Blackroute 2026.07.28

Blackroute Release Summary

Release artifacts are cleaned with BogonForge-compatible public IP filtering before publication.

Dataset

• Configured sources: 51
• Sources remaining after cleanup: 47
• Records before cleanup: 4419348
• Single IPs before cleanup: 4031470
• CIDR prefixes before cleanup: 387878
• Records removed by cleanup: 0
• Records published: 4419348
• Single IPs published: 4031470
• CIDR prefixes published: 387878

Cleanup Policy

• Removed invalid IPs and CIDRs.
• Removed private, loopback, link-local, multicast, unspecified, CGNAT, reserved, and overly broad bogon prefixes.
• Rebuilt CSV, JSONL, MMDB, and run stats after cleanup.

Removed By Reason

No entries.

Top Sources

Name	Count
bitwire_inbound	3615093
team_cymru_fullbogons_ipv6	156293
pop3gropers	152751
blocklist_net_ua	124462
bitwire_outbound	102834
ziyadnz_threat_intel_hourly_ipv4	42183
dataplane_attack_feeds	32803
ipsum_level1	29805
abuseipdb_s100_30d	26727
threatfox_ioc_ips	20674
threatview_ip_blocklist	19850
romainmarcoux_outgoing_40k	19441
inversion_dnsbl_google_ipv4	19159
romainmarcoux_inbound_40k	10838
blocklist_de_web	8275
cinsscore_badguys	7222
phishing_database_ips	7106
abuseipdb_s100_7d	5236
firehol_abusers_1d	3674
ipblocklist_level3	3273

Top Threat Labels

Name	Count
recent_attack_any	4201964
community_high_risk	4134521
malware_host_active	4113723
bruteforce	320955
phishing_or_scam	194245
c2_ioc	187249
spam	128821
persistent_attacker	112508
multi_sensor_high_risk	104538
compromised_or_hostile_host	72258
recent_attack_mail	12907
recent_attack_web	9288
recent_attack_ssh	4814
aggregate_abuser_1d	3883
recent_badbot_or_regbot	3566
recent_attack_imap	3549
recent_attack_ftp	64
abuse	60
recent_attack_sip	54

Top Infrastructure Labels

Name	Count
bogon	159288
prefix_cybercrime	1756
hosting	858

Top Classification Labels

Name	Count
aggregate_threat_intel	4121855
mail_bruteforce	155684
pop3_bruteforce	155684
spam_source	128821
brute_force	128761
national_cert_malicious	128761
aggregate_abuseipdb_confidence_100	102178
aggregate_threat_intel_hourly	101048
aggregate_inbound_threat	40000
aggregate_outbound_threat	40000
network_scan_or_abuse	36787
c2_ioc	20685
dnsbl_malicious	19414
safe_browsing_malicious	19414
phishing_ip	7120
ultra_conservative_aggregate	4570
aggregate_blacklist_scored	3944
university_honeypot_attacker	1667
cloud_hosting_abuse_derived	858
cobalt_strike_c2	801

Blackroute 2026.07.27

Blackroute Release Summary

Release artifacts are cleaned with BogonForge-compatible public IP filtering before publication.

Dataset

• Configured sources: 51
• Sources remaining after cleanup: 47
• Records before cleanup: 4416566
• Single IPs before cleanup: 4028632
• CIDR prefixes before cleanup: 387934
• Records removed by cleanup: 0
• Records published: 4416566
• Single IPs published: 4028632
• CIDR prefixes published: 387934

Cleanup Policy

• Removed invalid IPs and CIDRs.
• Removed private, loopback, link-local, multicast, unspecified, CGNAT, reserved, and overly broad bogon prefixes.
• Rebuilt CSV, JSONL, MMDB, and run stats after cleanup.

Removed By Reason

No entries.

Top Sources

Name	Count
bitwire_inbound	3613436
team_cymru_fullbogons_ipv6	156294
pop3gropers	152599
blocklist_net_ua	123574
bitwire_outbound	102354
ziyadnz_threat_intel_hourly_ipv4	41648
dataplane_attack_feeds	33027
ipsum_level1	29611
abuseipdb_s100_30d	26952
threatfox_ioc_ips	20941
romainmarcoux_outgoing_40k	19781
threatview_ip_blocklist	19161
inversion_dnsbl_google_ipv4	19142
romainmarcoux_inbound_40k	10970
blocklist_de_web	8257
cinsscore_badguys	7454
phishing_database_ips	7107
abuseipdb_s100_7d	6325
ipblocklist_level3	3278
team_cymru_fullbogons_ipv4	2995

Top Threat Labels

Name	Count
recent_attack_any	4199390
community_high_risk	4131669
malware_host_active	4111144
bruteforce	319959
phishing_or_scam	194184
c2_ioc	187188
spam	127985
persistent_attacker	113014
multi_sensor_high_risk	104395
compromised_or_hostile_host	71858
recent_attack_mail	13021
recent_attack_web	9307
recent_attack_ssh	4585
recent_badbot_or_regbot	3765
recent_attack_imap	3576
aggregate_abuser_1d	3025
recent_attack_ftp	71
recent_attack_sip	70
abuse	60

Top Infrastructure Labels

Name	Count
bogon	159289
prefix_cybercrime	1756
hosting	857

Top Classification Labels

Name	Count
aggregate_threat_intel	4119945
mail_bruteforce	155674
pop3_bruteforce	155674
spam_source	127985
brute_force	127925
national_cert_malicious	127925
aggregate_abuseipdb_confidence_100	103111
aggregate_threat_intel_hourly	100800
aggregate_inbound_threat	40000
aggregate_outbound_threat	40000
network_scan_or_abuse	36790
c2_ioc	20952
dnsbl_malicious	19436
safe_browsing_malicious	19436
phishing_ip	7120
ultra_conservative_aggregate	4570
aggregate_blacklist_scored	3944
university_honeypot_attacker	1608
cloud_hosting_abuse_derived	857
cobalt_strike_c2	801

Blackroute 2026.07.26

Blackroute Release Summary

Release artifacts are cleaned with BogonForge-compatible public IP filtering before publication.

Dataset

• Configured sources: 51
• Sources remaining after cleanup: 47
• Records before cleanup: 4406869
• Single IPs before cleanup: 4018999
• CIDR prefixes before cleanup: 387870
• Records removed by cleanup: 0
• Records published: 4406869
• Single IPs published: 4018999
• CIDR prefixes published: 387870

Cleanup Policy

• Removed invalid IPs and CIDRs.
• Removed private, loopback, link-local, multicast, unspecified, CGNAT, reserved, and overly broad bogon prefixes.
• Rebuilt CSV, JSONL, MMDB, and run stats after cleanup.

Removed By Reason

No entries.

Top Sources

Name	Count
bitwire_inbound	3601850
team_cymru_fullbogons_ipv6	156288
pop3gropers	152433
blocklist_net_ua	123387
bitwire_outbound	103043
ipsum_level1	37705
dataplane_attack_feeds	33077
ziyadnz_threat_intel_hourly_ipv4	32539
abuseipdb_s100_30d	30503
threatfox_ioc_ips	20655
threatview_ip_blocklist	20208
romainmarcoux_outgoing_40k	19576
inversion_dnsbl_google_ipv4	19192
blocklist_de_web	8264
cinsscore_badguys	7540
romainmarcoux_inbound_40k	7516
phishing_database_ips	7106
abuseipdb_s100_7d	6215
blocklist_de_bots	3541
ipblocklist_level3	3277

Top Threat Labels

Name	Count
recent_attack_any	4190833
community_high_risk	4120649
malware_host_active	4099802
bruteforce	319726
phishing_or_scam	195311
c2_ioc	188316
spam	127862
persistent_attacker	114423
multi_sensor_high_risk	105281
compromised_or_hostile_host	72624
recent_attack_mail	13201
recent_attack_web	9405
recent_badbot_or_regbot	5729
recent_attack_ssh	4621
recent_attack_imap	3698
aggregate_abuser_1d	3269
recent_attack_ftp	86
recent_attack_sip	82
abuse	60

Top Infrastructure Labels

Name	Count
bogon	159280
prefix_cybercrime	1762
hosting	861

Top Classification Labels

Name	Count
aggregate_threat_intel	4110413
mail_bruteforce	155623
pop3_bruteforce	155623
spam_source	127862
brute_force	127802
national_cert_malicious	127802
aggregate_abuseipdb_confidence_100	103020
aggregate_threat_intel_hourly	101663
aggregate_inbound_threat	40000
aggregate_outbound_threat	40000
network_scan_or_abuse	36658
c2_ioc	20666
dnsbl_malicious	19454
safe_browsing_malicious	19454
phishing_ip	7120
ultra_conservative_aggregate	4571
aggregate_blacklist_scored	3944
university_honeypot_attacker	1884
cloud_hosting_abuse_derived	861
cobalt_strike_c2	801

Blackroute 2026.07.25

Blackroute Release Summary

Release artifacts are cleaned with BogonForge-compatible public IP filtering before publication.

Dataset

• Configured sources: 51
• Sources remaining after cleanup: 46
• Records before cleanup: 4401370
• Single IPs before cleanup: 4013543
• CIDR prefixes before cleanup: 387827
• Records removed by cleanup: 0
• Records published: 4401370
• Single IPs published: 4013543
• CIDR prefixes published: 387827

Cleanup Policy

• Removed invalid IPs and CIDRs.
• Removed private, loopback, link-local, multicast, unspecified, CGNAT, reserved, and overly broad bogon prefixes.
• Rebuilt CSV, JSONL, MMDB, and run stats after cleanup.

Removed By Reason

No entries.

Top Sources

Name	Count
bitwire_inbound	3595686
team_cymru_fullbogons_ipv6	156286
pop3gropers	152793
blocklist_net_ua	122999
bitwire_outbound	102470
ziyadnz_threat_intel_hourly_ipv4	39109
abuseipdb_s100_30d	36667
dataplane_attack_feeds	32632
ipsum_level1	29162
threatfox_ioc_ips	20856
romainmarcoux_outgoing_40k	19302
inversion_dnsbl_google_ipv4	19193
threatview_ip_blocklist	19096
blocklist_de_web	8463
romainmarcoux_inbound_40k	7455
cinsscore_badguys	7214
phishing_database_ips	7095
firehol_abusers_1d	5519
blocklist_de_bots	3914
ipblocklist_level3	3277

Top Threat Labels

Name	Count
recent_attack_any	4186793
community_high_risk	4115087
malware_host_active	4094363
bruteforce	320762
phishing_or_scam	195101
c2_ioc	188107
spam	127515
persistent_attacker	115337
multi_sensor_high_risk	104751
compromised_or_hostile_host	71711
recent_attack_mail	13059
recent_attack_web	9484
recent_badbot_or_regbot	7140
aggregate_abuser_1d	5853
recent_attack_ssh	4590
recent_attack_imap	3511
recent_attack_ftp	83
recent_attack_sip	76
abuse	60

Top Infrastructure Labels

Name	Count
bogon	159278
prefix_cybercrime	1762
hosting	863

Top Classification Labels

Name	Count
aggregate_threat_intel	4105501
mail_bruteforce	155485
pop3_bruteforce	155485
spam_source	127515
brute_force	127455
national_cert_malicious	127455
aggregate_abuseipdb_confidence_100	103341
aggregate_threat_intel_hourly	102898
aggregate_inbound_threat	40000
aggregate_outbound_threat	40000
network_scan_or_abuse	36206
c2_ioc	20867
dnsbl_malicious	19456
safe_browsing_malicious	19456
phishing_ip	7120
ultra_conservative_aggregate	4572
aggregate_blacklist_scored	3944
university_honeypot_attacker	3058
cloud_hosting_abuse_derived	863
cobalt_strike_c2	801

Blackroute 2026.07.24

Blackroute Release Summary

Release artifacts are cleaned with BogonForge-compatible public IP filtering before publication.

Dataset

• Configured sources: 51
• Sources remaining after cleanup: 45
• Records before cleanup: 3516610
• Single IPs before cleanup: 3314919
• CIDR prefixes before cleanup: 201691
• Records removed by cleanup: 0
• Records published: 3516610
• Single IPs published: 3314919
• CIDR prefixes published: 201691

Cleanup Policy

• Removed invalid IPs and CIDRs.
• Removed private, loopback, link-local, multicast, unspecified, CGNAT, reserved, and overly broad bogon prefixes.
• Rebuilt CSV, JSONL, MMDB, and run stats after cleanup.

Removed By Reason

No entries.

