Blackhole observatory networks, not prefixes
When an operator tags a prefix with the standard BLACKHOLE community, they take it off the internet on purpose. This page counts those networks, every day.
Your connection originates in .
Examples
What the numbers measure
The observatory counts networks that originated
0:666 or 65535:666. Generic :666
matches are discarded — they inflate the count by two orders of magnitude.
Per-AS Posture and Exposure remain a seven-day index of
structure and response. Lookup any AS from the search box.
Posture 0—100
Structural · slow-moving
- Resilience 55
- Distinct adjacent networks in the observed AS paths. Path diversity is the dominant structural factor. 58% of covered networks have exactly one adjacency.
- Stability 25
- Update churn per prefix per day, penalised for a withdrawal-heavy stream.
- Hygiene 20
- Share of /25-and-longer announcements, excluding blackhole-tagged ones.
Grades: A ≥ 85 · B ≥ 70 · C ≥ 50 · D below. A quiet single-homed network tops out at 45.
Exposure 0—100
Behavioural · weekly
- RFC 7999 blackhole
- Standard BLACKHOLE communities (
0:666,65535:666), counted by prefix and by day. - Churn spike
- Latest day against the network's own 13-day baseline (median/MAD).
- Deaggregation
- More-specific announcements — traffic being steered.
- Withdrawal pressure
- An unusually withdrawal-heavy stream.
| Signal | Coverage median | In the score because |
|---|---|---|
| Adjacency degree | 1 | No second path means blackholing is the only available tool. |
| Churn / prefix / day | 49.4 | Raw event counts punish large transits; per-prefix does not. |
| Withdrawal share | 0.2% | Sustained withdrawals indicate instability, not a clean re-route. |
| More-specific share | 0% | Deaggregation is both a hygiene cost and a mitigation signature. |
Breakpoints from 1,780 active networks (TR, BG, GE, IQ, SY) on 31 Aug 2026, frozen for v1.0.
Limitations
- Construct. BGP carries routing intent, not traffic. LENS measures the observable response — blackholes, deaggregation, withdrawals, churn — never Gbps or attack counts.
- Networks, not prefixes. Prefix counts concentrate in a few originators. The headline is always the number of distinct ASNs.
- Precision over recall. Only RFC 7999 blackhole communities are counted. Generic
:666matches are discarded. - Country is the AS registry, not a prefix location. Observation is Europe-weighted; a large share in one country can be practice, coverage, or both.
- Retention gap. A break in the daily series is a raw-table retention boundary, not a quiet internet. No trend is drawn across it.
- No named ranking. Country pages name no operator. A live named feed would be a scoreboard.
- Updates, not a RIB. Silence means nothing changed, not unreachable. No claim about uptime or outages.
- Partial observation. Adjacency is a lower bound on real peering. A network with more neighbours than we see scores conservatively.
- Not a certification. An index of observable routing behaviour. Not an audit of hosts, filtering, or contracts.
A briefing on a specific AS
The observatory is the global count. A briefing covers one network’s historical window, the live stream, and a mitigation path for that topology.
Built by the team behind YAM DDoS. The observatory is free; the measurements are the ones we use ourselves.