Blackroute 2026.06.04

Blackroute Release Summary

Release artifacts are cleaned with BogonForge-compatible public IP filtering before publication.

Dataset

• Configured sources: 52
• Sources remaining after cleanup: 48
• Records before cleanup: 4017415
• Single IPs before cleanup: 3626367
• CIDR prefixes before cleanup: 391048
• Records removed by cleanup: 0
• Records published: 4017415
• Single IPs published: 3626367
• CIDR prefixes published: 391048

Cleanup Policy

• Removed invalid IPs and CIDRs.
• Removed private, loopback, link-local, multicast, unspecified, CGNAT, reserved, and overly broad bogon prefixes.
• Rebuilt CSV, JSONL, MMDB, and run stats after cleanup.

Removed By Reason

No entries.

Top Sources

Name	Count
bitwire_inbound	3220477
team_cymru_fullbogons_ipv6	156786
pop3gropers	151596
bitwire_outbound	106892
blocklist_net_ua	88083
ziyadnz_threat_intel_hourly_ipv4	40420
ipsum_level1	38943
dataplane_attack_feeds	32381
abuseipdb_s100_30d	31785
threatfox_ioc_ips	26032
shadowwhisperer_scanners	22581
romainmarcoux_outgoing_40k	21284
inversion_dnsbl_google_ipv4	19972
abuseipdb_s100_7d	9532
blocklist_de_web	8605
romainmarcoux_inbound_40k	8382
phishing_database_ips	7106
threatview_ip_blocklist	4980
firehol_abusers_1d	3706
ipblocklist_level3	3263

Top Threat Labels

Name	Count
recent_attack_any	3803035
community_high_risk	3735218
malware_host_active	3707437
bruteforce	282078
phishing_or_scam	201370
c2_ioc	194382
persistent_attacker	119603
multi_sensor_high_risk	94901
spam	92122
compromised_or_hostile_host	63425
network_scan_or_abuse	28454
recent_attack_mail	12638
recent_attack_web	9239
recent_attack_ssh	7598
aggregate_abuser_1d	3863
recent_attack_imap	2912
recent_badbot_or_regbot	2424
recent_attack_ftp	680
recent_attack_sip	60
abuse	56

Top Infrastructure Labels

Name	Count
bogon	159728
prefix_cybercrime	1734
hosting	911

Top Classification Labels

Name	Count
aggregate_threat_intel	3730032
mail_bruteforce	153835
pop3_bruteforce	153835
aggregate_abuseipdb_confidence_100	130883
aggregate_threat_intel_hourly	94269
spam_source	92122
brute_force	92066
national_cert_malicious	92066
aggregate_inbound_threat	40000
aggregate_outbound_threat	40000
network_scan_or_abuse	34380
internet_scanner	28454
reconnaissance	28454
c2_ioc	26042
dnsbl_malicious	20316
safe_browsing_malicious	20316
phishing_ip	7117
ultra_conservative_aggregate	4485
aggregate_blacklist_scored	3944
university_honeypot_attacker	1594

Blackroute 2026.06.03

Blackroute Release Summary

Release artifacts are cleaned with BogonForge-compatible public IP filtering before publication.

Dataset

• Configured sources: 52
• Sources remaining after cleanup: 48
• Records before cleanup: 4009597
• Single IPs before cleanup: 3618810
• CIDR prefixes before cleanup: 390787
• Records removed by cleanup: 0
• Records published: 4009597
• Single IPs published: 3618810
• CIDR prefixes published: 390787

Cleanup Policy

• Removed invalid IPs and CIDRs.
• Removed private, loopback, link-local, multicast, unspecified, CGNAT, reserved, and overly broad bogon prefixes.
• Rebuilt CSV, JSONL, MMDB, and run stats after cleanup.

Removed By Reason

No entries.

