Drop the threat before it reaches your firewall.

BlackHawk BlackHole is a BGP blackhole route server operated by BlackHawk Data as AS401573. You bring up a single eBGP session from a router you already own, and that router begins discarding traffic to command-and-control servers, malware and ransomware infrastructure, phishing hosts, botnets, scanners and entire hostile networks — in the forwarding plane, at line rate, before any of it reaches a firewall rule, an IDS or a proxy licence tier. You choose which threat categories and which countries you receive, and changes apply over the live session in seconds without a reconnect.

Different layer, different economics. Every inspection control you own examines traffic in software, and each one is priced or performance-limited by how much traffic it inspects and how many indicators it can hold — usually a few thousand. A router’s forwarding plane is the one place in the network where dropping a packet is genuinely free, and you have already paid for it. BlackHole does not inspect anything; it tells hardware you already own what to throw away. It is not a replacement for a firewall. It is the capacity already sitting idle in your routers, and it makes the firewall’s inspection budget go further by removing traffic that never needed inspecting.

That is the right question to ask, and the guardrails are built for it. An immutable safelist means RFC 1918 space, loopback, link-local, CGNAT, documentation ranges, the public resolvers and the DNS root servers can never enter the table — matched by overlap in both directions, so announcing 8.8.0.0/16 is refused exactly as firmly as 8.8.8.8/32. Nothing broader than a /8 in IPv4 or a /19 in IPv6 is accepted from any source, so a malformed feed cannot advertise a default route. Feeds that shrink by more than half, return nothing, or exceed their ceiling are rejected and the previous data retained. You also choose the next-hop, so you can start in observe mode against a collector and see exactly what would be dropped before you drop anything.

No. Inbound is rejected for every peer unconditionally, by a single global policy statement that covers a new peer the moment it connects. The route server sends routes and never accepts one. The service is architecturally incapable of accepting a route from a customer, which is a stronger statement than a per-peer filter that someone could misconfigure.

Sign in, enter your router address and ASN, generate an MD5 key, and paste the configuration the console generates for your platform. It is genuinely minutes for the route server — there is no appliance, no agent and no tunnel. The optional on-premises collector is a separate, later step.

Twelve, with a complete paste-ready configuration generated for each: Cisco IOS-XE, Cisco IOS-XR, Cisco NX-OS, Juniper Junos, Arista EOS, Fortinet FortiOS, HPE Aruba AOS-CX, Nokia SR OS, Huawei VRP, FRRouting, VyOS and MikroTik RouterOS 7. The templates behind the public samples and the console generator are shared, so a syntax correction cannot land in one and not the other.

Because GTSM (RFC 5082) requires an arriving TTL of 255, which only holds when the two BGP speakers are directly adjacent. BlackHole peers across the public internet from your loopback, so nearly every subscriber is multihop. Leaving GTSM off emits ebgp-multihop; turning it on emits ttl-security, and the console warns when the combination looks wrong. A hard-coded "ttl-security hops 1" is the single most common reason one of these sessions never leaves Active.

That is what the optional on-premises collector does, and it is the part most buyers come for. Blackholing tells you that traffic stopped; it does not tell you which machine sent it, and that is the only fact an incident actually turns on. The collector is deployed inside your own network, sits where the blackhole routes point, and turns every blocked beacon into a named internal host, a named user and the threat category that put the route there — turning "your router discarded 41,000 packets" into "WKS-4021 in Finance, used by a named employee, has been beaconing to a known C2 every ninety seconds since Tuesday." It works without deploying an agent on the endpoint, which for OT, medical devices, printers, building management and contractor hardware is the only way you will ever learn that box is compromised.

From the route server: your peering configuration and session telemetry. From the collector: the destination addresses your own routers already blackholed, plus a five-minute heartbeat carrying version, platform and two counters. No internal addresses, no hostnames, no usernames and no flow records — those exist only on your own appliance. There is an automated test in the build that fails if a field is ever added to that heartbeat. An offline mode stops all outbound calls entirely, so an air-gapped site is a day behind rather than unsupported.

Yes. The viewer role is read-only and cannot change routing, which exists precisely so access can be granted without also granting the ability to blackhole a /8. Owner, admin, member and viewer are enforced in the database, and an admin cannot promote themselves to owner or remove one.

Full parity on the same session. MP-BGP carries IPv6 threat prefixes with correct next-hops for both families, not as an afterthought.

There is a genuinely capable free tier: one router, seven threat categories including command and control, malware, ransomware, phishing, botnets and bulletproof ranges, three seats, a 250,000-prefix session limit, and emergency injections. Enterprise adds unlimited routers and seats, every category, per-country blocking and a one-million-prefix limit, and is priced per engagement. Everything that makes a session safe — TCP-MD5, GTSM, prefix limits, inbound rejection — is on every plan, because charging for those would be charging for correctness. A downgrade destroys nothing: rows survive and an upgrade restores them with nothing re-entered.