This will trip up most SOC workflows in funny ways, and I like it.

IPs having a global distinction between public/private is a convention, but local routing can widely differ.

Same with the "China Cyberattacks" - the guys sitting on top of my outgoing fiber can simulate any IP address they want to me.