Blackroute 2026.06.30

Blackroute Release Summary

Release artifacts are cleaned with BogonForge-compatible public IP filtering before publication.

Dataset

• Configured sources: 51
• Sources remaining after cleanup: 48
• Records before cleanup: 4195589
• Single IPs before cleanup: 3803710
• CIDR prefixes before cleanup: 391879
• Records removed by cleanup: 0
• Records published: 4195589
• Single IPs published: 3803710
• CIDR prefixes published: 391879

Cleanup Policy

• Removed invalid IPs and CIDRs.
• Removed private, loopback, link-local, multicast, unspecified, CGNAT, reserved, and overly broad bogon prefixes.
• Rebuilt CSV, JSONL, MMDB, and run stats after cleanup.

Removed By Reason

No entries.

Top Sources

Name	Count
bitwire_inbound	3361107
team_cymru_fullbogons_ipv6	157263
pop3gropers	152596
blocklist_net_ua	105521
bitwire_outbound	101718
abuseipdb_s100_30d	52089
ipsum_level1	34858
ziyadnz_threat_intel_hourly_ipv4	33306
dataplane_attack_feeds	29607
threatfox_ioc_ips	23472
shadowwhisperer_scanners	22204
inversion_dnsbl_google_ipv4	19527
romainmarcoux_outgoing_40k	17907
threatview_ip_blocklist	17805
blocklist_de_mail	8581
blocklist_de_web	7959
phishing_database_ips	7109
abuseipdb_s100_7d	6809
cinsscore_badguys	5987
romainmarcoux_inbound_40k	5558

Top Threat Labels

Name	Count
recent_attack_any	3977908
community_high_risk	3906238
malware_host_active	3866961
bruteforce	301054
phishing_or_scam	192350
c2_ioc	185358
persistent_attacker	122915
spam	109509
multi_sensor_high_risk	107530
compromised_or_hostile_host	73829
network_scan_or_abuse	28454
recent_attack_web	16756
recent_attack_mail	14414
recent_attack_ssh	9081
aggregate_abuser_1d	4154
recent_attack_imap	4141
recent_badbot_or_regbot	3684
recent_attack_ftp	338
abuse	60
recent_attack_sip	41

Top Infrastructure Labels

Name	Count
bogon	160240
prefix_cybercrime	1778
hosting	895

Top Classification Labels

Name	Count
aggregate_threat_intel	3881173
mail_bruteforce	154562
pop3_bruteforce	154562
aggregate_abuseipdb_confidence_100	133282
spam_source	109509
brute_force	109449
national_cert_malicious	109449
aggregate_threat_intel_hourly	106225
aggregate_inbound_threat	40000
aggregate_outbound_threat	40000
network_scan_or_abuse	34222
internet_scanner	28454
reconnaissance	28454
c2_ioc	23814
dnsbl_malicious	19864
safe_browsing_malicious	19864
phishing_ip	7119
ultra_conservative_aggregate	4569
aggregate_blacklist_scored	3944
cloud_hosting_abuse_derived	895

Blackroute 2026.06.29

Blackroute Release Summary

Release artifacts are cleaned with BogonForge-compatible public IP filtering before publication.

Dataset

• Configured sources: 51
• Sources remaining after cleanup: 47
• Records before cleanup: 4176541
• Single IPs before cleanup: 3784667
• CIDR prefixes before cleanup: 391874
• Records removed by cleanup: 0
• Records published: 4176541
• Single IPs published: 3784667
• CIDR prefixes published: 391874

Cleanup Policy

• Removed invalid IPs and CIDRs.
• Removed private, loopback, link-local, multicast, unspecified, CGNAT, reserved, and overly broad bogon prefixes.
• Rebuilt CSV, JSONL, MMDB, and run stats after cleanup.

Removed By Reason

No entries.

