Blackroute 2026.07.03

Blackroute Release Summary

Release artifacts are cleaned with BogonForge-compatible public IP filtering before publication.

Dataset

• Configured sources: 51
• Sources remaining after cleanup: 46
• Records before cleanup: 4227418
• Single IPs before cleanup: 3834165
• CIDR prefixes before cleanup: 393253
• Records removed by cleanup: 0
• Records published: 4227418
• Single IPs published: 3834165
• CIDR prefixes published: 393253

Cleanup Policy

• Removed invalid IPs and CIDRs.
• Removed private, loopback, link-local, multicast, unspecified, CGNAT, reserved, and overly broad bogon prefixes.
• Rebuilt CSV, JSONL, MMDB, and run stats after cleanup.

Removed By Reason

No entries.

Top Sources

Name	Count
bitwire_inbound	3393069
team_cymru_fullbogons_ipv6	157299
pop3gropers	152714
blocklist_net_ua	106181
bitwire_outbound	99544
abuseipdb_s100_30d	46277
ziyadnz_threat_intel_hourly_ipv4	44243
ipsum_level1	32200
dataplane_attack_feeds	31394
threatfox_ioc_ips	23457
shadowwhisperer_scanners	22299
inversion_dnsbl_google_ipv4	19491
threatview_ip_blocklist	18800
romainmarcoux_outgoing_40k	18357
romainmarcoux_inbound_40k	10358
abuseipdb_s100_7d	8867
blocklist_de_web	8440
phishing_database_ips	7109
cinsscore_badguys	6154
firehol_abusers_1d	3685

Top Threat Labels

Name	Count
recent_attack_any	4008891
community_high_risk	3936952
malware_host_active	3902875
bruteforce	302422
phishing_or_scam	193640
c2_ioc	186651
persistent_attacker	116860
spam	110439
multi_sensor_high_risk	109699
compromised_or_hostile_host	74401
network_scan_or_abuse	28454
recent_attack_mail	12684
recent_attack_web	9566
recent_badbot_or_regbot	5205
recent_attack_ssh	4646
aggregate_abuser_1d	3891
recent_attack_imap	3172
recent_attack_ftp	464
recent_attack_sip	132
abuse	60

Top Infrastructure Labels

Name	Count
bogon	160278
prefix_cybercrime	1775
hosting	889

Top Classification Labels

Name	Count
aggregate_threat_intel	3913600
mail_bruteforce	154675
pop3_bruteforce	154675
aggregate_abuseipdb_confidence_100	132230
spam_source	110439
brute_force	110379
national_cert_malicious	110379
aggregate_threat_intel_hourly	107425
aggregate_inbound_threat	40000
aggregate_outbound_threat	40000
network_scan_or_abuse	35443
internet_scanner	28454
reconnaissance	28454
c2_ioc	23468
dnsbl_malicious	19833
safe_browsing_malicious	19833
phishing_ip	7119
ultra_conservative_aggregate	4567
aggregate_blacklist_scored	3944
cloud_hosting_abuse_derived	889

Blackroute 2026.07.02

Blackroute Release Summary

Release artifacts are cleaned with BogonForge-compatible public IP filtering before publication.

Dataset

• Configured sources: 51
• Sources remaining after cleanup: 47
• Records before cleanup: 4224629
• Single IPs before cleanup: 3831449
• CIDR prefixes before cleanup: 393180
• Records removed by cleanup: 0
• Records published: 4224629
• Single IPs published: 3831449
• CIDR prefixes published: 393180

Cleanup Policy

• Removed invalid IPs and CIDRs.
• Removed private, loopback, link-local, multicast, unspecified, CGNAT, reserved, and overly broad bogon prefixes.
• Rebuilt CSV, JSONL, MMDB, and run stats after cleanup.

Removed By Reason

No entries.

