In this article Vasileios Giotsas summarises the results of a detailed study of how transferred IPv4 prefixes are misused in the wild by synthesising an array of longitudinal IP blacklists, honeypot data, and AS reputation lists:

https://labs.ripe.net/Members/vgiotsas/a-first-look-at-the-misuse-and-abuse-...

an interesting read, and looks to be a solid analysis. as a researcher, i like it a lot. as an operator, i am not sure what the heck we can do about it. randy