Ghost Fleet: Half of All New Scanning IPs Last Week Geolocated to Hong Kong — Nearly None Completed a Connection

Summary: GreyNoise observed 242,666 new scanning IPs geolocating to Hong Kong between March 12 and 18, nearly half of all new scanning IPs it saw that week, and 99.7% never completed a single TCP connection. Of those, 241,964 are labeled spoofable, with GNET INC. (AS9294) alone contributing 28.9% of all new IPs, while UCLOUD (AS135377) added just 1,746 IPs but saw session volume rise from 9.7 million to 55.4 million and has 663 IPs classified malicious.
Why it matters: Any detection system that doesn't separate verified from unverified source addresses just absorbed a quarter-million ghost IPs, while the 702 Hong Kong IPs that actually completed connections and scanned MySQL, SSH, SMB, and RDP across sensors in 20+ countries can get lost in that noise.

Read the original at GreyNoise Blog ↗