This counts spam emails blocked because the sending IP matched Check Point's IP reputation blacklist feed. A sustained rise here, cross-referenced with the SMTP relay logs, often points to a specific compromised sender pool (e.g. a partner's outbound mail server) rather than a broad, varied campaign. For example, 400 messages might be blocked in a day from a single /24 flagged as a spam-sending botnet range.