Top Sources

Name	Count
bitwire_inbound	3212143
team_cymru_fullbogons_ipv6	156832
pop3gropers	151825
bitwire_outbound	106908
blocklist_net_ua	87161
ziyadnz_threat_intel_hourly_ipv4	39951
ipsum_level1	39723
abuseipdb_s100_30d	34332
dataplane_attack_feeds	30640
threatfox_ioc_ips	26019
shadowwhisperer_scanners	22281
inversion_dnsbl_google_ipv4	19986
romainmarcoux_outgoing_40k	19089
threatview_ip_blocklist	12450
blocklist_de_web	8584
phishing_database_ips	7105
abuseipdb_s100_7d	6800
romainmarcoux_inbound_40k	5510
firehol_abusers_1d	4002
ipblocklist_level3	3263

Top Threat Labels

Name	Count
recent_attack_any	3795097
community_high_risk	3727092
malware_host_active	3700167
bruteforce	281293
phishing_or_scam	202566
c2_ioc	195588
persistent_attacker	123121
multi_sensor_high_risk	95011
spam	91581
compromised_or_hostile_host	70861
network_scan_or_abuse	28454
recent_attack_mail	12527
recent_attack_web	9200
recent_attack_ssh	8250
aggregate_abuser_1d	4170
recent_attack_imap	2737
recent_badbot_or_regbot	2205
recent_attack_ftp	501
recent_attack_sip	89
abuse	56

Top Infrastructure Labels

Name	Count
bogon	159769
prefix_cybercrime	1690
hosting	913

Top Classification Labels

Name	Count
aggregate_threat_intel	3723564
mail_bruteforce	153778
pop3_bruteforce	153778
aggregate_abuseipdb_confidence_100	130850
aggregate_threat_intel_hourly	94382
spam_source	91581
brute_force	91525
national_cert_malicious	91525
aggregate_inbound_threat	40000
aggregate_outbound_threat	40000
network_scan_or_abuse	34468
internet_scanner	28454
reconnaissance	28454
c2_ioc	26029
dnsbl_malicious	20333
safe_browsing_malicious	20333
phishing_ip	7117
university_honeypot_attacker	5339
ultra_conservative_aggregate	4440
aggregate_blacklist_scored	3944

Blackroute 2026.06.02

Blackroute Release Summary

Release artifacts are cleaned with BogonForge-compatible public IP filtering before publication.

Dataset

• Configured sources: 52
• Sources remaining after cleanup: 47
• Records before cleanup: 3997066
• Single IPs before cleanup: 3606432
• CIDR prefixes before cleanup: 390634
• Records removed by cleanup: 0
• Records published: 3997066
• Single IPs published: 3606432
• CIDR prefixes published: 390634

Cleanup Policy

• Removed invalid IPs and CIDRs.
• Removed private, loopback, link-local, multicast, unspecified, CGNAT, reserved, and overly broad bogon prefixes.
• Rebuilt CSV, JSONL, MMDB, and run stats after cleanup.

Removed By Reason

No entries.

Top Sources

Name	Count
bitwire_inbound	3202442
team_cymru_fullbogons_ipv6	156809
pop3gropers	151319
bitwire_outbound	107842
blocklist_net_ua	86848
ziyadnz_threat_intel_hourly_ipv4	39700
ipsum_level1	36866
abuseipdb_s100_30d	31159
dataplane_attack_feeds	29614
threatfox_ioc_ips	25636
shadowwhisperer_scanners	22184
inversion_dnsbl_google_ipv4	20010
romainmarcoux_outgoing_40k	18024
threatview_ip_blocklist	16329
abuseipdb_s100_7d	9417
blocklist_de_web	8453
romainmarcoux_inbound_40k	7904
phishing_database_ips	7101
firehol_abusers_1d	3632
ipblocklist_level3	3268

Top Threat Labels

Name	Count
recent_attack_any	3783842
community_high_risk	3715706
malware_host_active	3690472
bruteforce	280688
phishing_or_scam	203763
c2_ioc	196785
persistent_attacker	119769
multi_sensor_high_risk	93796
spam	91503
compromised_or_hostile_host	74417
network_scan_or_abuse	28454
recent_attack_mail	12240
recent_attack_web	9734
recent_attack_ssh	6153
aggregate_abuser_1d	3840
recent_badbot_or_regbot	3374
recent_attack_imap	2427
recent_attack_ftp	589
recent_attack_sip	123
abuse	56

Top Infrastructure Labels

Name	Count
bogon	159746
prefix_cybercrime	1701
hosting	911

Top Classification Labels

Name	Count
aggregate_threat_intel	3711998
mail_bruteforce	153460
pop3_bruteforce	153460
aggregate_abuseipdb_confidence_100	129784
aggregate_threat_intel_hourly	93171
spam_source	91503
brute_force	91447
national_cert_malicious	91447
aggregate_inbound_threat	40000
aggregate_outbound_threat	40000
network_scan_or_abuse	34722
internet_scanner	28454
reconnaissance	28454
c2_ioc	25646
dnsbl_malicious	20353
safe_browsing_malicious	20353
phishing_ip	7117
ultra_conservative_aggregate	4450
aggregate_blacklist_scored	3944
cloud_hosting_abuse_derived	911

Blackroute 2026.06.01

Blackroute Release Summary

Release artifacts are cleaned with BogonForge-compatible public IP filtering before publication.