Top Sources

Name	Count
bitwire_inbound	3391675
team_cymru_fullbogons_ipv6	157267
pop3gropers	151841
blocklist_net_ua	105804
bitwire_outbound	101019
abuseipdb_s100_30d	46418
ipsum_level1	34744
ziyadnz_threat_intel_hourly_ipv4	34114
threatview_ip_blocklist	30810
dataplane_attack_feeds	30050
threatfox_ioc_ips	23505
shadowwhisperer_scanners	22257
inversion_dnsbl_google_ipv4	19499
romainmarcoux_outgoing_40k	17003
romainmarcoux_inbound_40k	10473
blocklist_de_mail	8292
phishing_database_ips	7109
abuseipdb_s100_7d	6174
cinsscore_badguys	6140
firehol_abusers_1d	3632

Top Threat Labels

Name	Count
recent_attack_any	4006773
community_high_risk	3934614
malware_host_active	3901045
bruteforce	302346
phishing_or_scam	203505
c2_ioc	196516
persistent_attacker	128327
spam	110558
multi_sensor_high_risk	108226
compromised_or_hostile_host	86334
network_scan_or_abuse	28454
recent_attack_mail	14074
recent_attack_web	9511
recent_attack_ssh	5600
recent_attack_imap	4555
aggregate_abuser_1d	3820
recent_badbot_or_regbot	3653
recent_attack_ftp	469
abuse	60
recent_attack_sip	47

Top Infrastructure Labels

Name	Count
bogon	160242
prefix_cybercrime	1776
hosting	892

Top Classification Labels

Name	Count
aggregate_threat_intel	3914162
mail_bruteforce	154631
pop3_bruteforce	154631
aggregate_abuseipdb_confidence_100	132767
spam_source	110558
brute_force	110498
national_cert_malicious	110498
aggregate_threat_intel_hourly	107595
aggregate_inbound_threat	40000
aggregate_outbound_threat	40000
network_scan_or_abuse	34994
internet_scanner	28454
reconnaissance	28454
c2_ioc	23516
dnsbl_malicious	19839
safe_browsing_malicious	19839
phishing_ip	7119
ultra_conservative_aggregate	4566
aggregate_blacklist_scored	3944
cloud_hosting_abuse_derived	892

Blackroute 2026.07.01

Blackroute Release Summary

Release artifacts are cleaned with BogonForge-compatible public IP filtering before publication.

Dataset

• Configured sources: 51
• Sources remaining after cleanup: 47
• Records before cleanup: 4201011
• Single IPs before cleanup: 3808611
• CIDR prefixes before cleanup: 392400
• Records removed by cleanup: 0
• Records published: 4201011
• Single IPs published: 3808611
• CIDR prefixes published: 392400

Cleanup Policy

• Removed invalid IPs and CIDRs.
• Removed private, loopback, link-local, multicast, unspecified, CGNAT, reserved, and overly broad bogon prefixes.
• Rebuilt CSV, JSONL, MMDB, and run stats after cleanup.

Removed By Reason

No entries.

Top Sources

Name	Count
bitwire_inbound	3364615
team_cymru_fullbogons_ipv6	157267
pop3gropers	152186
blocklist_net_ua	105384
bitwire_outbound	103047
abuseipdb_s100_30d	52216
ipsum_level1	34545
ziyadnz_threat_intel_hourly_ipv4	34400
threatview_ip_blocklist	30188
dataplane_attack_feeds	29131
threatfox_ioc_ips	23549
shadowwhisperer_scanners	22148
inversion_dnsbl_google_ipv4	19502
romainmarcoux_outgoing_40k	17003
blocklist_de_mail	8315
abuseipdb_s100_7d	7614
phishing_database_ips	7109
cinsscore_badguys	6551
romainmarcoux_inbound_40k	5717
firehol_abusers_1d	4047

Top Threat Labels

Name	Count
recent_attack_any	3982801
community_high_risk	3911382
malware_host_active	3876573
bruteforce	301782
phishing_or_scam	204208
c2_ioc	197217
persistent_attacker	129922
spam	110105
multi_sensor_high_risk	108055
compromised_or_hostile_host	85789
network_scan_or_abuse	28454
recent_attack_web	17065
recent_attack_mail	14481
recent_attack_ssh	9191
recent_attack_imap	4902
aggregate_abuser_1d	4285
recent_badbot_or_regbot	3406
recent_attack_ftp	480
abuse	60
recent_attack_sip	50

Top Infrastructure Labels

Name	Count
bogon	160241
prefix_cybercrime	1778
hosting	894

Top Classification Labels

Name	Count
aggregate_threat_intel	3890010
mail_bruteforce	154606
pop3_bruteforce	154606
aggregate_abuseipdb_confidence_100	133524
spam_source	110105
brute_force	110045
national_cert_malicious	110045
aggregate_threat_intel_hourly	106672
aggregate_inbound_threat	40000
aggregate_outbound_threat	40000
network_scan_or_abuse	34610
internet_scanner	28454
reconnaissance	28454
c2_ioc	23560
dnsbl_malicious	19842
safe_browsing_malicious	19842
phishing_ip	7119
ultra_conservative_aggregate	4567
aggregate_blacklist_scored	3944
cloud_hosting_abuse_derived	894

Blackroute 2026.06.30

Blackroute Release Summary

Release artifacts are cleaned with BogonForge-compatible public IP filtering before publication.

Dataset

• Configured sources: 51
• Sources remaining after cleanup: 48
• Records before cleanup: 4195589
• Single IPs before cleanup: 3803710
• CIDR prefixes before cleanup: 391879
• Records removed by cleanup: 0
• Records published: 4195589
• Single IPs published: 3803710
• CIDR prefixes published: 391879

Cleanup Policy

• Removed invalid IPs and CIDRs.
• Removed private, loopback, link-local, multicast, unspecified, CGNAT, reserved, and overly broad bogon prefixes.
• Rebuilt CSV, JSONL, MMDB, and run stats after cleanup.

Removed By Reason

No entries.

Top Sources

Name	Count
bitwire_inbound	3361107
team_cymru_fullbogons_ipv6	157263
pop3gropers	152596
blocklist_net_ua	105521
bitwire_outbound	101718
abuseipdb_s100_30d	52089
ipsum_level1	34858
ziyadnz_threat_intel_hourly_ipv4	33306
dataplane_attack_feeds	29607
threatfox_ioc_ips	23472
shadowwhisperer_scanners	22204
inversion_dnsbl_google_ipv4	19527
romainmarcoux_outgoing_40k	17907
threatview_ip_blocklist	17805
blocklist_de_mail	8581
blocklist_de_web	7959
phishing_database_ips	7109
abuseipdb_s100_7d	6809
cinsscore_badguys	5987
romainmarcoux_inbound_40k	5558

Top Threat Labels

Name	Count
recent_attack_any	3977908
community_high_risk	3906238
malware_host_active	3866961
bruteforce	301054
phishing_or_scam	192350
c2_ioc	185358
persistent_attacker	122915
spam	109509
multi_sensor_high_risk	107530
compromised_or_hostile_host	73829
network_scan_or_abuse	28454
recent_attack_web	16756
recent_attack_mail	14414
recent_attack_ssh	9081
aggregate_abuser_1d	4154
recent_attack_imap	4141
recent_badbot_or_regbot	3684
recent_attack_ftp	338
abuse	60
recent_attack_sip	41

Top Infrastructure Labels

Name	Count
bogon	160240
prefix_cybercrime	1778
hosting	895

Top Classification Labels

Name	Count
aggregate_threat_intel	3881173
mail_bruteforce	154562
pop3_bruteforce	154562
aggregate_abuseipdb_confidence_100	133282
spam_source	109509
brute_force	109449
national_cert_malicious	109449
aggregate_threat_intel_hourly	106225
aggregate_inbound_threat	40000
aggregate_outbound_threat	40000
network_scan_or_abuse	34222
internet_scanner	28454
reconnaissance	28454
c2_ioc	23814
dnsbl_malicious	19864
safe_browsing_malicious	19864
phishing_ip	7119
ultra_conservative_aggregate	4569
aggregate_blacklist_scored	3944
cloud_hosting_abuse_derived	895

Blackroute 2026.06.29

Blackroute Release Summary

Release artifacts are cleaned with BogonForge-compatible public IP filtering before publication.

Dataset

• Configured sources: 51
• Sources remaining after cleanup: 47
• Records before cleanup: 4176541
• Single IPs before cleanup: 3784667
• CIDR prefixes before cleanup: 391874
• Records removed by cleanup: 0
• Records published: 4176541
• Single IPs published: 3784667
• CIDR prefixes published: 391874

Cleanup Policy

• Removed invalid IPs and CIDRs.
• Removed private, loopback, link-local, multicast, unspecified, CGNAT, reserved, and overly broad bogon prefixes.
• Rebuilt CSV, JSONL, MMDB, and run stats after cleanup.

Removed By Reason

No entries.

