When I did itsec work we joked that the #1 indicator of an attack from Russia was a sudden dropoff of connections from Russia. I immediately assume that traffic

When I did itsec work we joked that the #1 indicator of an attack from Russia was a sudden dropoff of connections from Russia. I immediately assume that traffic origin has been spoofed