Dataset

• Configured sources: 52
• Sources remaining after cleanup: 50
• Records before cleanup: 3991772
• Single IPs before cleanup: 3600425
• CIDR prefixes before cleanup: 391347
• Records removed by cleanup: 0
• Records published: 3991772
• Single IPs published: 3600425
• CIDR prefixes published: 391347

Cleanup Policy

• Removed invalid IPs and CIDRs.
• Removed private, loopback, link-local, multicast, unspecified, CGNAT, reserved, and overly broad bogon prefixes.
• Rebuilt CSV, JSONL, MMDB, and run stats after cleanup.

Removed By Reason

No entries.

Top Sources

Name	Count
bitwire_inbound	3195614
team_cymru_fullbogons_ipv6	156774
pop3gropers	151335
bitwire_outbound	104878
blocklist_net_ua	86233
ipsum_level1	35222
abuseipdb_s100_30d	33217
dataplane_attack_feeds	30245
ziyadnz_threat_intel_hourly_ipv4	28704
threatfox_ioc_ips	27070
shadowwhisperer_scanners	21938
inversion_dnsbl_google_ipv4	19997
threatview_ip_blocklist	15900
romainmarcoux_outgoing_40k	15337
usom_blocklist_ips	13960
abuseipdb_s100_7d	9077
blocklist_de_web	8536
phishing_database_ips	7105
romainmarcoux_inbound_40k	5645
cinsscore_badguys	5504

Top Threat Labels

Name	Count
recent_attack_any	3778228
community_high_risk	3710282
malware_host_active	3684988
bruteforce	280131
phishing_or_scam	202964
c2_ioc	195986
persistent_attacker	122597
multi_sensor_high_risk	101972
spam	91096
compromised_or_hostile_host	89610
network_scan_or_abuse	28454
recent_attack_mail	12355
recent_attack_web	9481
recent_attack_ssh	5249
recent_badbot_or_regbot	3655
aggregate_abuser_1d	3596
recent_attack_imap	2526
recent_attack_ftp	592
abuse	56
recent_attack_sip	49

Top Infrastructure Labels

Name	Count
bogon	159710
prefix_cybercrime	1701
hosting	912

Top Classification Labels

Name	Count
aggregate_threat_intel	3705993
mail_bruteforce	153459
pop3_bruteforce	153459
aggregate_abuseipdb_confidence_100	129158
national_cert_malicious	105636
aggregate_threat_intel_hourly	99954
spam_source	91096
brute_force	91040
aggregate_inbound_threat	40000
aggregate_outbound_threat	40000
network_scan_or_abuse	35247
internet_scanner	28454
reconnaissance	28454
c2_ioc	27080
dnsbl_malicious	20376
safe_browsing_malicious	20376
malicious_url_or_ip	14730
phishing_ip	7117
ultra_conservative_aggregate	4450
aggregate_blacklist_scored	3944

Blackroute 2026.05.31

Blackroute Release Summary

Release artifacts are cleaned with BogonForge-compatible public IP filtering before publication.

Dataset

• Configured sources: 52
• Sources remaining after cleanup: 50
• Records before cleanup: 3984202
• Single IPs before cleanup: 3594151
• CIDR prefixes before cleanup: 390051
• Records removed by cleanup: 0
• Records published: 3984202
• Single IPs published: 3594151
• CIDR prefixes published: 390051

Cleanup Policy

• Removed invalid IPs and CIDRs.
• Removed private, loopback, link-local, multicast, unspecified, CGNAT, reserved, and overly broad bogon prefixes.
• Rebuilt CSV, JSONL, MMDB, and run stats after cleanup.

Removed By Reason

No entries.

Top Sources

Name	Count
bitwire_inbound	3187829
team_cymru_fullbogons_ipv6	156770
pop3gropers	151071
bitwire_outbound	105740
blocklist_net_ua	84431
ipsum_level1	35942
abuseipdb_s100_30d	33540
dataplane_attack_feeds	30741
ziyadnz_threat_intel_hourly_ipv4	29392
threatfox_ioc_ips	27097
shadowwhisperer_scanners	21957
inversion_dnsbl_google_ipv4	20019
threatview_ip_blocklist	17324
romainmarcoux_outgoing_40k	14525
usom_blocklist_ips	13957
abuseipdb_s100_7d	8487
blocklist_de_web	8160
phishing_database_ips	7104
romainmarcoux_inbound_40k	5574
cinsscore_badguys	5092

Top Threat Labels

Name	Count
recent_attack_any	3770611
community_high_risk	3702804
malware_host_active	3677624
bruteforce	278084
phishing_or_scam	205623
c2_ioc	198645
persistent_attacker	126111
multi_sensor_high_risk	102973
compromised_or_hostile_host	91052
spam	89377
network_scan_or_abuse	28454
recent_attack_mail	12762
recent_attack_web	8877
recent_attack_ssh	7453
aggregate_abuser_1d	3494
recent_attack_imap	2974
recent_badbot_or_regbot	2901
recent_attack_ftp	588
abuse	56
recent_attack_sip	42

Top Infrastructure Labels

Name	Count
bogon	159706
prefix_cybercrime	1701
hosting	916

Top Classification Labels

Name	Count
aggregate_threat_intel	3699762
mail_bruteforce	153457
pop3_bruteforce	153457
aggregate_abuseipdb_confidence_100	129063
national_cert_malicious	103915
aggregate_threat_intel_hourly	100992
spam_source	89377
brute_force	89321
aggregate_inbound_threat	40000
aggregate_outbound_threat	40000
network_scan_or_abuse	36071
internet_scanner	28454
reconnaissance	28454
c2_ioc	27107
dnsbl_malicious	20397
safe_browsing_malicious	20397
malicious_url_or_ip	14730
phishing_ip	7117
ultra_conservative_aggregate	4446
aggregate_blacklist_scored	3944

Blackroute 2026.05.30

Blackroute Release Summary

Release artifacts are cleaned with BogonForge-compatible public IP filtering before publication.

Dataset

• Configured sources: 52
• Sources remaining after cleanup: 50
• Records before cleanup: 3979965
• Single IPs before cleanup: 3590345
• CIDR prefixes before cleanup: 389620
• Records removed by cleanup: 0
• Records published: 3979965
• Single IPs published: 3590345
• CIDR prefixes published: 389620

Cleanup Policy

• Removed invalid IPs and CIDRs.
• Removed private, loopback, link-local, multicast, unspecified, CGNAT, reserved, and overly broad bogon prefixes.
• Rebuilt CSV, JSONL, MMDB, and run stats after cleanup.

Removed By Reason

No entries.

Top Sources

Name	Count
bitwire_inbound	3184640
team_cymru_fullbogons_ipv6	156752
pop3gropers	150969
bitwire_outbound	104972
blocklist_net_ua	83373
ipsum_level1	37947
dataplane_attack_feeds	30929
abuseipdb_s100_30d	30746
ziyadnz_threat_intel_hourly_ipv4	29601
threatfox_ioc_ips	27064
shadowwhisperer_scanners	21939
inversion_dnsbl_google_ipv4	20008
threatview_ip_blocklist	17048
romainmarcoux_outgoing_40k	14793
usom_blocklist_ips	13961
blocklist_de_web	8292
romainmarcoux_inbound_40k	8220
phishing_database_ips	7104
abuseipdb_s100_7d	6435
cinsscore_badguys	5513

Top Threat Labels

Name	Count
recent_attack_any	3765770
community_high_risk	3699828
malware_host_active	3674753
bruteforce	277152
phishing_or_scam	206829
c2_ioc	199853
persistent_attacker	129523
multi_sensor_high_risk	103256
compromised_or_hostile_host	90751
spam	88260
network_scan_or_abuse	28454
recent_attack_mail	13196
recent_attack_web	9203
recent_attack_ssh	5631
recent_badbot_or_regbot	3379
recent_attack_imap	3324
aggregate_abuser_1d	3303
recent_attack_ftp	671
recent_attack_sip	86
abuse	56