Top Sources

Name	Count
bitwire_inbound	2868208
pop3gropers	153434
blocklist_net_ua	123082
bitwire_outbound	102832
ziyadnz_threat_intel_hourly_ipv4	38239
dataplane_attack_feeds	31806
abuseipdb_s100_30d	30291
ipsum_level1	29717
threatfox_ioc_ips	21048
threatview_ip_blocklist	20716
inversion_dnsbl_google_ipv4	19164
romainmarcoux_outgoing_40k	18998
blocklist_de_web	8335
cinsscore_badguys	7465
romainmarcoux_inbound_40k	7449
phishing_database_ips	7106
abuseipdb_s100_7d	5658
blocklist_de_bots	3687
firehol_abusers_1d	3541
ipblocklist_level3	3272

Top Threat Labels

Name	Count
recent_attack_any	3458469
community_high_risk	3389372
malware_host_active	3365934
bruteforce	321445
phishing_or_scam	197535
c2_ioc	190541
spam	128326
persistent_attacker	118702
multi_sensor_high_risk	107011
compromised_or_hostile_host	73499
recent_attack_mail	13708
recent_attack_ssh	9601
recent_attack_web	9367
recent_badbot_or_regbot	5939
recent_attack_imap	4152
aggregate_abuser_1d	3764
recent_attack_sip	108
recent_attack_ftp	107
abuse	60

Top Infrastructure Labels

Name	Count
prefix_cybercrime	1760
hosting	866

Top Classification Labels

Name	Count
aggregate_threat_intel	3375992
mail_bruteforce	155468
pop3_bruteforce	155468
spam_source	128326
brute_force	128266
national_cert_malicious	128266
aggregate_abuseipdb_confidence_100	103234
aggregate_threat_intel_hourly	102938
aggregate_inbound_threat	40000
aggregate_outbound_threat	40000
network_scan_or_abuse	35576
c2_ioc	21059
dnsbl_malicious	19459
safe_browsing_malicious	19459
phishing_ip	7120
ultra_conservative_aggregate	4578
aggregate_blacklist_scored	3944
university_honeypot_attacker	1963
cloud_hosting_abuse_derived	866
cobalt_strike_c2	801

Blackroute 2026.07.23

Blackroute Release Summary

Release artifacts are cleaned with BogonForge-compatible public IP filtering before publication.

Dataset

• Configured sources: 51
• Sources remaining after cleanup: 47
• Records before cleanup: 4384062
• Single IPs before cleanup: 3997027
• CIDR prefixes before cleanup: 387035
• Records removed by cleanup: 0
• Records published: 4384062
• Single IPs published: 3997027
• CIDR prefixes published: 387035

Cleanup Policy

• Removed invalid IPs and CIDRs.
• Removed private, loopback, link-local, multicast, unspecified, CGNAT, reserved, and overly broad bogon prefixes.
• Rebuilt CSV, JSONL, MMDB, and run stats after cleanup.

Removed By Reason

No entries.

Top Sources

Name	Count
bitwire_inbound	3576821
team_cymru_fullbogons_ipv6	156241
pop3gropers	152884
blocklist_net_ua	122530
bitwire_outbound	103275
ziyadnz_threat_intel_hourly_ipv4	40597
ipsum_level1	33382
dataplane_attack_feeds	30861
abuseipdb_s100_30d	27090
threatview_ip_blocklist	24209
threatfox_ioc_ips	21199
inversion_dnsbl_google_ipv4	19171
romainmarcoux_outgoing_40k	18194
romainmarcoux_inbound_40k	10158
blocklist_de_web	8241
phishing_database_ips	7107
cinsscore_badguys	6538
abuseipdb_s100_7d	5021
firehol_abusers_1d	3645
ipblocklist_level3	3270

Top Threat Labels

Name	Count
recent_attack_any	4165944
community_high_risk	4095777
malware_host_active	4076810
bruteforce	320943
phishing_or_scam	197777
c2_ioc	190789
spam	127990
persistent_attacker	120875
multi_sensor_high_risk	107663
compromised_or_hostile_host	77085
recent_attack_mail	13362
recent_attack_ssh	9641
recent_attack_web	9343
recent_attack_imap	3869
aggregate_abuser_1d	3820
recent_badbot_or_regbot	3435
recent_attack_sip	104
recent_attack_ftp	102
abuse	60

