Blackroute 2026.07.08

Blackroute Release Summary

Release artifacts are cleaned with BogonForge-compatible public IP filtering before publication.

Dataset

• Configured sources: 51
• Sources remaining after cleanup: 49
• Records before cleanup: 4323926
• Single IPs before cleanup: 3928478
• CIDR prefixes before cleanup: 395448
• Records removed by cleanup: 0
• Records published: 4323926
• Single IPs published: 3928478
• CIDR prefixes published: 395448

Cleanup Policy

• Removed invalid IPs and CIDRs.
• Removed private, loopback, link-local, multicast, unspecified, CGNAT, reserved, and overly broad bogon prefixes.
• Rebuilt CSV, JSONL, MMDB, and run stats after cleanup.

Removed By Reason

No entries.

Top Sources

Name	Count
bitwire_inbound	3487306
team_cymru_fullbogons_ipv6	157336
pop3gropers	152392
blocklist_net_ua	116909
bitwire_outbound	100879
abuseipdb_s100_30d	47178
ziyadnz_threat_intel_hourly_ipv4	35308
dataplane_attack_feeds	29116
ipsum_level1	28866
threatfox_ioc_ips	22651
shadowwhisperer_scanners	22144
threatview_ip_blocklist	22115
inversion_dnsbl_google_ipv4	19423
romainmarcoux_outgoing_40k	18767
romainmarcoux_inbound_40k	11430
blocklist_de_mail	8132
phishing_database_ips	7109
abuseipdb_s100_7d	6881
cinsscore_badguys	6541
firehol_abusers_1d	4007

Top Threat Labels

Name	Count
recent_attack_any	4107456
community_high_risk	4028207
malware_host_active	3995832
bruteforce	314308
phishing_or_scam	196798
c2_ioc	189800
spam	121159
persistent_attacker	115273
multi_sensor_high_risk	104749
compromised_or_hostile_host	77145
network_scan_or_abuse	28454
recent_attack_mail	13248
recent_attack_web	9530
recent_badbot_or_regbot	7807
recent_attack_ssh	5171
aggregate_abuser_1d	4193
recent_attack_imap	3610
recent_attack_ftp	1020
recent_attack_sip	98
abuse	60

Top Infrastructure Labels

Name	Count
bogon	160312
prefix_cybercrime	1774
hosting	890

Top Classification Labels

Name	Count
aggregate_threat_intel	4004318
mail_bruteforce	155178
pop3_bruteforce	155178
aggregate_abuseipdb_confidence_100	128626
spam_source	121159
brute_force	121099
national_cert_malicious	121099
aggregate_threat_intel_hourly	101580
aggregate_inbound_threat	40000
aggregate_outbound_threat	40000
network_scan_or_abuse	33864
internet_scanner	28454
reconnaissance	28454
c2_ioc	23000
dnsbl_malicious	19754
safe_browsing_malicious	19754
phishing_ip	7120
ultra_conservative_aggregate	4565
aggregate_blacklist_scored	3944
university_honeypot_attacker	1655

Blackroute 2026.07.07

Blackroute Release Summary

Release artifacts are cleaned with BogonForge-compatible public IP filtering before publication.

Dataset

• Configured sources: 51
• Sources remaining after cleanup: 48
• Records before cleanup: 4319050
• Single IPs before cleanup: 3923594
• CIDR prefixes before cleanup: 395456
• Records removed by cleanup: 0
• Records published: 4319050
• Single IPs published: 3923594
• CIDR prefixes published: 395456

Cleanup Policy

• Removed invalid IPs and CIDRs.
• Removed private, loopback, link-local, multicast, unspecified, CGNAT, reserved, and overly broad bogon prefixes.
• Rebuilt CSV, JSONL, MMDB, and run stats after cleanup.

Removed By Reason

No entries.