Top Sources

Name	Count
bitwire_inbound	3356239
team_cymru_fullbogons_ipv6	157247
pop3gropers	152410
blocklist_net_ua	104588
bitwire_outbound	100796
abuseipdb_s100_30d	61289
ipsum_level1	42989
dataplane_attack_feeds	27719
ziyadnz_threat_intel_hourly_ipv4	25392
threatfox_ioc_ips	23827
shadowwhisperer_scanners	21966
inversion_dnsbl_google_ipv4	19570
romainmarcoux_outgoing_40k	18122
threatview_ip_blocklist	16941
blocklist_de_mail	8204
phishing_database_ips	7109
cinsscore_badguys	6970
romainmarcoux_inbound_40k	5751
ipblocklist_level3	3270
firehol_abusers_1d	3253

Top Threat Labels

Name	Count
recent_attack_any	3959086
community_high_risk	3888540
malware_host_active	3853934
bruteforce	299941
phishing_or_scam	189329
c2_ioc	182338
persistent_attacker	115600
spam	108499
multi_sensor_high_risk	96535
compromised_or_hostile_host	73047
network_scan_or_abuse	28454
recent_attack_mail	13239
recent_attack_web	8799
recent_attack_ssh	4290
recent_attack_imap	3687
aggregate_abuser_1d	3397
recent_badbot_or_regbot	3221
recent_attack_ftp	441
abuse	56
recent_attack_sip	39

Top Infrastructure Labels

Name	Count
bogon	160223
prefix_cybercrime	1791
hosting	896

Top Classification Labels

Name	Count
aggregate_threat_intel	3868083
mail_bruteforce	154541
pop3_bruteforce	154541
aggregate_abuseipdb_confidence_100	133699
spam_source	108499
brute_force	108443
national_cert_malicious	108443
aggregate_threat_intel_hourly	92959
aggregate_inbound_threat	40000
aggregate_outbound_threat	40000
network_scan_or_abuse	31810
internet_scanner	28454
reconnaissance	28454
c2_ioc	23836
dnsbl_malicious	19914
safe_browsing_malicious	19914
phishing_ip	7119
ultra_conservative_aggregate	4574
aggregate_blacklist_scored	3944
university_honeypot_attacker	1618

Blackroute 2026.06.28

Blackroute Release Summary

Release artifacts are cleaned with BogonForge-compatible public IP filtering before publication.

Dataset

• Configured sources: 51
• Sources remaining after cleanup: 47
• Records before cleanup: 4176603
• Single IPs before cleanup: 3784925
• CIDR prefixes before cleanup: 391678
• Records removed by cleanup: 0
• Records published: 4176603
• Single IPs published: 3784925
• CIDR prefixes published: 391678

Cleanup Policy

• Removed invalid IPs and CIDRs.
• Removed private, loopback, link-local, multicast, unspecified, CGNAT, reserved, and overly broad bogon prefixes.
• Rebuilt CSV, JSONL, MMDB, and run stats after cleanup.

Removed By Reason

No entries.

Top Sources

Name	Count
bitwire_inbound	3357878
team_cymru_fullbogons_ipv6	157224
pop3gropers	152215
blocklist_net_ua	104510
bitwire_outbound	99918
abuseipdb_s100_30d	54319
ipsum_level1	35372
ziyadnz_threat_intel_hourly_ipv4	33877
dataplane_attack_feeds	27908
threatfox_ioc_ips	23904
shadowwhisperer_scanners	21997
inversion_dnsbl_google_ipv4	19568
romainmarcoux_outgoing_40k	17278
threatview_ip_blocklist	17066
blocklist_de_mail	8939
phishing_database_ips	7106
cinsscore_badguys	6757
abuseipdb_s100_7d	6388
romainmarcoux_inbound_40k	5249
firehol_abusers_1d	3687

Top Threat Labels

Name	Count
recent_attack_any	3960091
community_high_risk	3889331
malware_host_active	3855218
bruteforce	299927
phishing_or_scam	190207
c2_ioc	183219
persistent_attacker	116133
spam	108672
multi_sensor_high_risk	95817
compromised_or_hostile_host	73216
network_scan_or_abuse	28454
recent_attack_mail	13215
recent_attack_web	8850
recent_attack_ssh	4349
aggregate_abuser_1d	3874
recent_attack_imap	3670
recent_badbot_or_regbot	2447
recent_attack_ftp	439
recent_attack_sip	106
abuse	56