Top Infrastructure Labels

Name	Count
bogon	159237
prefix_cybercrime	1761
hosting	864

Top Classification Labels

Name	Count
aggregate_threat_intel	4088024
mail_bruteforce	155350
pop3_bruteforce	155350
spam_source	127990
brute_force	127930
national_cert_malicious	127930
aggregate_threat_intel_hourly	104429
aggregate_abuseipdb_confidence_100	103727
aggregate_inbound_threat	40000
aggregate_outbound_threat	40000
network_scan_or_abuse	36226
c2_ioc	21210
dnsbl_malicious	19466
safe_browsing_malicious	19466
phishing_ip	7120
ultra_conservative_aggregate	4574
aggregate_blacklist_scored	3944
university_honeypot_attacker	1803
cloud_hosting_abuse_derived	864
cobalt_strike_c2	801

Blackroute 2026.07.22

Blackroute Release Summary

Release artifacts are cleaned with BogonForge-compatible public IP filtering before publication.

Dataset

• Configured sources: 51
• Sources remaining after cleanup: 48
• Records before cleanup: 4390347
• Single IPs before cleanup: 4002715
• CIDR prefixes before cleanup: 387632
• Records removed by cleanup: 0
• Records published: 4390347
• Single IPs published: 4002715
• CIDR prefixes published: 387632

Cleanup Policy

• Removed invalid IPs and CIDRs.
• Removed private, loopback, link-local, multicast, unspecified, CGNAT, reserved, and overly broad bogon prefixes.
• Rebuilt CSV, JSONL, MMDB, and run stats after cleanup.

Removed By Reason

No entries.

Top Sources

Name	Count
bitwire_inbound	3568128
team_cymru_fullbogons_ipv6	156235
pop3gropers	152804
blocklist_net_ua	122603
bitwire_outbound	100801
ziyadnz_threat_intel_hourly_ipv4	40498
dataplane_attack_feeds	31397
abuseipdb_s100_30d	31333
ipsum_level1	30506
shadowwhisperer_scanners	22411
threatview_ip_blocklist	21403
threatfox_ioc_ips	21282
inversion_dnsbl_google_ipv4	19221
romainmarcoux_outgoing_40k	18620
blocklist_de_web	8165
phishing_database_ips	7107
romainmarcoux_inbound_40k	6902
cinsscore_badguys	6294
abuseipdb_s100_7d	5069
firehol_abusers_1d	4266

Top Threat Labels

Name	Count
recent_attack_any	4173409
community_high_risk	4086957
malware_host_active	4067589
bruteforce	320476
phishing_or_scam	194235
c2_ioc	187241
spam	127651
persistent_attacker	115433
multi_sensor_high_risk	104464
compromised_or_hostile_host	74408
network_scan_or_abuse	28454
recent_attack_mail	13942
recent_attack_web	9352
recent_attack_ssh	5829
aggregate_abuser_1d	4498
recent_attack_imap	4436
recent_badbot_or_regbot	3614
recent_attack_ftp	87
recent_attack_sip	82
abuse	60

Top Infrastructure Labels

Name	Count
bogon	159220
prefix_cybercrime	1761
hosting	865

Top Classification Labels

Name	Count
aggregate_threat_intel	4077846
mail_bruteforce	155330
pop3_bruteforce	155330
spam_source	127651
brute_force	127591
national_cert_malicious	127591
aggregate_abuseipdb_confidence_100	104200
aggregate_threat_intel_hourly	101075
aggregate_inbound_threat	40000
aggregate_outbound_threat	40000
network_scan_or_abuse	36648
internet_scanner	28454
reconnaissance	28454
c2_ioc	21293
dnsbl_malicious	19476
safe_browsing_malicious	19476
phishing_ip	7120
ultra_conservative_aggregate	4562
aggregate_blacklist_scored	3944
university_honeypot_attacker	1988

Blackroute 2026.07.21

Blackroute Release Summary

Release artifacts are cleaned with BogonForge-compatible public IP filtering before publication.

Dataset

• Configured sources: 51
• Sources remaining after cleanup: 48
• Records before cleanup: 4381610
• Single IPs before cleanup: 3993905
• CIDR prefixes before cleanup: 387705
• Records removed by cleanup: 0
• Records published: 4381610
• Single IPs published: 3993905
• CIDR prefixes published: 387705

Cleanup Policy

• Removed invalid IPs and CIDRs.
• Removed private, loopback, link-local, multicast, unspecified, CGNAT, reserved, and overly broad bogon prefixes.
• Rebuilt CSV, JSONL, MMDB, and run stats after cleanup.

