A lot of teams still triage suspicious residential or SOHO traffic like it is automatically commodity background.
That can be a bad default. The UAT-7810 and LapDogs ORB reporting is a useful reminder that compromised routers and edge devices can be relay infrastructure, not just random dirty IP space. The better question is not “is this IP bad?” It is what role the infrastructure is playing near VPN, IdP, cloud admin, or edge-device activity.
AlphaHunt unpacked the operator angle here.
Where have you seen this fail first: enrichment, logging, triage, or attribution discipline?