Top Infrastructure Labels

Name	Count
bogon	160199
prefix_cybercrime	1791
hosting	896

Top Classification Labels

Name	Count
aggregate_threat_intel	3868160
mail_bruteforce	154516
pop3_bruteforce	154516
aggregate_abuseipdb_confidence_100	134120
spam_source	108672
brute_force	108616
national_cert_malicious	108616
aggregate_threat_intel_hourly	94563
aggregate_inbound_threat	40000
aggregate_outbound_threat	40000
network_scan_or_abuse	32182
internet_scanner	28454
reconnaissance	28454
c2_ioc	23913
dnsbl_malicious	19914
safe_browsing_malicious	19914
phishing_ip	7119
ultra_conservative_aggregate	4573
aggregate_blacklist_scored	3944
university_honeypot_attacker	1660

Blackroute 2026.06.27

Blackroute Release Summary

Release artifacts are cleaned with BogonForge-compatible public IP filtering before publication.

Dataset

• Configured sources: 51
• Sources remaining after cleanup: 48
• Records before cleanup: 4172679
• Single IPs before cleanup: 3781016
• CIDR prefixes before cleanup: 391663
• Records removed by cleanup: 0
• Records published: 4172679
• Single IPs published: 3781016
• CIDR prefixes published: 391663

Cleanup Policy

• Removed invalid IPs and CIDRs.
• Removed private, loopback, link-local, multicast, unspecified, CGNAT, reserved, and overly broad bogon prefixes.
• Rebuilt CSV, JSONL, MMDB, and run stats after cleanup.

Removed By Reason

No entries.

Top Sources

Name	Count
bitwire_inbound	3354646
team_cymru_fullbogons_ipv6	157198
pop3gropers	152221
blocklist_net_ua	104957
bitwire_outbound	99986
abuseipdb_s100_30d	49329
ipsum_level1	35538
ziyadnz_threat_intel_hourly_ipv4	32807
dataplane_attack_feeds	27503
threatfox_ioc_ips	23975
shadowwhisperer_scanners	21907
inversion_dnsbl_google_ipv4	19583
romainmarcoux_outgoing_40k	17431
threatview_ip_blocklist	17363
romainmarcoux_inbound_40k	11223
blocklist_de_web	8177
phishing_database_ips	7107
abuseipdb_s100_7d	6102
cinsscore_badguys	5799
firehol_abusers_1d	3692

Top Threat Labels

Name	Count
recent_attack_any	3956178
community_high_risk	3885239
malware_host_active	3851463
bruteforce	300276
phishing_or_scam	190530
c2_ioc	183540
persistent_attacker	116779
spam	109153
multi_sensor_high_risk	93916
compromised_or_hostile_host	73592
network_scan_or_abuse	28454
recent_attack_mail	13492
recent_attack_web	9205
recent_attack_ssh	4394
aggregate_abuser_1d	3924
recent_attack_imap	3898
recent_badbot_or_regbot	2508
recent_attack_ftp	372
recent_attack_sip	114
abuse	56

Top Infrastructure Labels

Name	Count
bogon	160172
prefix_cybercrime	1791
hosting	896

Top Classification Labels

Name	Count
aggregate_threat_intel	3864174
mail_bruteforce	154497
pop3_bruteforce	154497
aggregate_abuseipdb_confidence_100	134378
spam_source	109153
brute_force	109097
national_cert_malicious	109097
aggregate_threat_intel_hourly	92933
aggregate_inbound_threat	40000
aggregate_outbound_threat	40000
network_scan_or_abuse	31741
internet_scanner	28454
reconnaissance	28454
c2_ioc	23984
dnsbl_malicious	19931
safe_browsing_malicious	19931
phishing_ip	7119
ultra_conservative_aggregate	4575
aggregate_blacklist_scored	3944
university_honeypot_attacker	1632

Blackroute 2026.06.25

Blackroute Release Summary

Release artifacts are cleaned with BogonForge-compatible public IP filtering before publication.

