On Sun, Mar 12, 2017 at 5:59 PM, Baldur Norddahl <baldur.norddahl at gmail.com> wrote: > They could watch the routing table and notice which ASN is actually using > the address space. In fact ASN reputation might work better than IP space > reputation. > +1 And not only the originating ASN, but to a lesser extend, adjacent ASNs too