...

Do you not prefix-list customers? That'd have solved this, eh?

The problem is: the route is coming from our upstreams / peers. that means they also did not filter it out....... :(

oh bummer ;( that's not us sending that is it? :) Honestly, prefix filtering should apply in both directions. You'd want to be sure that your upstream didn't send you 1918 prefixes, or bogons or even your internal infrastructure, eh? hopefully a simple prefix filter as in the one mentioned a few times from cymru would fix it for you :)