Dataset

• Configured sources: 52
• Sources remaining after cleanup: 48
• Records before cleanup: 3524624
• Single IPs before cleanup: 3159697
• CIDR prefixes before cleanup: 364927
• Records removed by cleanup: 0
• Records published: 3524624
• Single IPs published: 3159697
• CIDR prefixes published: 364927

Cleanup Policy

• Removed invalid IPs and CIDRs.
• Removed private, loopback, link-local, multicast, unspecified, CGNAT, reserved, and overly broad bogon prefixes.
• Rebuilt CSV, JSONL, MMDB, and run stats after cleanup.

Removed By Reason

No entries.

Top Sources

Name	Count
bitwire_inbound	2710594
team_cymru_fullbogons_ipv6	157162
pop3gropers	151598
bitwire_outbound	101998
blocklist_net_ua	99732
abuseipdb_s100_30d	50715
ipsum_level1	34371
ziyadnz_threat_intel_hourly_ipv4	31419
dataplane_attack_feeds	27225
threatfox_ioc_ips	23963
shadowwhisperer_scanners	22263
inversion_dnsbl_google_ipv4	19602
threatview_ip_blocklist	18251
romainmarcoux_outgoing_40k	17469
abuseipdb_s100_7d	12943
blocklist_de_web	8270
phishing_database_ips	7106
romainmarcoux_inbound_40k	5339
cinsscore_badguys	5274
firehol_abusers_1d	3777

Top Threat Labels

Name	Count
recent_attack_any	3308595
community_high_risk	3243522
malware_host_active	3207014
bruteforce	294608
phishing_or_scam	193552
c2_ioc	186563
persistent_attacker	114990
spam	103887
multi_sensor_high_risk	91532
compromised_or_hostile_host	74411
network_scan_or_abuse	28454
recent_attack_mail	13951
recent_attack_web	8994
recent_attack_ssh	4546
recent_attack_imap	4098
aggregate_abuser_1d	4007
recent_badbot_or_regbot	2874
recent_attack_ftp	366
recent_attack_sip	61
abuse	56

Top Infrastructure Labels

Name	Count
bogon	160140
prefix_cybercrime	1786
hosting	900

Top Classification Labels

Name	Count
aggregate_threat_intel	3219156
mail_bruteforce	154450
pop3_bruteforce	154450
aggregate_abuseipdb_confidence_100	135756
spam_source	103887
brute_force	103831
national_cert_malicious	103831
aggregate_threat_intel_hourly	89826
aggregate_inbound_threat	40000
aggregate_outbound_threat	40000
network_scan_or_abuse	31969
internet_scanner	28454
reconnaissance	28454
c2_ioc	23972
dnsbl_malicious	19947
safe_browsing_malicious	19947
phishing_ip	7118
ultra_conservative_aggregate	4571
aggregate_blacklist_scored	3944
university_honeypot_attacker	1924

Blackroute 2026.06.24

Blackroute Release Summary

Release artifacts are cleaned with BogonForge-compatible public IP filtering before publication.

Dataset

• Configured sources: 52
• Sources remaining after cleanup: 47
• Records before cleanup: 4159596
• Single IPs before cleanup: 3768473
• CIDR prefixes before cleanup: 391123
• Records removed by cleanup: 0
• Records published: 4159596
• Single IPs published: 3768473
• CIDR prefixes published: 391123

Cleanup Policy

• Removed invalid IPs and CIDRs.
• Removed private, loopback, link-local, multicast, unspecified, CGNAT, reserved, and overly broad bogon prefixes.
• Rebuilt CSV, JSONL, MMDB, and run stats after cleanup.

Removed By Reason

No entries.

Top Sources

Name	Count
bitwire_inbound	3345458
team_cymru_fullbogons_ipv6	157205
pop3gropers	151797
bitwire_outbound	100497
blocklist_net_ua	99477
abuseipdb_s100_30d	43304
ipsum_level1	35649
ziyadnz_threat_intel_hourly_ipv4	34048
dataplane_attack_feeds	26607
threatfox_ioc_ips	23941
shadowwhisperer_scanners	21946
inversion_dnsbl_google_ipv4	19615
threatview_ip_blocklist	18145
romainmarcoux_outgoing_40k	17991
abuseipdb_s100_7d	14457
romainmarcoux_inbound_40k	9672
blocklist_de_web	8222
phishing_database_ips	7105
cinsscore_badguys	5999
firehol_abusers_1d	4274