Top Sources

Name	Count
bitwire_inbound	3480376
team_cymru_fullbogons_ipv6	157335
pop3gropers	152484
blocklist_net_ua	118639
bitwire_outbound	99415
abuseipdb_s100_30d	51195
ziyadnz_threat_intel_hourly_ipv4	37959
ipsum_level1	32091
dataplane_attack_feeds	30137
threatfox_ioc_ips	22690
shadowwhisperer_scanners	22344
threatview_ip_blocklist	21585
inversion_dnsbl_google_ipv4	19428
romainmarcoux_outgoing_40k	18382
blocklist_de_web	8292
phishing_database_ips	7109
romainmarcoux_inbound_40k	6241
cinsscore_badguys	5549
abuseipdb_s100_7d	5414
firehol_abusers_1d	3960

Top Threat Labels

Name	Count
recent_attack_any	4101468
community_high_risk	4022534
malware_host_active	3989365
bruteforce	315969
phishing_or_scam	193462
c2_ioc	186462
spam	122991
persistent_attacker	118700
multi_sensor_high_risk	106781
compromised_or_hostile_host	76718
network_scan_or_abuse	28454
recent_attack_mail	13528
recent_attack_web	9304
recent_badbot_or_regbot	6473
recent_attack_ssh	4717
aggregate_abuser_1d	4129
recent_attack_imap	3913
recent_attack_ftp	845
recent_attack_sip	143
abuse	60

Top Infrastructure Labels

Name	Count
bogon	160318
prefix_cybercrime	1773
hosting	891

Top Classification Labels

Name	Count
aggregate_threat_intel	4000639
mail_bruteforce	155170
pop3_bruteforce	155170
aggregate_abuseipdb_confidence_100	129506
spam_source	122991
brute_force	122931
national_cert_malicious	122931
aggregate_threat_intel_hourly	105326
aggregate_inbound_threat	40000
aggregate_outbound_threat	40000
network_scan_or_abuse	34477
internet_scanner	28454
reconnaissance	28454
c2_ioc	23033
dnsbl_malicious	19763
safe_browsing_malicious	19763
phishing_ip	7120
ultra_conservative_aggregate	4572
aggregate_blacklist_scored	3944
cloud_hosting_abuse_derived	891

Blackroute 2026.07.06

Blackroute Release Summary

Release artifacts are cleaned with BogonForge-compatible public IP filtering before publication.

Dataset

• Configured sources: 51
• Sources remaining after cleanup: 49
• Records before cleanup: 4295886
• Single IPs before cleanup: 3901498
• CIDR prefixes before cleanup: 394388
• Records removed by cleanup: 0
• Records published: 4295886
• Single IPs published: 3901498
• CIDR prefixes published: 394388

Cleanup Policy

• Removed invalid IPs and CIDRs.
• Removed private, loopback, link-local, multicast, unspecified, CGNAT, reserved, and overly broad bogon prefixes.
• Rebuilt CSV, JSONL, MMDB, and run stats after cleanup.

Removed By Reason

No entries.

Top Sources

Name	Count
bitwire_inbound	3458854
team_cymru_fullbogons_ipv6	157331
pop3gropers	152229
blocklist_net_ua	106979
bitwire_outbound	101295
ziyadnz_threat_intel_hourly_ipv4	45955
abuseipdb_s100_30d	45896
dataplane_attack_feeds	32228
ipsum_level1	31251
threatfox_ioc_ips	23135
shadowwhisperer_scanners	22295
threatview_ip_blocklist	20585
inversion_dnsbl_google_ipv4	19465
romainmarcoux_outgoing_40k	18168
romainmarcoux_inbound_40k	10115
blocklist_de_web	8223
abuseipdb_s100_7d	7471
phishing_database_ips	7109
cinsscore_badguys	6365
ipblocklist_level3	3281

Top Threat Labels

Name	Count
recent_attack_any	4077923
community_high_risk	4004770
malware_host_active	3971838
bruteforce	304218
phishing_or_scam	196641
c2_ioc	189654
persistent_attacker	116863
multi_sensor_high_risk	113616
spam	111307
compromised_or_hostile_host	75880
network_scan_or_abuse	28454
recent_attack_mail	14060
recent_attack_web	8924
recent_attack_ssh	4588
recent_attack_imap	4538
recent_badbot_or_regbot	4245
aggregate_abuser_1d	3268
recent_attack_ftp	534
recent_attack_sip	105
abuse	60

Top Infrastructure Labels

Name	Count
bogon	160316
prefix_cybercrime	1774
hosting	891

Top Classification Labels

Name	Count
aggregate_threat_intel	3981332
mail_bruteforce	155152
pop3_bruteforce	155152
aggregate_abuseipdb_confidence_100	130702
spam_source	111307
brute_force	111247
national_cert_malicious	111247
aggregate_threat_intel_hourly	110827
aggregate_inbound_threat	40000
aggregate_outbound_threat	40000
network_scan_or_abuse	36185
internet_scanner	28454
reconnaissance	28454
c2_ioc	23147
dnsbl_malicious	19800
safe_browsing_malicious	19800
phishing_ip	7120
ultra_conservative_aggregate	4573
aggregate_blacklist_scored	3944
university_honeypot_attacker	1702

Blackroute 2026.07.05

Blackroute Release Summary

Release artifacts are cleaned with BogonForge-compatible public IP filtering before publication.

Dataset

• Configured sources: 51
• Sources remaining after cleanup: 49
• Records before cleanup: 4236699
• Single IPs before cleanup: 3843276
• CIDR prefixes before cleanup: 393423
• Records removed by cleanup: 0
• Records published: 4236699
• Single IPs published: 3843276
• CIDR prefixes published: 393423

Cleanup Policy

• Removed invalid IPs and CIDRs.
• Removed private, loopback, link-local, multicast, unspecified, CGNAT, reserved, and overly broad bogon prefixes.
• Rebuilt CSV, JSONL, MMDB, and run stats after cleanup.

Removed By Reason

No entries.

Top Sources

Name	Count
bitwire_inbound	3400245
team_cymru_fullbogons_ipv6	157328
pop3gropers	152074
blocklist_net_ua	106134
bitwire_outbound	101991
abuseipdb_s100_30d	49695
ziyadnz_threat_intel_hourly_ipv4	45881
ipsum_level1	31565
dataplane_attack_feeds	31525
threatfox_ioc_ips	23001
shadowwhisperer_scanners	22505
threatview_ip_blocklist	21271
inversion_dnsbl_google_ipv4	19484
romainmarcoux_outgoing_40k	17769
abuseipdb_s100_7d	8371
blocklist_de_mail	8258
phishing_database_ips	7108
romainmarcoux_inbound_40k	6111
cinsscore_badguys	5622
firehol_abusers_1d	3340

Top Threat Labels

Name	Count
recent_attack_any	4018587
community_high_risk	3946399
malware_host_active	3913092
bruteforce	303229
phishing_or_scam	197317
c2_ioc	190327
persistent_attacker	118460
multi_sensor_high_risk	112107
spam	110505
compromised_or_hostile_host	76760
network_scan_or_abuse	28454
recent_attack_mail	13657
recent_attack_web	8995
recent_attack_ssh	4587
recent_badbot_or_regbot	4227
recent_attack_imap	4199
aggregate_abuser_1d	3582
recent_attack_ftp	417
recent_attack_sip	103
abuse	60

Top Infrastructure Labels

Name	Count
bogon	160312
prefix_cybercrime	1774
hosting	890

Top Classification Labels

Name	Count
aggregate_threat_intel	3923725
mail_bruteforce	155106
pop3_bruteforce	155106
aggregate_abuseipdb_confidence_100	131183
spam_source	110505
brute_force	110445
national_cert_malicious	110445
aggregate_threat_intel_hourly	110038
aggregate_inbound_threat	40000
aggregate_outbound_threat	40000
network_scan_or_abuse	35589
internet_scanner	28454
reconnaissance	28454
c2_ioc	23343
dnsbl_malicious	19815
safe_browsing_malicious	19815
phishing_ip	7119
ultra_conservative_aggregate	4571
aggregate_blacklist_scored	3944
university_honeypot_attacker	1701

Blackroute 2026.07.04

Blackroute Release Summary

Release artifacts are cleaned with BogonForge-compatible public IP filtering before publication.

Dataset

• Configured sources: 51
• Sources remaining after cleanup: 48
• Records before cleanup: 4233704
• Single IPs before cleanup: 3839913
• CIDR prefixes before cleanup: 393791
• Records removed by cleanup: 0
• Records published: 4233704
• Single IPs published: 3839913
• CIDR prefixes published: 393791

Cleanup Policy

• Removed invalid IPs and CIDRs.
• Removed private, loopback, link-local, multicast, unspecified, CGNAT, reserved, and overly broad bogon prefixes.
• Rebuilt CSV, JSONL, MMDB, and run stats after cleanup.

Removed By Reason

No entries.