Top Sources

Name	Count
bitwire_inbound	3356239
team_cymru_fullbogons_ipv6	157247
pop3gropers	152410
blocklist_net_ua	104588
bitwire_outbound	100796
abuseipdb_s100_30d	61289
ipsum_level1	42989
dataplane_attack_feeds	27719
ziyadnz_threat_intel_hourly_ipv4	25392
threatfox_ioc_ips	23827
shadowwhisperer_scanners	21966
inversion_dnsbl_google_ipv4	19570
romainmarcoux_outgoing_40k	18122
threatview_ip_blocklist	16941
blocklist_de_mail	8204
phishing_database_ips	7109
cinsscore_badguys	6970
romainmarcoux_inbound_40k	5751
ipblocklist_level3	3270
firehol_abusers_1d	3253

Top Threat Labels

Name	Count
recent_attack_any	3959086
community_high_risk	3888540
malware_host_active	3853934
bruteforce	299941
phishing_or_scam	189329
c2_ioc	182338
persistent_attacker	115600
spam	108499
multi_sensor_high_risk	96535
compromised_or_hostile_host	73047
network_scan_or_abuse	28454
recent_attack_mail	13239
recent_attack_web	8799
recent_attack_ssh	4290
recent_attack_imap	3687
aggregate_abuser_1d	3397
recent_badbot_or_regbot	3221
recent_attack_ftp	441
abuse	56
recent_attack_sip	39

Top Infrastructure Labels

Name	Count
bogon	160223
prefix_cybercrime	1791
hosting	896

Top Classification Labels

Name	Count
aggregate_threat_intel	3868083
mail_bruteforce	154541
pop3_bruteforce	154541
aggregate_abuseipdb_confidence_100	133699
spam_source	108499
brute_force	108443
national_cert_malicious	108443
aggregate_threat_intel_hourly	92959
aggregate_inbound_threat	40000
aggregate_outbound_threat	40000
network_scan_or_abuse	31810
internet_scanner	28454
reconnaissance	28454
c2_ioc	23836
dnsbl_malicious	19914
safe_browsing_malicious	19914
phishing_ip	7119
ultra_conservative_aggregate	4574
aggregate_blacklist_scored	3944
university_honeypot_attacker	1618

Blackroute 2026.06.28

Blackroute Release Summary

Release artifacts are cleaned with BogonForge-compatible public IP filtering before publication.

Dataset

• Configured sources: 51
• Sources remaining after cleanup: 47
• Records before cleanup: 4176603
• Single IPs before cleanup: 3784925
• CIDR prefixes before cleanup: 391678
• Records removed by cleanup: 0
• Records published: 4176603
• Single IPs published: 3784925
• CIDR prefixes published: 391678

Cleanup Policy

• Removed invalid IPs and CIDRs.
• Removed private, loopback, link-local, multicast, unspecified, CGNAT, reserved, and overly broad bogon prefixes.
• Rebuilt CSV, JSONL, MMDB, and run stats after cleanup.

Removed By Reason

No entries.

Top Sources

Name	Count
bitwire_inbound	3357878
team_cymru_fullbogons_ipv6	157224
pop3gropers	152215
blocklist_net_ua	104510
bitwire_outbound	99918
abuseipdb_s100_30d	54319
ipsum_level1	35372
ziyadnz_threat_intel_hourly_ipv4	33877
dataplane_attack_feeds	27908
threatfox_ioc_ips	23904
shadowwhisperer_scanners	21997
inversion_dnsbl_google_ipv4	19568
romainmarcoux_outgoing_40k	17278
threatview_ip_blocklist	17066
blocklist_de_mail	8939
phishing_database_ips	7106
cinsscore_badguys	6757
abuseipdb_s100_7d	6388
romainmarcoux_inbound_40k	5249
firehol_abusers_1d	3687

Top Threat Labels

Name	Count
recent_attack_any	3960091
community_high_risk	3889331
malware_host_active	3855218
bruteforce	299927
phishing_or_scam	190207
c2_ioc	183219
persistent_attacker	116133
spam	108672
multi_sensor_high_risk	95817
compromised_or_hostile_host	73216
network_scan_or_abuse	28454
recent_attack_mail	13215
recent_attack_web	8850
recent_attack_ssh	4349
aggregate_abuser_1d	3874
recent_attack_imap	3670
recent_badbot_or_regbot	2447
recent_attack_ftp	439
recent_attack_sip	106
abuse	56

Top Infrastructure Labels

Name	Count
bogon	160199
prefix_cybercrime	1791
hosting	896

Top Classification Labels

Name	Count
aggregate_threat_intel	3868160
mail_bruteforce	154516
pop3_bruteforce	154516
aggregate_abuseipdb_confidence_100	134120
spam_source	108672
brute_force	108616
national_cert_malicious	108616
aggregate_threat_intel_hourly	94563
aggregate_inbound_threat	40000
aggregate_outbound_threat	40000
network_scan_or_abuse	32182
internet_scanner	28454
reconnaissance	28454
c2_ioc	23913
dnsbl_malicious	19914
safe_browsing_malicious	19914
phishing_ip	7119
ultra_conservative_aggregate	4573
aggregate_blacklist_scored	3944
university_honeypot_attacker	1660

Blackroute 2026.06.27

Blackroute Release Summary

Release artifacts are cleaned with BogonForge-compatible public IP filtering before publication.