Removed By Reason

No entries.

Top Sources

Name	Count
bitwire_inbound	3560371
team_cymru_fullbogons_ipv6	156197
pop3gropers	153262
blocklist_net_ua	122708
bitwire_outbound	99979
ziyadnz_threat_intel_hourly_ipv4	39163
dataplane_attack_feeds	32790
ipsum_level1	29867
abuseipdb_s100_30d	27916
shadowwhisperer_scanners	22274
threatfox_ioc_ips	21340
romainmarcoux_outgoing_40k	19272
inversion_dnsbl_google_ipv4	19210
threatview_ip_blocklist	18457
romainmarcoux_inbound_40k	10171
blocklist_de_web	8626
phishing_database_ips	7107
cinsscore_badguys	6162
abuseipdb_s100_7d	5736
firehol_abusers_1d	3771

Top Threat Labels

Name	Count
recent_attack_any	4163942
community_high_risk	4078443
malware_host_active	4057921
bruteforce	319895
phishing_or_scam	192585
c2_ioc	185589
spam	127210
persistent_attacker	113005
multi_sensor_high_risk	105397
compromised_or_hostile_host	71573
network_scan_or_abuse	28454
recent_attack_mail	12703
recent_attack_web	9395
recent_attack_ssh	5352
recent_badbot_or_regbot	4212
aggregate_abuser_1d	3988
recent_attack_imap	3152
recent_attack_ftp	92
recent_attack_sip	78
abuse	60

Top Infrastructure Labels

Name	Count
bogon	159179
prefix_cybercrime	1759
hosting	866

Top Classification Labels

Name	Count
aggregate_threat_intel	4068913
mail_bruteforce	155311
pop3_bruteforce	155311
spam_source	127210
brute_force	127150
national_cert_malicious	127150
aggregate_abuseipdb_confidence_100	103403
aggregate_threat_intel_hourly	102390
aggregate_inbound_threat	40000
aggregate_outbound_threat	40000
network_scan_or_abuse	36950
internet_scanner	28454
reconnaissance	28454
c2_ioc	21351
dnsbl_malicious	19501
safe_browsing_malicious	19501
phishing_ip	7120
ultra_conservative_aggregate	4560
aggregate_blacklist_scored	3944
university_honeypot_attacker	2052

Blackroute 2026.07.20

Blackroute Release Summary

Release artifacts are cleaned with BogonForge-compatible public IP filtering before publication.

Dataset

• Configured sources: 51
• Sources remaining after cleanup: 48
• Records before cleanup: 4375282
• Single IPs before cleanup: 3987655
• CIDR prefixes before cleanup: 387627
• Records removed by cleanup: 0
• Records published: 4375282
• Single IPs published: 3987655
• CIDR prefixes published: 387627

Cleanup Policy

• Removed invalid IPs and CIDRs.
• Removed private, loopback, link-local, multicast, unspecified, CGNAT, reserved, and overly broad bogon prefixes.
• Rebuilt CSV, JSONL, MMDB, and run stats after cleanup.

Removed By Reason

No entries.

Top Sources

Name	Count
bitwire_inbound	3554499
team_cymru_fullbogons_ipv6	156169
pop3gropers	153045
blocklist_net_ua	121811
bitwire_outbound	101317
ziyadnz_threat_intel_hourly_ipv4	41014
ipsum_level1	33144
dataplane_attack_feeds	32514
abuseipdb_s100_30d	27762
shadowwhisperer_scanners	22164
threatfox_ioc_ips	21506
inversion_dnsbl_google_ipv4	19223
romainmarcoux_outgoing_40k	18763
threatview_ip_blocklist	18458
romainmarcoux_inbound_40k	10359
blocklist_de_web	8327
phishing_database_ips	7108
cinsscore_badguys	5588
abuseipdb_s100_7d	4393
ipblocklist_level3	3272