Top Infrastructure Labels

Name	Count
bogon	159687
prefix_cybercrime	1700
hosting	918

Top Classification Labels

Name	Count
aggregate_threat_intel	3697382
mail_bruteforce	153407
pop3_bruteforce	153407
aggregate_abuseipdb_confidence_100	128116
national_cert_malicious	102796
aggregate_threat_intel_hourly	101891
spam_source	88260
brute_force	88204
aggregate_inbound_threat	40000
aggregate_outbound_threat	40000
network_scan_or_abuse	36066
internet_scanner	28454
reconnaissance	28454
c2_ioc	27074
dnsbl_malicious	20390
safe_browsing_malicious	20390
malicious_url_or_ip	14729
phishing_ip	7117
ultra_conservative_aggregate	4447
aggregate_blacklist_scored	3944

Blackroute 2026.05.29

Blackroute Release Summary

Release artifacts are cleaned with BogonForge-compatible public IP filtering before publication.

Dataset

• Configured sources: 52
• Sources remaining after cleanup: 50
• Records before cleanup: 3971818
• Single IPs before cleanup: 3582458
• CIDR prefixes before cleanup: 389360
• Records removed by cleanup: 0
• Records published: 3971818
• Single IPs published: 3582458
• CIDR prefixes published: 389360

Cleanup Policy

• Removed invalid IPs and CIDRs.
• Removed private, loopback, link-local, multicast, unspecified, CGNAT, reserved, and overly broad bogon prefixes.
• Rebuilt CSV, JSONL, MMDB, and run stats after cleanup.

Removed By Reason

No entries.

Top Sources

Name	Count
bitwire_inbound	3174644
team_cymru_fullbogons_ipv6	156745
pop3gropers	150914
bitwire_outbound	103811
blocklist_net_ua	83561
ipsum_level1	36293
abuseipdb_s100_30d	34297
dataplane_attack_feeds	31802
ziyadnz_threat_intel_hourly_ipv4	31755
threatfox_ioc_ips	27110
shadowwhisperer_scanners	21857
inversion_dnsbl_google_ipv4	20027
threatview_ip_blocklist	16436
romainmarcoux_outgoing_40k	15261
usom_blocklist_ips	13958
blocklist_de_web	8296
abuseipdb_s100_7d	7903
phishing_database_ips	7097
romainmarcoux_inbound_40k	5677
cinsscore_badguys	5013

Top Threat Labels

Name	Count
recent_attack_any	3757103
community_high_risk	3691468
malware_host_active	3666684
bruteforce	277601
phishing_or_scam	207242
c2_ioc	200266
persistent_attacker	126350
multi_sensor_high_risk	104887
compromised_or_hostile_host	90170
spam	88255
network_scan_or_abuse	28454
recent_attack_mail	13111
recent_attack_web	9145
recent_attack_ssh	5669
aggregate_abuser_1d	3552
recent_attack_imap	3134
recent_badbot_or_regbot	2225
recent_attack_ftp	761
recent_attack_sip	78
abuse	56

Top Infrastructure Labels

Name	Count
bogon	159680
prefix_cybercrime	1700
hosting	918

Top Classification Labels

Name	Count
aggregate_threat_intel	3687692
mail_bruteforce	153405
pop3_bruteforce	153405
aggregate_abuseipdb_confidence_100	129589
aggregate_threat_intel_hourly	103034
national_cert_malicious	102789
spam_source	88255
brute_force	88199
aggregate_inbound_threat	40000
aggregate_outbound_threat	40000
network_scan_or_abuse	36760
internet_scanner	28454
reconnaissance	28454
c2_ioc	27120
dnsbl_malicious	20412
safe_browsing_malicious	20412
malicious_url_or_ip	14729
phishing_ip	7117
ultra_conservative_aggregate	4448
aggregate_blacklist_scored	3944

Blackroute 2026.05.28

Blackroute Release Summary

Release artifacts are cleaned with BogonForge-compatible public IP filtering before publication.

