The Coverage Gap: Why Your Blocklist Is Missing 119,000 Malicious IPs Today
Summary: On May 14, 2026, GreyNoise's Global Observation Grid recorded 119,842 malicious, non-spoofable IPs targeting edge infrastructure, and comparing that set against eleven widely deployed OSINT and commercial IP feeds found average coverage of 2.0%, with no single feed closing more than five percent of the gap. GreyNoise attributes the shortfall to static curation against infrastructure that rotates by the tens of thousands while curated feeds turn over dozens of IPs per day, citing automated reconnaissance, compromised consumer devices and rented residential IP pools, and short-lived VPS instances.
Key Takeaway: If 98% of the malicious activity hitting your edge on a given day is invisible to your current feeds, the blocklist you trust is answering a question about yesterday's attackers - and the vendor-curated EDLs shipping by default in many enterprise firewalls came in under half a percent.
Read the original at GreyNoise Blog ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026