The source is in the article, actually. This is the order from FSB that MTS operator received. They translated this as: “the mass distribution of obviously false reports of a terrorist act” in January, resulting in “mass evacuations of schools, administrative buildings and shopping centers.”

Right before the IP addresses list, you can find terms "blackhole", "BGP".

The document has a signature of a head of the FSB center that handles this types of requests and orders. Also, you can see a stamp in the right bottom corner on the first page.

Full story, how a Russian internet company has actually found out about blackholing can be found here (in Russian): https://habr.com/ru/company/tm/blog/443222/ In the story, you can find that MTS confirmed that they are blocking traffic and referenced the order in the original article.

If the CIA said “we got bomb threats from Tor so we need to block it,” I wouldn’t believe it. This source appears to have a similar level of corroboration. It looks far more likely that ProtonMail is being blocked to perpetuate the Russian elites’ control of Russia’s polity and economy. Not for security reasons.

The sad truth that it isn't. The most of the services they blocked were chosen for some insignificant reasons. This is what happens when you have a ruined system where every district judge can order to ban Youtube.

Not the OP or the source you're looking for but an interesting article related to bomb threats in Russia: https://jamestown.org/program/telephone-bomb-threats-forcing...