Dataset

• Configured sources: 52
• Sources remaining after cleanup: 50
• Records before cleanup: 3977351
• Single IPs before cleanup: 3585849
• CIDR prefixes before cleanup: 391502
• Records removed by cleanup: 0
• Records published: 3977351
• Single IPs published: 3585849
• CIDR prefixes published: 391502

Cleanup Policy

• Removed invalid IPs and CIDRs.
• Removed private, loopback, link-local, multicast, unspecified, CGNAT, reserved, and overly broad bogon prefixes.
• Rebuilt CSV, JSONL, MMDB, and run stats after cleanup.

Removed By Reason

No entries.

Top Sources

Name	Count
bitwire_inbound	3181920
team_cymru_fullbogons_ipv6	156739
pop3gropers	150643
bitwire_outbound	104003
blocklist_net_ua	82928
ipsum_level1	35686
ziyadnz_threat_intel_hourly_ipv4	32667
dataplane_attack_feeds	32309
abuseipdb_s100_30d	31548
threatfox_ioc_ips	27191
shadowwhisperer_scanners	22016
inversion_dnsbl_google_ipv4	20055
threatview_ip_blocklist	17018
romainmarcoux_outgoing_40k	14326
usom_blocklist_ips	13959
blocklist_de_web	8235
romainmarcoux_inbound_40k	7981
phishing_database_ips	7104
abuseipdb_s100_7d	6870
cinsscore_badguys	5641

Top Threat Labels

Name	Count
recent_attack_any	3762305
community_high_risk	3697120
malware_host_active	3672271
bruteforce	276948
phishing_or_scam	206294
c2_ioc	199320
persistent_attacker	127287
multi_sensor_high_risk	105882
compromised_or_hostile_host	90888
spam	87824
network_scan_or_abuse	28454
recent_attack_mail	12913
recent_attack_web	8949
recent_attack_ssh	5775
aggregate_abuser_1d	3707
recent_attack_imap	3009
recent_badbot_or_regbot	1324
recent_attack_ftp	802
abuse	56
recent_attack_sip	31

Top Infrastructure Labels

Name	Count
bogon	159675
prefix_cybercrime	1702
hosting	918

Top Classification Labels

Name	Count
aggregate_threat_intel	3693124
mail_bruteforce	153365
pop3_bruteforce	153365
aggregate_abuseipdb_confidence_100	128978
aggregate_threat_intel_hourly	104058
national_cert_malicious	102358
spam_source	87824
brute_force	87768
aggregate_inbound_threat	40000
aggregate_outbound_threat	40000
network_scan_or_abuse	37433
internet_scanner	28454
reconnaissance	28454
c2_ioc	27201
dnsbl_malicious	20440
safe_browsing_malicious	20440
malicious_url_or_ip	14729
phishing_ip	7117
ultra_conservative_aggregate	4450
aggregate_blacklist_scored	3944

Blackroute 2026.05.27

Blackroute Release Summary

Release artifacts are cleaned with BogonForge-compatible public IP filtering before publication.

Dataset

• Configured sources: 52
• Sources remaining after cleanup: 49
• Records before cleanup: 3969538
• Single IPs before cleanup: 3578157
• CIDR prefixes before cleanup: 391381
• Records removed by cleanup: 0
• Records published: 3969538
• Single IPs published: 3578157
• CIDR prefixes published: 391381

Cleanup Policy

• Removed invalid IPs and CIDRs.
• Removed private, loopback, link-local, multicast, unspecified, CGNAT, reserved, and overly broad bogon prefixes.
• Rebuilt CSV, JSONL, MMDB, and run stats after cleanup.

Removed By Reason

No entries.

Top Sources

Name	Count
bitwire_inbound	3173550
team_cymru_fullbogons_ipv6	156763
pop3gropers	150394
bitwire_outbound	105439
blocklist_net_ua	82247
ipsum_level1	35087
dataplane_attack_feeds	31758
abuseipdb_s100_30d	31376
ziyadnz_threat_intel_hourly_ipv4	31239
threatfox_ioc_ips	27243
shadowwhisperer_scanners	21821
inversion_dnsbl_google_ipv4	20065
threatview_ip_blocklist	17378
romainmarcoux_outgoing_40k	14695
usom_blocklist_ips	13944
blocklist_de_mail	8505
romainmarcoux_inbound_40k	7978
abuseipdb_s100_7d	7271
phishing_database_ips	7104
cinsscore_badguys	6154