Top Sources

Name	Count
bitwire_inbound	3396278
team_cymru_fullbogons_ipv6	157324
pop3gropers	152663
blocklist_net_ua	106708
bitwire_outbound	101310
abuseipdb_s100_30d	45753
ziyadnz_threat_intel_hourly_ipv4	45057
dataplane_attack_feeds	31372
ipsum_level1	30880
threatfox_ioc_ips	23096
shadowwhisperer_scanners	22264
threatview_ip_blocklist	20135
inversion_dnsbl_google_ipv4	19491
romainmarcoux_outgoing_40k	18253
romainmarcoux_inbound_40k	10251
abuseipdb_s100_7d	9989
blocklist_de_web	8319
phishing_database_ips	7108
cinsscore_badguys	6021
firehol_abusers_1d	3826

Top Threat Labels

Name	Count
recent_attack_any	4015202
community_high_risk	3942875
malware_host_active	3909156
bruteforce	303255
phishing_or_scam	196540
c2_ioc	189549
persistent_attacker	115771
multi_sensor_high_risk	111178
spam	111070
compromised_or_hostile_host	75719
network_scan_or_abuse	28454
recent_attack_mail	13354
recent_attack_web	9313
recent_badbot_or_regbot	5527
recent_attack_ssh	4627
aggregate_abuser_1d	4073
recent_attack_imap	3854
recent_attack_ftp	423
recent_attack_sip	141
abuse	60

Top Infrastructure Labels

Name	Count
bogon	160302
prefix_cybercrime	1774
hosting	890

Top Classification Labels

Name	Count
aggregate_threat_intel	3918144
mail_bruteforce	154730
pop3_bruteforce	154730
aggregate_abuseipdb_confidence_100	131652
spam_source	111070
brute_force	111010
national_cert_malicious	111010
aggregate_threat_intel_hourly	108293
aggregate_inbound_threat	40000
aggregate_outbound_threat	40000
network_scan_or_abuse	35626
internet_scanner	28454
reconnaissance	28454
c2_ioc	23440
dnsbl_malicious	19826
safe_browsing_malicious	19826
phishing_ip	7119
ultra_conservative_aggregate	4568
aggregate_blacklist_scored	3944
cloud_hosting_abuse_derived	890

Blackroute 2026.07.03

Blackroute Release Summary

Release artifacts are cleaned with BogonForge-compatible public IP filtering before publication.

Dataset

• Configured sources: 51
• Sources remaining after cleanup: 46
• Records before cleanup: 4227418
• Single IPs before cleanup: 3834165
• CIDR prefixes before cleanup: 393253
• Records removed by cleanup: 0
• Records published: 4227418
• Single IPs published: 3834165
• CIDR prefixes published: 393253

Cleanup Policy

• Removed invalid IPs and CIDRs.
• Removed private, loopback, link-local, multicast, unspecified, CGNAT, reserved, and overly broad bogon prefixes.
• Rebuilt CSV, JSONL, MMDB, and run stats after cleanup.

Removed By Reason

No entries.

Top Sources

Name	Count
bitwire_inbound	3393069
team_cymru_fullbogons_ipv6	157299
pop3gropers	152714
blocklist_net_ua	106181
bitwire_outbound	99544
abuseipdb_s100_30d	46277
ziyadnz_threat_intel_hourly_ipv4	44243
ipsum_level1	32200
dataplane_attack_feeds	31394
threatfox_ioc_ips	23457
shadowwhisperer_scanners	22299
inversion_dnsbl_google_ipv4	19491
threatview_ip_blocklist	18800
romainmarcoux_outgoing_40k	18357
romainmarcoux_inbound_40k	10358
abuseipdb_s100_7d	8867
blocklist_de_web	8440
phishing_database_ips	7109
cinsscore_badguys	6154
firehol_abusers_1d	3685

Top Threat Labels

Name	Count
recent_attack_any	4008891
community_high_risk	3936952
malware_host_active	3902875
bruteforce	302422
phishing_or_scam	193640
c2_ioc	186651
persistent_attacker	116860
spam	110439
multi_sensor_high_risk	109699
compromised_or_hostile_host	74401
network_scan_or_abuse	28454
recent_attack_mail	12684
recent_attack_web	9566
recent_badbot_or_regbot	5205
recent_attack_ssh	4646
aggregate_abuser_1d	3891
recent_attack_imap	3172
recent_attack_ftp	464
recent_attack_sip	132
abuse	60

Top Infrastructure Labels

Name	Count
bogon	160278
prefix_cybercrime	1775
hosting	889

Top Classification Labels

Name	Count
aggregate_threat_intel	3913600
mail_bruteforce	154675
pop3_bruteforce	154675
aggregate_abuseipdb_confidence_100	132230
spam_source	110439
brute_force	110379
national_cert_malicious	110379
aggregate_threat_intel_hourly	107425
aggregate_inbound_threat	40000
aggregate_outbound_threat	40000
network_scan_or_abuse	35443
internet_scanner	28454
reconnaissance	28454
c2_ioc	23468
dnsbl_malicious	19833
safe_browsing_malicious	19833
phishing_ip	7119
ultra_conservative_aggregate	4567
aggregate_blacklist_scored	3944
cloud_hosting_abuse_derived	889

Blackroute 2026.07.02

Blackroute Release Summary

Release artifacts are cleaned with BogonForge-compatible public IP filtering before publication.

Dataset

• Configured sources: 51
• Sources remaining after cleanup: 47
• Records before cleanup: 4224629
• Single IPs before cleanup: 3831449
• CIDR prefixes before cleanup: 393180
• Records removed by cleanup: 0
• Records published: 4224629
• Single IPs published: 3831449
• CIDR prefixes published: 393180

Cleanup Policy

• Removed invalid IPs and CIDRs.
• Removed private, loopback, link-local, multicast, unspecified, CGNAT, reserved, and overly broad bogon prefixes.
• Rebuilt CSV, JSONL, MMDB, and run stats after cleanup.

Removed By Reason

No entries.

Top Sources

Name	Count
bitwire_inbound	3391675
team_cymru_fullbogons_ipv6	157267
pop3gropers	151841
blocklist_net_ua	105804
bitwire_outbound	101019
abuseipdb_s100_30d	46418
ipsum_level1	34744
ziyadnz_threat_intel_hourly_ipv4	34114
threatview_ip_blocklist	30810
dataplane_attack_feeds	30050
threatfox_ioc_ips	23505
shadowwhisperer_scanners	22257
inversion_dnsbl_google_ipv4	19499
romainmarcoux_outgoing_40k	17003
romainmarcoux_inbound_40k	10473
blocklist_de_mail	8292
phishing_database_ips	7109
abuseipdb_s100_7d	6174
cinsscore_badguys	6140
firehol_abusers_1d	3632

Top Threat Labels

Name	Count
recent_attack_any	4006773
community_high_risk	3934614
malware_host_active	3901045
bruteforce	302346
phishing_or_scam	203505
c2_ioc	196516
persistent_attacker	128327
spam	110558
multi_sensor_high_risk	108226
compromised_or_hostile_host	86334
network_scan_or_abuse	28454
recent_attack_mail	14074
recent_attack_web	9511
recent_attack_ssh	5600
recent_attack_imap	4555
aggregate_abuser_1d	3820
recent_badbot_or_regbot	3653
recent_attack_ftp	469
abuse	60
recent_attack_sip	47

Top Infrastructure Labels

Name	Count
bogon	160242
prefix_cybercrime	1776
hosting	892

Top Classification Labels

Name	Count
aggregate_threat_intel	3914162
mail_bruteforce	154631
pop3_bruteforce	154631
aggregate_abuseipdb_confidence_100	132767
spam_source	110558
brute_force	110498
national_cert_malicious	110498
aggregate_threat_intel_hourly	107595
aggregate_inbound_threat	40000
aggregate_outbound_threat	40000
network_scan_or_abuse	34994
internet_scanner	28454
reconnaissance	28454
c2_ioc	23516
dnsbl_malicious	19839
safe_browsing_malicious	19839
phishing_ip	7119
ultra_conservative_aggregate	4566
aggregate_blacklist_scored	3944
cloud_hosting_abuse_derived	892

Blackroute 2026.07.01

Blackroute Release Summary

Release artifacts are cleaned with BogonForge-compatible public IP filtering before publication.

