Comments