Top Threat Labels

Name	Count
recent_attack_any	3753722
community_high_risk	3689061
malware_host_active	3664344
bruteforce	275819
phishing_or_scam	208369
c2_ioc	201396
persistent_attacker	127078
multi_sensor_high_risk	104854
compromised_or_hostile_host	91358
spam	86270
network_scan_or_abuse	28454
recent_attack_mail	13215
recent_attack_web	8813
recent_attack_ssh	5404
aggregate_abuser_1d	3911
recent_attack_imap	3340
recent_badbot_or_regbot	2324
recent_attack_ftp	1129
abuse	56
recent_attack_sip	43

Top Infrastructure Labels

Name	Count
bogon	159695
prefix_cybercrime	1706
hosting	916

Top Classification Labels

Name	Count
aggregate_threat_intel	3685642
mail_bruteforce	153365
pop3_bruteforce	153365
aggregate_abuseipdb_confidence_100	127939
aggregate_threat_intel_hourly	102499
national_cert_malicious	100810
spam_source	86270
brute_force	86214
aggregate_inbound_threat	40000
aggregate_outbound_threat	40000
network_scan_or_abuse	37371
internet_scanner	28454
reconnaissance	28454
c2_ioc	27253
dnsbl_malicious	20453
safe_browsing_malicious	20453
malicious_url_or_ip	14729
phishing_ip	7117
ultra_conservative_aggregate	4453
aggregate_blacklist_scored	3944

Blackroute 2026.05.26

Blackroute Release Summary

Release artifacts are cleaned with BogonForge-compatible public IP filtering before publication.

Dataset

• Configured sources: 52
• Sources remaining after cleanup: 51
• Records before cleanup: 3966331
• Single IPs before cleanup: 3574972
• CIDR prefixes before cleanup: 391359
• Records removed by cleanup: 0
• Records published: 3966331
• Single IPs published: 3574972
• CIDR prefixes published: 391359

Cleanup Policy

• Removed invalid IPs and CIDRs.
• Removed private, loopback, link-local, multicast, unspecified, CGNAT, reserved, and overly broad bogon prefixes.
• Rebuilt CSV, JSONL, MMDB, and run stats after cleanup.

Removed By Reason

No entries.

Top Sources

Name	Count
bitwire_inbound	3164746
team_cymru_fullbogons_ipv6	156760
pop3gropers	150439
bitwire_outbound	103314
blocklist_net_ua	82374
ziyadnz_threat_intel_hourly_ipv4	37836
ipsum_level1	34881
dataplane_attack_feeds	32917
abuseipdb_s100_30d	29419
threatfox_ioc_ips	27338
shadowwhisperer_scanners	22073
inversion_dnsbl_google_ipv4	20063
threatview_ip_blocklist	16292
romainmarcoux_outgoing_40k	14741
usom_blocklist_ips	13939
blocklist_de_web	8225
romainmarcoux_inbound_40k	7796
abuseipdb_s100_7d	7588
phishing_database_ips	7104
cinsscore_badguys	6672

Top Threat Labels

Name	Count
recent_attack_any	3748751
community_high_risk	3688076
malware_host_active	3660426
bruteforce	275824
phishing_or_scam	206434
c2_ioc	199460
persistent_attacker	127150
multi_sensor_high_risk	114212
compromised_or_hostile_host	90360
spam	86391
network_scan_or_abuse	28454
recent_attack_mail	13533
recent_attack_web	8767
recent_attack_ssh	4877
aggregate_abuser_1d	4811
recent_attack_imap	3562
recent_badbot_or_regbot	2701
recent_attack_ftp	1856
abuse	56
recent_attack_sip	40

Top Infrastructure Labels

Name	Count
bogon	159695
prefix_cybercrime	1706
hosting	916

Top Classification Labels

Name	Count
aggregate_threat_intel	3680245
mail_bruteforce	153341
pop3_bruteforce	153341
aggregate_abuseipdb_confidence_100	127614
aggregate_threat_intel_hourly	111966
national_cert_malicious	100931
spam_source	86391
brute_force	86335
aggregate_inbound_threat	40000
aggregate_outbound_threat	40000
network_scan_or_abuse	37904
internet_scanner	28454
reconnaissance	28454
c2_ioc	27348
dnsbl_malicious	20453
safe_browsing_malicious	20453
malicious_url_or_ip	14729
phishing_ip	7117
ultra_conservative_aggregate	4447
aggregate_blacklist_scored	3944