Dataset

• Configured sources: 51
• Sources remaining after cleanup: 47
• Records before cleanup: 4201011
• Single IPs before cleanup: 3808611
• CIDR prefixes before cleanup: 392400
• Records removed by cleanup: 0
• Records published: 4201011
• Single IPs published: 3808611
• CIDR prefixes published: 392400

Cleanup Policy

• Removed invalid IPs and CIDRs.
• Removed private, loopback, link-local, multicast, unspecified, CGNAT, reserved, and overly broad bogon prefixes.
• Rebuilt CSV, JSONL, MMDB, and run stats after cleanup.

Removed By Reason

No entries.

Top Sources

Name	Count
bitwire_inbound	3364615
team_cymru_fullbogons_ipv6	157267
pop3gropers	152186
blocklist_net_ua	105384
bitwire_outbound	103047
abuseipdb_s100_30d	52216
ipsum_level1	34545
ziyadnz_threat_intel_hourly_ipv4	34400
threatview_ip_blocklist	30188
dataplane_attack_feeds	29131
threatfox_ioc_ips	23549
shadowwhisperer_scanners	22148
inversion_dnsbl_google_ipv4	19502
romainmarcoux_outgoing_40k	17003
blocklist_de_mail	8315
abuseipdb_s100_7d	7614
phishing_database_ips	7109
cinsscore_badguys	6551
romainmarcoux_inbound_40k	5717
firehol_abusers_1d	4047

Top Threat Labels

Name	Count
recent_attack_any	3982801
community_high_risk	3911382
malware_host_active	3876573
bruteforce	301782
phishing_or_scam	204208
c2_ioc	197217
persistent_attacker	129922
spam	110105
multi_sensor_high_risk	108055
compromised_or_hostile_host	85789
network_scan_or_abuse	28454
recent_attack_web	17065
recent_attack_mail	14481
recent_attack_ssh	9191
recent_attack_imap	4902
aggregate_abuser_1d	4285
recent_badbot_or_regbot	3406
recent_attack_ftp	480
abuse	60
recent_attack_sip	50

Top Infrastructure Labels

Name	Count
bogon	160241
prefix_cybercrime	1778
hosting	894

Top Classification Labels

Name	Count
aggregate_threat_intel	3890010
mail_bruteforce	154606
pop3_bruteforce	154606
aggregate_abuseipdb_confidence_100	133524
spam_source	110105
brute_force	110045
national_cert_malicious	110045
aggregate_threat_intel_hourly	106672
aggregate_inbound_threat	40000
aggregate_outbound_threat	40000
network_scan_or_abuse	34610
internet_scanner	28454
reconnaissance	28454
c2_ioc	23560
dnsbl_malicious	19842
safe_browsing_malicious	19842
phishing_ip	7119
ultra_conservative_aggregate	4567
aggregate_blacklist_scored	3944
cloud_hosting_abuse_derived	894

Blackroute 2026.06.30

Blackroute Release Summary

Release artifacts are cleaned with BogonForge-compatible public IP filtering before publication.

Dataset

• Configured sources: 51
• Sources remaining after cleanup: 48
• Records before cleanup: 4195589
• Single IPs before cleanup: 3803710
• CIDR prefixes before cleanup: 391879
• Records removed by cleanup: 0
• Records published: 4195589
• Single IPs published: 3803710
• CIDR prefixes published: 391879

Cleanup Policy

• Removed invalid IPs and CIDRs.
• Removed private, loopback, link-local, multicast, unspecified, CGNAT, reserved, and overly broad bogon prefixes.
• Rebuilt CSV, JSONL, MMDB, and run stats after cleanup.

Removed By Reason

No entries.

Top Sources

Name	Count
bitwire_inbound	3361107
team_cymru_fullbogons_ipv6	157263
pop3gropers	152596
blocklist_net_ua	105521
bitwire_outbound	101718
abuseipdb_s100_30d	52089
ipsum_level1	34858
ziyadnz_threat_intel_hourly_ipv4	33306
dataplane_attack_feeds	29607
threatfox_ioc_ips	23472
shadowwhisperer_scanners	22204
inversion_dnsbl_google_ipv4	19527
romainmarcoux_outgoing_40k	17907
threatview_ip_blocklist	17805
blocklist_de_mail	8581
blocklist_de_web	7959
phishing_database_ips	7109
abuseipdb_s100_7d	6809
cinsscore_badguys	5987
romainmarcoux_inbound_40k	5558