Dataset

• Configured sources: 51
• Sources remaining after cleanup: 48
• Records before cleanup: 4172679
• Single IPs before cleanup: 3781016
• CIDR prefixes before cleanup: 391663
• Records removed by cleanup: 0
• Records published: 4172679
• Single IPs published: 3781016
• CIDR prefixes published: 391663

Cleanup Policy

• Removed invalid IPs and CIDRs.
• Removed private, loopback, link-local, multicast, unspecified, CGNAT, reserved, and overly broad bogon prefixes.
• Rebuilt CSV, JSONL, MMDB, and run stats after cleanup.

Removed By Reason

No entries.

Top Sources

Name	Count
bitwire_inbound	3354646
team_cymru_fullbogons_ipv6	157198
pop3gropers	152221
blocklist_net_ua	104957
bitwire_outbound	99986
abuseipdb_s100_30d	49329
ipsum_level1	35538
ziyadnz_threat_intel_hourly_ipv4	32807
dataplane_attack_feeds	27503
threatfox_ioc_ips	23975
shadowwhisperer_scanners	21907
inversion_dnsbl_google_ipv4	19583
romainmarcoux_outgoing_40k	17431
threatview_ip_blocklist	17363
romainmarcoux_inbound_40k	11223
blocklist_de_web	8177
phishing_database_ips	7107
abuseipdb_s100_7d	6102
cinsscore_badguys	5799
firehol_abusers_1d	3692

Top Threat Labels

Name	Count
recent_attack_any	3956178
community_high_risk	3885239
malware_host_active	3851463
bruteforce	300276
phishing_or_scam	190530
c2_ioc	183540
persistent_attacker	116779
spam	109153
multi_sensor_high_risk	93916
compromised_or_hostile_host	73592
network_scan_or_abuse	28454
recent_attack_mail	13492
recent_attack_web	9205
recent_attack_ssh	4394
aggregate_abuser_1d	3924
recent_attack_imap	3898
recent_badbot_or_regbot	2508
recent_attack_ftp	372
recent_attack_sip	114
abuse	56

Top Infrastructure Labels

Name	Count
bogon	160172
prefix_cybercrime	1791
hosting	896

Top Classification Labels

Name	Count
aggregate_threat_intel	3864174
mail_bruteforce	154497
pop3_bruteforce	154497
aggregate_abuseipdb_confidence_100	134378
spam_source	109153
brute_force	109097
national_cert_malicious	109097
aggregate_threat_intel_hourly	92933
aggregate_inbound_threat	40000
aggregate_outbound_threat	40000
network_scan_or_abuse	31741
internet_scanner	28454
reconnaissance	28454
c2_ioc	23984
dnsbl_malicious	19931
safe_browsing_malicious	19931
phishing_ip	7119
ultra_conservative_aggregate	4575
aggregate_blacklist_scored	3944
university_honeypot_attacker	1632

Blackroute 2026.06.25

Blackroute Release Summary

Release artifacts are cleaned with BogonForge-compatible public IP filtering before publication.

Dataset

• Configured sources: 52
• Sources remaining after cleanup: 48
• Records before cleanup: 3524624
• Single IPs before cleanup: 3159697
• CIDR prefixes before cleanup: 364927
• Records removed by cleanup: 0
• Records published: 3524624
• Single IPs published: 3159697
• CIDR prefixes published: 364927

Cleanup Policy

• Removed invalid IPs and CIDRs.
• Removed private, loopback, link-local, multicast, unspecified, CGNAT, reserved, and overly broad bogon prefixes.
• Rebuilt CSV, JSONL, MMDB, and run stats after cleanup.

Removed By Reason

No entries.

