ya'll should read what asmap is for and how bitcoin uses it.

"While Core’s netgroup bucketing prevents too many peers from connecting from a single netgroup, a single AS entity can control many IP address ranges"

if a single entity controls lots of knots nodes then your node will potentially connect to those ips without knowing. This is the eclipse attack.

asmap just adds more information so that core can try to avoid connecting to ips controlled by the same ASN (like a bunch of cloud nodes).

If before I was connecting to mostly knots nodes and then I turn asmap on and they disappear, this implies people are running a knots sybil attack. it's not technically a proof but it is anecdotal evidence.

some people running larger node statistics are seeing a drastic drop in connected knots node counts with asmap on. I am seeing the same.