Top Threat Labels

Name	Count
recent_attack_any	4156395
community_high_risk	4071931
malware_host_active	4051791
bruteforce	318601
phishing_or_scam	192259
c2_ioc	185263
spam	126036
persistent_attacker	117780
multi_sensor_high_risk	105238
compromised_or_hostile_host	71784
network_scan_or_abuse	28454
recent_attack_mail	12565
recent_attack_web	9221
recent_attack_ssh	4981
recent_badbot_or_regbot	3564
aggregate_abuser_1d	3280
recent_attack_imap	3049
recent_attack_ftp	85
abuse	60
recent_attack_sip	59

Top Infrastructure Labels

Name	Count
bogon	159152
prefix_cybercrime	1770
hosting	869

Top Classification Labels

Name	Count
aggregate_threat_intel	4064489
mail_bruteforce	155299
pop3_bruteforce	155299
spam_source	126036
brute_force	125976
national_cert_malicious	125976
aggregate_threat_intel_hourly	103201
aggregate_abuseipdb_confidence_100	103074
aggregate_inbound_threat	40000
aggregate_outbound_threat	40000
network_scan_or_abuse	36876
internet_scanner	28454
reconnaissance	28454
c2_ioc	21517
dnsbl_malicious	19510
safe_browsing_malicious	19510
phishing_ip	7120
ultra_conservative_aggregate	4567
aggregate_blacklist_scored	3944
university_honeypot_attacker	1760

Blackroute 2026.07.19

Blackroute Release Summary

Release artifacts are cleaned with BogonForge-compatible public IP filtering before publication.

Dataset

• Configured sources: 51
• Sources remaining after cleanup: 48
• Records before cleanup: 4370221
• Single IPs before cleanup: 3983310
• CIDR prefixes before cleanup: 386911
• Records removed by cleanup: 0
• Records published: 4370221
• Single IPs published: 3983310
• CIDR prefixes published: 386911

Cleanup Policy

• Removed invalid IPs and CIDRs.
• Removed private, loopback, link-local, multicast, unspecified, CGNAT, reserved, and overly broad bogon prefixes.
• Rebuilt CSV, JSONL, MMDB, and run stats after cleanup.

Removed By Reason

No entries.

Top Sources

Name	Count
bitwire_inbound	3549628
team_cymru_fullbogons_ipv6	156156
pop3gropers	152595
blocklist_net_ua	120856
bitwire_outbound	101079
ziyadnz_threat_intel_hourly_ipv4	38402
abuseipdb_s100_30d	32346
ipsum_level1	30871
dataplane_attack_feeds	30319
shadowwhisperer_scanners	22218
threatfox_ioc_ips	21595
threatview_ip_blocklist	21185
inversion_dnsbl_google_ipv4	19233
romainmarcoux_outgoing_40k	18597
romainmarcoux_inbound_40k	10309
blocklist_de_mail	8383
phishing_database_ips	7108
abuseipdb_s100_7d	5645
cinsscore_badguys	5319
ipblocklist_level3	3281

Top Threat Labels

Name	Count
recent_attack_any	4152201
community_high_risk	4070440
malware_host_active	4045569
bruteforce	318048
phishing_or_scam	193410
c2_ioc	186414
spam	125580
persistent_attacker	115599
multi_sensor_high_risk	104297
compromised_or_hostile_host	74602
network_scan_or_abuse	28454
recent_attack_mail	14362
recent_attack_web	9172
recent_attack_ssh	5650
recent_attack_imap	4926
recent_badbot_or_regbot	4052
aggregate_abuser_1d	3085
recent_attack_ftp	425
recent_attack_sip	105
abuse	60

Top Infrastructure Labels

Name	Count
bogon	159139
prefix_cybercrime	1770
hosting	869

Top Classification Labels

Name	Count
aggregate_threat_intel	4056148
mail_bruteforce	155289
pop3_bruteforce	155289
spam_source	125580
brute_force	125520
national_cert_malicious	125520
aggregate_abuseipdb_confidence_100	110688
aggregate_threat_intel_hourly	101544
aggregate_inbound_threat	40000
aggregate_outbound_threat	40000
network_scan_or_abuse	35167
internet_scanner	28454
reconnaissance	28454
c2_ioc	21606
dnsbl_malicious	19529
safe_browsing_malicious	19529
phishing_ip	7120
ultra_conservative_aggregate	4568
aggregate_blacklist_scored	3944
university_honeypot_attacker	1361