Top Sources

Name	Count
bitwire_inbound	2710594
team_cymru_fullbogons_ipv6	157162
pop3gropers	151598
bitwire_outbound	101998
blocklist_net_ua	99732
abuseipdb_s100_30d	50715
ipsum_level1	34371
ziyadnz_threat_intel_hourly_ipv4	31419
dataplane_attack_feeds	27225
threatfox_ioc_ips	23963
shadowwhisperer_scanners	22263
inversion_dnsbl_google_ipv4	19602
threatview_ip_blocklist	18251
romainmarcoux_outgoing_40k	17469
abuseipdb_s100_7d	12943
blocklist_de_web	8270
phishing_database_ips	7106
romainmarcoux_inbound_40k	5339
cinsscore_badguys	5274
firehol_abusers_1d	3777

Top Threat Labels

Name	Count
recent_attack_any	3308595
community_high_risk	3243522
malware_host_active	3207014
bruteforce	294608
phishing_or_scam	193552
c2_ioc	186563
persistent_attacker	114990
spam	103887
multi_sensor_high_risk	91532
compromised_or_hostile_host	74411
network_scan_or_abuse	28454
recent_attack_mail	13951
recent_attack_web	8994
recent_attack_ssh	4546
recent_attack_imap	4098
aggregate_abuser_1d	4007
recent_badbot_or_regbot	2874
recent_attack_ftp	366
recent_attack_sip	61
abuse	56

Top Infrastructure Labels

Name	Count
bogon	160140
prefix_cybercrime	1786
hosting	900

Top Classification Labels

Name	Count
aggregate_threat_intel	3219156
mail_bruteforce	154450
pop3_bruteforce	154450
aggregate_abuseipdb_confidence_100	135756
spam_source	103887
brute_force	103831
national_cert_malicious	103831
aggregate_threat_intel_hourly	89826
aggregate_inbound_threat	40000
aggregate_outbound_threat	40000
network_scan_or_abuse	31969
internet_scanner	28454
reconnaissance	28454
c2_ioc	23972
dnsbl_malicious	19947
safe_browsing_malicious	19947
phishing_ip	7118
ultra_conservative_aggregate	4571
aggregate_blacklist_scored	3944
university_honeypot_attacker	1924

Blackroute 2026.06.24

Blackroute Release Summary

Release artifacts are cleaned with BogonForge-compatible public IP filtering before publication.

Dataset

• Configured sources: 52
• Sources remaining after cleanup: 47
• Records before cleanup: 4159596
• Single IPs before cleanup: 3768473
• CIDR prefixes before cleanup: 391123
• Records removed by cleanup: 0
• Records published: 4159596
• Single IPs published: 3768473
• CIDR prefixes published: 391123

Cleanup Policy

• Removed invalid IPs and CIDRs.
• Removed private, loopback, link-local, multicast, unspecified, CGNAT, reserved, and overly broad bogon prefixes.
• Rebuilt CSV, JSONL, MMDB, and run stats after cleanup.

Removed By Reason

No entries.

Top Sources

Name	Count
bitwire_inbound	3345458
team_cymru_fullbogons_ipv6	157205
pop3gropers	151797
bitwire_outbound	100497
blocklist_net_ua	99477
abuseipdb_s100_30d	43304
ipsum_level1	35649
ziyadnz_threat_intel_hourly_ipv4	34048
dataplane_attack_feeds	26607
threatfox_ioc_ips	23941
shadowwhisperer_scanners	21946
inversion_dnsbl_google_ipv4	19615
threatview_ip_blocklist	18145
romainmarcoux_outgoing_40k	17991
abuseipdb_s100_7d	14457
romainmarcoux_inbound_40k	9672
blocklist_de_web	8222
phishing_database_ips	7105
cinsscore_badguys	5999
firehol_abusers_1d	4274

Top Threat Labels

Name	Count
recent_attack_any	3942851
community_high_risk	3876238
malware_host_active	3842611
bruteforce	294095
phishing_or_scam	194072
c2_ioc	187084
persistent_attacker	117071
spam	103630
multi_sensor_high_risk	93793
compromised_or_hostile_host	74289
network_scan_or_abuse	28454
recent_attack_mail	14000
recent_attack_web	9141
recent_attack_ssh	4570
aggregate_abuser_1d	4521
recent_attack_imap	4018
recent_badbot_or_regbot	2612
recent_attack_ftp	374
recent_attack_sip	100
abuse	56

