What Are Bogon IP Addresses?

A bogon IP address is any IP address that has not been assigned to an entity by IANA (Internet Assigned Numbers Authority) or a Regional Internet Registry, or that has been reserved for special use by internet standards. These addresses should never appear as source or destination IPs in traffic crossing the public internet.

The term "bogon" comes from "bogus." It was coined in network engineering circles to describe IP space that has no legitimate reason to show up in routed traffic. If your firewall logs show packets from 192.0.2.45 or 240.0.0.1, something is wrong, because those addresses are not supposed to exist outside of documentation examples and reserved blocks.

Bogon addresses fall into two categories.

1. The first is permanently reserved space: private ranges like 10.0.0.0/8, loopback addresses like 127.0.0.0/8, and other blocks set aside by RFCs for specific functions.
2. The second is unallocated space: address blocks that IANA has not yet assigned to any RIR. This second category shrinks over time as new allocations happen, which is why bogon lists need regular updates.

TL;DR

• Bogon IP addresses are IPs not assigned by IANA/RIRs or reserved for special use (private networks, loopback, documentation, multicast)
• They should never appear in public internet traffic; their presence usually signals misconfiguration or spoofing
• Two types exist: permanently reserved (stable, defined by RFCs) and unallocated (shrinks as IANA assigns new blocks)
• Bogon filtering at router, firewall, and application layers is a baseline security practice
• IPv4 bogon space is now minimal due to exhaustion; IPv6 still has large unallocated ranges
• IP geolocation APIs like ipgeolocation.io reject bogon IPs since they have no real-world location data

For the full IPv4 and IPv6 bogon range tables, security implications, and filtering implementation details, keep reading.

Bogons vs. Martian Packets

These two terms get mixed up constantly, so it is worth being precise.

Martian packets are a specific subset of bogons. They carry source or destination addresses from ranges that are permanently reserved by RFC standards: private addresses (RFC 1918), loopback, link-local, documentation, and multicast ranges. The list of Martian ranges does not change unless an RFC is updated, which happens rarely.

Bogon addresses include all Martians plus any address space that is currently unallocated by IANA. In 2011, IANA distributed the last available IPv4 /8 blocks to the five RIRs, which means the "unallocated IPv4" portion of the bogon list is now nearly empty. For IPv6, the picture is different: roughly 85% of the IPv6 address space remains unallocated, making the IPv6 bogon list substantially larger.

The practical takeaway: Martian lists are static and easy to maintain. Full bogon lists require periodic updates to reflect new allocations.

Complete Bogon IP Address Ranges

The tables below list all bogon ranges as of April 2026. IPv4 bogon space consists almost entirely of reserved/special-use blocks, since nearly all allocatable IPv4 space has been distributed. IPv6 bogon space is larger because most of the address space remains unassigned.

Why Bogon Traffic Is a Security Problem

Bogon source addresses in your logs are never innocent. Legitimate traffic does not originate from unallocated or reserved address space. When you see it, the explanation is either a network misconfiguration or deliberate spoofing, and the latter is far more common on public-facing infrastructure.

Attackers use bogon source addresses for a few specific reasons. Spoofed source IPs make it difficult to trace the origin of an attack, since the return path leads nowhere. DDoS amplification attacks frequently use bogon sources: the attacker sends requests to open resolvers with a spoofed source address, and the amplified responses flood the target. According to CAIDA's Spoofer Project, roughly 30% of autonomous systems still allow spoofed traffic to leave their networks, which means bogon-sourced packets remain a real problem in 2026.

Network scanning is another common use. Probing from bogon space lets an attacker map your open ports and services without exposing a traceable IP. If your intrusion detection system does not flag bogon sources, these scans blend into background noise.

On internal networks, bogon traffic in unexpected places often indicates a misconfigured device, a rogue DHCP server handing out private addresses on the wrong segment, or a VPN tunnel leaking internal routes. These are not security attacks, but they are still problems worth catching early.

How to Filter Bogon Traffic

Bogon filtering is considered a baseline security practice by organizations like MANRS (Mutually Agreed Norms for Routing Security) and is recommended in BCP 38 (RFC 2827). Filtering can happen at multiple layers, and most production networks implement it at more than one.

---

3. Application-Layer Bogon Detection

For developers building applications that process IP addresses, handling bogons at the application layer adds a useful validation step. If your application queries an IP geolocation API with a bogon address, no meaningful location data exists for that IP.

The ipgeolocation.io IP Geolocation API handles this explicitly. When a bogon IP is submitted, the API returns:

HTTP 423 Locked
{
    "message": "'0.0.0.0' is a bogon IP address."
}

Bogon, private, and malformed IPs are not counted against your API quota, so validation checks do not consume credits. This makes it practical to use the API as a validation layer: submit the IP, check for a 423 response, and flag or discard the request before further processing.

This matters in real applications. If you are running ad verification, fraud scoring, or access control based on geolocation data, a bogon source IP is a strong signal that the request is either spoofed or coming from a misconfigured client. Catching it early saves processing time and prevents bad data from entering your pipeline.

Keeping Your Bogon Lists Current

Static bogon lists go stale. While the Martian/reserved ranges rarely change, the unallocated portion of the bogon list shifts every time IANA or an RIR makes a new assignment. For IPv4, this happens infrequently now that the free pool is exhausted. For IPv6, new allocations are still regular.

Recommended sources for up-to-date bogon data:

• IANA IPv4 Address Space Registry: The authoritative source for which /8 blocks are allocated, reserved, or available.
• Team Cymru Bogon Reference: Provides downloadable bogon prefix lists updated regularly. Supports BGP feed integration for automated updates.
• RIR delegation files: ARIN, RIPE, APNIC, LACNIC, and AFRINIC each publish daily delegation statistics showing which blocks they have assigned.

For production firewall and router filters, pulling updates at least daily is the recommended minimum. Some organizations subscribe to Team Cymru's BGP bogon feed, which pushes updates automatically as allocations change. This is the most reliable approach for networks where stale bogon filters could block newly legitimate traffic.

Next Steps

If you are seeing bogon addresses in your traffic logs, start by implementing ingress filtering at your network edge. For application developers working with IP data, use your geolocation API's bogon detection to catch and discard these addresses before they reach your processing pipeline. The IP Security database from ipgeolocation.io can provide additional threat intelligence beyond bogon detection, including proxy, VPN, and Tor identification for IPs that are technically valid but still suspicious.