Threat Intel
GreyNoise Detects 242K New Hong Kong Scanning IPs, 99.7% Never Handshake
GreyNoise Observation Grid logged 242,666 new IPs registered in Hong Kong over a week, most never completed a TCP handshake. Only 702 actually connected, targeting services like MySQL, SSH, SMB, RDP. Defenders should verify source IPs and filter out unverified ghosts to avoid noise.
What Happened
GreyNoise Observation Grid recorded 242,666 new IP addresses that resolved to Hong Kong within a seven‑day window. The majority—99.7%—never completed a TCP handshake, meaning GreyNoise cannot confirm they are active hosts. Only 702 of those IPs actually opened connections, scanning for MySQL, SSH, SMB, and RDP across more than 20 countries.
Impact
- Unverified “ghost” IPs inflate threat feeds, potentially causing false positives in IDS/IPS and SIEM systems.
- Only a handful of real connections were observed, but they targeted common services, indicating routine reconnaissance.
- One ASN (UCLOUD) saw a 472% surge in session volume, with 38% of its IPs flagged malicious.
What to Do
- Cross‑check GreyNoise data against your own verified IP lists before ingesting it into detection engines.
- Apply a filter that discards IPs that have not completed a TCP handshake in your environment.
- Investigate the 702 connected IPs for patterns: source ASN, destination ports, and frequency.
- Update firewall and blocklist rules to exclude known ghost IP ranges, reducing noise and resource consumption.
“Ghost IPs can overwhelm security tooling; distinguishing verified from unverified sources is essential for accurate threat detection.”
Related articles
Proxyjacking Campaign Hijacks Edge Devices to Serve Residential Proxies – 143 Devices in 34 Countries
A proxyjacking operation was uncovered by GreyNoise during a live demo, affecting 143 edge devices across 34 countries. The attackers used compromised devices to route traffic through residential IPs, masking malicious activity. Defenders should audit edge device integrity, block identified malicious IPs, and monitor Entra ID sign‑in logs for anomalous residential sources.
Read briefing
AI‑Powered Attack Hits 395 PaperCut Servers Across 48 Countries
A likely Russian‑speaking threat actor leveraged hundreds of AI agents to craft, test, and launch a global campaign against PaperCut NG/MF servers, exploiting CVE‑2026‑81578 and CVE‑2026‑82078. Within hours of launching, the attackers achieved remote code execution, escalated to domain admin in minutes, and compromised 395 organizations—roughly half in education—across 48 nations. The operation used pass‑the‑hash, DCSync, and custom Rust utilities to harvest credentials and domain secrets. Immediate patching of the two CVEs is mandatory.
Read briefing
GreyNoise Launches Threat Brief Library in Visualizer for Real‑Time Threat Insights
GreyNoise has added a Threat Brief Library to its Visualizer, giving users ready access to weekly At The Edge briefs, Executive Situation Reports, and public At The Edge Clear editions. The library lets defenders search, filter, and download PDFs built from primary sensor data, enabling faster analysis and response. Security teams should explore the library, integrate IOCs into blocklists, and use the recommended actions to harden defenses.
Read briefing
SonicWall SonicOS Management Interface Scanning Spike Signals Potential Vulnerability Exposure
GreyNoise detected a record 597,000 scanning sessions against SonicWall SonicOS API interfaces on May 12, 2026, a 46× increase over normal levels. The spike mirrors patterns that preceded CVE‑2026‑0400, suggesting defenders should review SonicWall firmware, enable logging, and monitor for exploitation attempts.
Read briefing