Top Infrastructure Labels

Name	Count
bogon	160153
prefix_cybercrime	1789
hosting	900

Top Classification Labels

Name	Count
aggregate_threat_intel	3854841
mail_bruteforce	154438
pop3_bruteforce	154438
aggregate_abuseipdb_confidence_100	136315
spam_source	103630
brute_force	103574
national_cert_malicious	103574
aggregate_threat_intel_hourly	92007
aggregate_inbound_threat	40000
aggregate_outbound_threat	40000
network_scan_or_abuse	31598
internet_scanner	28454
reconnaissance	28454
c2_ioc	23950
dnsbl_malicious	19960
safe_browsing_malicious	19960
phishing_ip	7118
ultra_conservative_aggregate	4542
aggregate_blacklist_scored	3944
university_honeypot_attacker	1948

Blackroute 2026.06.23

Blackroute Release Summary

Release artifacts are cleaned with BogonForge-compatible public IP filtering before publication.

Dataset

• Configured sources: 52
• Sources remaining after cleanup: 47
• Records before cleanup: 3521673
• Single IPs before cleanup: 3157355
• CIDR prefixes before cleanup: 364318
• Records removed by cleanup: 0
• Records published: 3521673
• Single IPs published: 3157355
• CIDR prefixes published: 364318

Cleanup Policy

• Removed invalid IPs and CIDRs.
• Removed private, loopback, link-local, multicast, unspecified, CGNAT, reserved, and overly broad bogon prefixes.
• Rebuilt CSV, JSONL, MMDB, and run stats after cleanup.

Removed By Reason

No entries.

Top Sources

Name	Count
bitwire_inbound	2713357
team_cymru_fullbogons_ipv6	157188
pop3gropers	152334
blocklist_net_ua	99243
bitwire_outbound	98952
abuseipdb_s100_30d	46091
ziyadnz_threat_intel_hourly_ipv4	32784
ipsum_level1	32050
dataplane_attack_feeds	27815
threatfox_ioc_ips	23966
shadowwhisperer_scanners	22532
romainmarcoux_outgoing_40k	18120
abuseipdb_s100_7d	17712
inversion_dnsbl_google_ipv4	16168
threatview_ip_blocklist	15991
blocklist_de_web	8243
phishing_database_ips	7106
cinsscore_badguys	5890
romainmarcoux_inbound_40k	5074
firehol_abusers_1d	3912

Top Threat Labels

Name	Count
recent_attack_any	3308630
community_high_risk	3244056
malware_host_active	3206293
bruteforce	293635
phishing_or_scam	189279
c2_ioc	182291
persistent_attacker	108681
spam	103420
multi_sensor_high_risk	91693
compromised_or_hostile_host	68746
network_scan_or_abuse	28454
recent_attack_mail	13373
recent_attack_web	9265
recent_attack_ssh	4657
aggregate_abuser_1d	4176
recent_attack_imap	3531
recent_badbot_or_regbot	2094
recent_attack_ftp	396
recent_attack_sip	96
abuse	56

Top Infrastructure Labels

Name	Count
bogon	160137
prefix_cybercrime	1787
hosting	732

Top Classification Labels

Name	Count
aggregate_threat_intel	3214780
mail_bruteforce	154349
pop3_bruteforce	154349
aggregate_abuseipdb_confidence_100	136564
spam_source	103420
brute_force	103364
national_cert_malicious	103364
aggregate_threat_intel_hourly	91065
aggregate_inbound_threat	40000
aggregate_outbound_threat	40000
network_scan_or_abuse	32294
internet_scanner	28454
reconnaissance	28454
c2_ioc	23975
dnsbl_malicious	16456
safe_browsing_malicious	16456
phishing_ip	7118
ultra_conservative_aggregate	4545
aggregate_blacklist_scored	3944
university_honeypot_attacker	2072

Blackroute 2026.06.22

Blackroute Release Summary

Release artifacts are cleaned with BogonForge-compatible public IP filtering before publication.