Top Threat Labels

Name	Count
recent_attack_any	3942851
community_high_risk	3876238
malware_host_active	3842611
bruteforce	294095
phishing_or_scam	194072
c2_ioc	187084
persistent_attacker	117071
spam	103630
multi_sensor_high_risk	93793
compromised_or_hostile_host	74289
network_scan_or_abuse	28454
recent_attack_mail	14000
recent_attack_web	9141
recent_attack_ssh	4570
aggregate_abuser_1d	4521
recent_attack_imap	4018
recent_badbot_or_regbot	2612
recent_attack_ftp	374
recent_attack_sip	100
abuse	56

Top Infrastructure Labels

Name	Count
bogon	160153
prefix_cybercrime	1789
hosting	900

Top Classification Labels

Name	Count
aggregate_threat_intel	3854841
mail_bruteforce	154438
pop3_bruteforce	154438
aggregate_abuseipdb_confidence_100	136315
spam_source	103630
brute_force	103574
national_cert_malicious	103574
aggregate_threat_intel_hourly	92007
aggregate_inbound_threat	40000
aggregate_outbound_threat	40000
network_scan_or_abuse	31598
internet_scanner	28454
reconnaissance	28454
c2_ioc	23950
dnsbl_malicious	19960
safe_browsing_malicious	19960
phishing_ip	7118
ultra_conservative_aggregate	4542
aggregate_blacklist_scored	3944
university_honeypot_attacker	1948

Blackroute 2026.06.23

Blackroute Release Summary

Release artifacts are cleaned with BogonForge-compatible public IP filtering before publication.

Dataset

• Configured sources: 52
• Sources remaining after cleanup: 47
• Records before cleanup: 3521673
• Single IPs before cleanup: 3157355
• CIDR prefixes before cleanup: 364318
• Records removed by cleanup: 0
• Records published: 3521673
• Single IPs published: 3157355
• CIDR prefixes published: 364318

Cleanup Policy

• Removed invalid IPs and CIDRs.
• Removed private, loopback, link-local, multicast, unspecified, CGNAT, reserved, and overly broad bogon prefixes.
• Rebuilt CSV, JSONL, MMDB, and run stats after cleanup.

Removed By Reason

No entries.

Top Sources

Name	Count
bitwire_inbound	2713357
team_cymru_fullbogons_ipv6	157188
pop3gropers	152334
blocklist_net_ua	99243
bitwire_outbound	98952
abuseipdb_s100_30d	46091
ziyadnz_threat_intel_hourly_ipv4	32784
ipsum_level1	32050
dataplane_attack_feeds	27815
threatfox_ioc_ips	23966
shadowwhisperer_scanners	22532
romainmarcoux_outgoing_40k	18120
abuseipdb_s100_7d	17712
inversion_dnsbl_google_ipv4	16168
threatview_ip_blocklist	15991
blocklist_de_web	8243
phishing_database_ips	7106
cinsscore_badguys	5890
romainmarcoux_inbound_40k	5074
firehol_abusers_1d	3912

Top Threat Labels

Name	Count
recent_attack_any	3308630
community_high_risk	3244056
malware_host_active	3206293
bruteforce	293635
phishing_or_scam	189279
c2_ioc	182291
persistent_attacker	108681
spam	103420
multi_sensor_high_risk	91693
compromised_or_hostile_host	68746
network_scan_or_abuse	28454
recent_attack_mail	13373
recent_attack_web	9265
recent_attack_ssh	4657
aggregate_abuser_1d	4176
recent_attack_imap	3531
recent_badbot_or_regbot	2094
recent_attack_ftp	396
recent_attack_sip	96
abuse	56

Top Infrastructure Labels

Name	Count
bogon	160137
prefix_cybercrime	1787
hosting	732

Top Classification Labels

Name	Count
aggregate_threat_intel	3214780
mail_bruteforce	154349
pop3_bruteforce	154349
aggregate_abuseipdb_confidence_100	136564
spam_source	103420
brute_force	103364
national_cert_malicious	103364
aggregate_threat_intel_hourly	91065
aggregate_inbound_threat	40000
aggregate_outbound_threat	40000
network_scan_or_abuse	32294
internet_scanner	28454
reconnaissance	28454
c2_ioc	23975
dnsbl_malicious	16456
safe_browsing_malicious	16456
phishing_ip	7118
ultra_conservative_aggregate	4545
aggregate_blacklist_scored	3944
university_honeypot_attacker	2072