Top Threat Labels

Name	Count
recent_attack_any	3977908
community_high_risk	3906238
malware_host_active	3866961
bruteforce	301054
phishing_or_scam	192350
c2_ioc	185358
persistent_attacker	122915
spam	109509
multi_sensor_high_risk	107530
compromised_or_hostile_host	73829
network_scan_or_abuse	28454
recent_attack_web	16756
recent_attack_mail	14414
recent_attack_ssh	9081
aggregate_abuser_1d	4154
recent_attack_imap	4141
recent_badbot_or_regbot	3684
recent_attack_ftp	338
abuse	60
recent_attack_sip	41

Top Infrastructure Labels

Name	Count
bogon	160240
prefix_cybercrime	1778
hosting	895

Top Classification Labels

Name	Count
aggregate_threat_intel	3881173
mail_bruteforce	154562
pop3_bruteforce	154562
aggregate_abuseipdb_confidence_100	133282
spam_source	109509
brute_force	109449
national_cert_malicious	109449
aggregate_threat_intel_hourly	106225
aggregate_inbound_threat	40000
aggregate_outbound_threat	40000
network_scan_or_abuse	34222
internet_scanner	28454
reconnaissance	28454
c2_ioc	23814
dnsbl_malicious	19864
safe_browsing_malicious	19864
phishing_ip	7119
ultra_conservative_aggregate	4569
aggregate_blacklist_scored	3944
cloud_hosting_abuse_derived	895

Blackroute 2026.06.29

Blackroute Release Summary

Release artifacts are cleaned with BogonForge-compatible public IP filtering before publication.

Dataset

• Configured sources: 51
• Sources remaining after cleanup: 47
• Records before cleanup: 4176541
• Single IPs before cleanup: 3784667
• CIDR prefixes before cleanup: 391874
• Records removed by cleanup: 0
• Records published: 4176541
• Single IPs published: 3784667
• CIDR prefixes published: 391874

Cleanup Policy

• Removed invalid IPs and CIDRs.
• Removed private, loopback, link-local, multicast, unspecified, CGNAT, reserved, and overly broad bogon prefixes.
• Rebuilt CSV, JSONL, MMDB, and run stats after cleanup.

Removed By Reason

No entries.

Top Sources

Name	Count
bitwire_inbound	3356239
team_cymru_fullbogons_ipv6	157247
pop3gropers	152410
blocklist_net_ua	104588
bitwire_outbound	100796
abuseipdb_s100_30d	61289
ipsum_level1	42989
dataplane_attack_feeds	27719
ziyadnz_threat_intel_hourly_ipv4	25392
threatfox_ioc_ips	23827
shadowwhisperer_scanners	21966
inversion_dnsbl_google_ipv4	19570
romainmarcoux_outgoing_40k	18122
threatview_ip_blocklist	16941
blocklist_de_mail	8204
phishing_database_ips	7109
cinsscore_badguys	6970
romainmarcoux_inbound_40k	5751
ipblocklist_level3	3270
firehol_abusers_1d	3253

Top Threat Labels

Name	Count
recent_attack_any	3959086
community_high_risk	3888540
malware_host_active	3853934
bruteforce	299941
phishing_or_scam	189329
c2_ioc	182338
persistent_attacker	115600
spam	108499
multi_sensor_high_risk	96535
compromised_or_hostile_host	73047
network_scan_or_abuse	28454
recent_attack_mail	13239
recent_attack_web	8799
recent_attack_ssh	4290
recent_attack_imap	3687
aggregate_abuser_1d	3397
recent_badbot_or_regbot	3221
recent_attack_ftp	441
abuse	56
recent_attack_sip	39

Top Infrastructure Labels

Name	Count
bogon	160223
prefix_cybercrime	1791
hosting	896

Top Classification Labels

Name	Count
aggregate_threat_intel	3868083
mail_bruteforce	154541
pop3_bruteforce	154541
aggregate_abuseipdb_confidence_100	133699
spam_source	108499
brute_force	108443
national_cert_malicious	108443
aggregate_threat_intel_hourly	92959
aggregate_inbound_threat	40000
aggregate_outbound_threat	40000
network_scan_or_abuse	31810
internet_scanner	28454
reconnaissance	28454
c2_ioc	23836
dnsbl_malicious	19914
safe_browsing_malicious	19914
phishing_ip	7119
ultra_conservative_aggregate	4574
aggregate_blacklist_scored	3944
university_honeypot_attacker	1618