Dataset

• Configured sources: 52
• Sources remaining after cleanup: 48
• Records before cleanup: 3518858
• Single IPs before cleanup: 3155377
• CIDR prefixes before cleanup: 363481
• Records removed by cleanup: 0
• Records published: 3518858
• Single IPs published: 3155377
• CIDR prefixes published: 363481

Cleanup Policy

• Removed invalid IPs and CIDRs.
• Removed private, loopback, link-local, multicast, unspecified, CGNAT, reserved, and overly broad bogon prefixes.
• Rebuilt CSV, JSONL, MMDB, and run stats after cleanup.

Removed By Reason

No entries.

Top Sources

Name	Count
bitwire_inbound	2707138
team_cymru_fullbogons_ipv6	157144
pop3gropers	152083
bitwire_outbound	99653
blocklist_net_ua	98953
ipsum_level1	41090
abuseipdb_s100_30d	39776
ziyadnz_threat_intel_hourly_ipv4	37568
dataplane_attack_feeds	27737
threatfox_ioc_ips	24026
shadowwhisperer_scanners	22316
romainmarcoux_outgoing_40k	17710
inversion_dnsbl_google_ipv4	16156
threatview_ip_blocklist	15699
abuseipdb_s100_7d	11109
romainmarcoux_inbound_40k	8540
blocklist_de_mail	8299
phishing_database_ips	7102
cinsscore_badguys	6114
firehol_abusers_1d	3465

Top Threat Labels

Name	Count
recent_attack_any	3304653
community_high_risk	3240588
malware_host_active	3201953
bruteforce	296412
phishing_or_scam	192399
c2_ioc	185413
persistent_attacker	127513
spam	103112
multi_sensor_high_risk	101127
compromised_or_hostile_host	68504
network_scan_or_abuse	28454
recent_attack_mail	12081
recent_attack_web	9130
recent_attack_ssh	4745
aggregate_abuser_1d	3668
recent_attack_imap	2445
recent_badbot_or_regbot	2004
recent_attack_ftp	474
recent_attack_sip	70
abuse	56

Top Infrastructure Labels

Name	Count
bogon	160097
prefix_cybercrime	1787
hosting	900

Top Classification Labels

Name	Count
aggregate_threat_intel	3221483
mail_bruteforce	154270
pop3_bruteforce	154270
aggregate_abuseipdb_confidence_100	136857
spam_source	103112
brute_force	103056
national_cert_malicious	103056
aggregate_threat_intel_hourly	98606
aggregate_inbound_threat	40000
aggregate_outbound_threat	40000
network_scan_or_abuse	32078
internet_scanner	28454
reconnaissance	28454
c2_ioc	24036
dnsbl_malicious	16456
safe_browsing_malicious	16456
phishing_ip	7118
ultra_conservative_aggregate	4545
aggregate_blacklist_scored	3944
cloud_hosting_abuse_derived	900

Blackroute 2026.06.21

Blackroute Release Summary

Release artifacts are cleaned with BogonForge-compatible public IP filtering before publication.

Dataset

• Configured sources: 52
• Sources remaining after cleanup: 48
• Records before cleanup: 3511685
• Single IPs before cleanup: 3143414
• CIDR prefixes before cleanup: 368271
• Records removed by cleanup: 0
• Records published: 3511685
• Single IPs published: 3143414
• CIDR prefixes published: 368271

Cleanup Policy

• Removed invalid IPs and CIDRs.
• Removed private, loopback, link-local, multicast, unspecified, CGNAT, reserved, and overly broad bogon prefixes.
• Rebuilt CSV, JSONL, MMDB, and run stats after cleanup.

Removed By Reason

No entries.

Top Sources

Name	Count
bitwire_inbound	2696560
team_cymru_fullbogons_ipv6	157121
pop3gropers	151694
bitwire_outbound	100470
blocklist_net_ua	97926
ipsum_level1	39858
ziyadnz_threat_intel_hourly_ipv4	39020
abuseipdb_s100_30d	38080
dataplane_attack_feeds	27872
threatfox_ioc_ips	24057
shadowwhisperer_scanners	22265
inversion_dnsbl_google_ipv4	19142
romainmarcoux_outgoing_40k	17198
threatview_ip_blocklist	16453
abuseipdb_s100_7d	13514
romainmarcoux_inbound_40k	8396
blocklist_de_web	8190
phishing_database_ips	7106
cinsscore_badguys	5753
firehol_abusers_1d	3883

