I can't quite put my finger on it, but there's something troubling about this. How was the "sinkhole" implemented? Did they just block ssh out of some countri

I can't quite put my finger on it, but there's something troubling about this. How was the "sinkhole" implemented? Did they just block ssh out of some countries? Are they looking inside packets to tell the difference between the automated scanners and legit traffic? Does Cicso own an ISP? Who are "some other large ISPs"?