I doubt port forwarding had anything to do with this. These IPs are on blacklists because they are used by robots and scammers to make requests, not because they are used to host malware.