Top Threat Labels

Name	Count
recent_attack_any	3293879
community_high_risk	3230850
malware_host_active	3191949
bruteforce	295259
phishing_or_scam	192315
c2_ioc	185327
persistent_attacker	125804
multi_sensor_high_risk	102471
spam	102240
compromised_or_hostile_host	72292
network_scan_or_abuse	28454
recent_attack_mail	12642
recent_attack_web	8895
recent_attack_ssh	4653
aggregate_abuser_1d	4129
recent_attack_imap	3028
recent_badbot_or_regbot	2200
recent_attack_ftp	387
recent_attack_sip	93
abuse	56

Top Infrastructure Labels

Name	Count
bogon	160076
prefix_cybercrime	1798
hosting	878

Top Classification Labels

Name	Count
aggregate_threat_intel	3211245
mail_bruteforce	154257
pop3_bruteforce	154257
aggregate_abuseipdb_confidence_100	137182
spam_source	102240
brute_force	102184
national_cert_malicious	102184
aggregate_threat_intel_hourly	101391
aggregate_inbound_threat	40000
aggregate_outbound_threat	40000
network_scan_or_abuse	32279
internet_scanner	28454
reconnaissance	28454
c2_ioc	24066
dnsbl_malicious	19488
safe_browsing_malicious	19488
phishing_ip	7118
ultra_conservative_aggregate	4552
aggregate_blacklist_scored	3944
university_honeypot_attacker	1680

Blackroute 2026.06.20

Blackroute Release Summary

Release artifacts are cleaned with BogonForge-compatible public IP filtering before publication.

Dataset

• Configured sources: 52
• Sources remaining after cleanup: 49
• Records before cleanup: 3516222
• Single IPs before cleanup: 3148526
• CIDR prefixes before cleanup: 367696
• Records removed by cleanup: 0
• Records published: 3516222
• Single IPs published: 3148526
• CIDR prefixes published: 367696

Cleanup Policy

• Removed invalid IPs and CIDRs.
• Removed private, loopback, link-local, multicast, unspecified, CGNAT, reserved, and overly broad bogon prefixes.
• Rebuilt CSV, JSONL, MMDB, and run stats after cleanup.

Removed By Reason

No entries.

Top Sources

Name	Count
bitwire_inbound	2698131
team_cymru_fullbogons_ipv6	157108
pop3gropers	152300
bitwire_outbound	99245
blocklist_net_ua	97900
ipsum_level1	49903
abuseipdb_s100_30d	37528
ziyadnz_threat_intel_hourly_ipv4	31330
dataplane_attack_feeds	30873
threatfox_ioc_ips	24106
shadowwhisperer_scanners	22792
romainmarcoux_outgoing_40k	20032
inversion_dnsbl_google_ipv4	19703
abuseipdb_s100_7d	12588
romainmarcoux_inbound_40k	10501
blocklist_de_web	8336
cinsscore_badguys	7878
phishing_database_ips	7107
threatview_ip_blocklist	6629
firehol_abusers_1d	3692

Top Threat Labels

Name	Count
recent_attack_any	3289713
community_high_risk	3227439
malware_host_active	3187417
bruteforce	294751
phishing_or_scam	189775
c2_ioc	182779
persistent_attacker	124604
multi_sensor_high_risk	103485
spam	101920
compromised_or_hostile_host	63067
network_scan_or_abuse	28454
recent_attack_mail	12573
recent_attack_web	8900
recent_attack_ssh	4905
aggregate_abuser_1d	3919
recent_attack_imap	2988
recent_badbot_or_regbot	2501
recent_attack_ftp	404
recent_attack_sip	90
abuse	56

Top Infrastructure Labels

Name	Count
bogon	160059
prefix_cybercrime	1799
hosting	899

Top Classification Labels

Name	Count
aggregate_threat_intel	3212997
mail_bruteforce	154236
pop3_bruteforce	154236
aggregate_abuseipdb_confidence_100	137689
aggregate_threat_intel_hourly	102236
spam_source	101920
brute_force	101864
national_cert_malicious	101864
aggregate_inbound_threat	40000
aggregate_outbound_threat	40000
network_scan_or_abuse	32929
internet_scanner	28454
reconnaissance	28454
c2_ioc	24116
dnsbl_malicious	20052
safe_browsing_malicious	20052
phishing_ip	7118
ultra_conservative_aggregate	4549
aggregate_blacklist_scored	3944
university_honeypot_attacker	1712