Ghost scanning traffic: what defenders should act on now

TL;DR: 242,666 new scanning IPs geolocating to Hong Kong were observed in seven days, according to GreyNoise, but 99.7% never completed a TCP handshake, meaning the addresses could not be verified as real sources and likely polluted detection datasets with ghost infrastructure. The problem is not volume alone, but unverified source trust, which makes IP-centric scoring noisy and operationally brittle.

Editorial analysis by NHI Mgmt Group, based on content published by GreyNoise: “Ghost Fleet: Half of All New Scanning IPs Last Week Geolocated to Hong Kong — Nearly None Completed a Connection”.

By the numbers:

• 99.7% of those IPs never completed a single TCP connection.
• Only 702 IPs geolocating to Hong Kong actually completed TCP handshakes.
• UCLOUD surged 472% in session volume to become the top ASN by session volume in GreyNoise data.

Key questions

Q: How should security teams handle unverified scanning IPs in detection pipelines?

A: Treat unverified source IPs as lower-confidence telemetry until they complete a handshake or otherwise prove origin.

Q: Why do spoofable IPs create problems for threat intelligence and blocklists?

A: Spoofable IPs can look real enough to inflate counts, but they never prove the source actually existed as observed.

Q: What are the signs that scanning telemetry is being distorted by ghost infrastructure?

A: Look for very high IP counts with minimal handshake completion, weak or absent payload evidence, and a large gap between observed source volume and verified sessions.

Practitioner guidance

• Verify source legitimacy before enriching IP data Require handshake completion or equivalent proof of origin before IPs enter scoring, correlation, or attribution workflows.
• Separate confirmed scanners from spoofable noise Tag unverified source addresses distinctly so analysts can exclude them from reputation baselines and watchlist generation.
• Recalibrate blocklists around behaviour, not count Weight protocol mix, session completion, and repeat scanning evidence more heavily than raw IP volume or geolocation labels.

Bottom line: The central risk is not the appearance of scanning volume, but the contamination of detection datasets by source addresses that never proved themselves through a TCP handshake.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →