/
← Voltar ao feed
medium

GreyNoise: 242,666 Unverified Hong Kong Scanning IPs Surge in a Week While UCLOUD (AS135377) Drives Real Multi-Protocol Scanning

1 fonte(s) · 1 atualização(ões) · publicado 24/03/2026 21:00 · coletado há 3 dias

Between March 12 and 18, 2026, the GreyNoise Observation Grid (GOG) recorded 242,666 new scanning IPs geolocating to Hong Kong, 48.9% of all new scanning IPs seen that week. 99.7% never completed a TCP handshake, so GreyNoise classes them as "spoofable" (unverified source addresses). They carried no payloads and triggered no signatures. GNET INC. (AS9294) alone contributed 143,340 IPs, none classified malicious. The real signal is UCLOUD (AS135377): only 1,746 IPs, but session volume rose 472% (9.7M to 55.4M), making it the top ASN by session volume, with about 38% of its IPs classified malicious and scanning of MySQL, SSH, SMB and RDP across sensors in 20+ countries. GreyNoise does not attribute the activity to any named actor or state, and notes that geolocation reflects IP registration, not operator location.

Detalhes técnicos

  • Only 702 Hong Kong-geolocated IPs completed TCP handshakes; 362 of them are classified malicious. UCLOUD accounts for 663 malicious IPs.
  • Six hosting providers account for 93.3% of the new Hong Kong IPs. 241,964 of the 242,666 IPs are spoofable and classified "unknown", mostly categorized as hosting (92.3%).
  • Targeted services: MySQL (3306), SSH (22), SMB (445), RDP (3389).
  • The scanning landscape rotated within a week: AS213438 (10.7M sessions the prior week) disappeared entirely, traffic from Australia-geolocated IPs fell 72%, and new infrastructure geolocating to Poland and Germany appeared.
  • Cross-referencing with Censys and VirusTotal showed templated deployments: a Germany-geolocated cluster registered to a Seychelles entity consistent with a single VM image, and a Windows VPS cluster across Bulgaria, Romania and France over three ASNs with identical service configurations.
  • Censys shows traffic relay and tunneling software on UCLOUD at a density atypical of legitimate hosting, with repeating non-standard ports across subnets. The top scanning IPs have low reputation detection.
  • GreyNoise cannot determine the purpose of the ghost fleet from its own data.

Remediação

  • Review detection stacks that weight activity by IP count without distinguishing spoofable from confirmed (handshake-completing) sources.
  • Update blocklists, as the dominant scanning sources changed within seven days.
  • Monitor UCLOUD (AS135377) for scanning of ports 3306, 22, 445 and 3389.
  • Track the ghost fleet ASNs (AS9294, AS138415, AS55933, AS135097, AS17561, AS45753) for behavioral change; if they begin completing handshakes and delivering payloads, the assessment changes.

Linha do tempo

  1. greynoise.io ↗ · pub. 24/03/2026 21:00 · coletado 19/10 18:37 primeiro registro

    GreyNoise: 242,666 Unverified Hong Kong Scanning IPs Surge in a Week While UCLOUD (AS135377) Drives Real Multi-Protocol Scanning

    ler a análise desta fonte

    Between March 12 and 18, 2026, the GreyNoise Observation Grid (GOG) recorded 242,666 new scanning IPs geolocating to Hong Kong, 48.9% of all new scanning IPs seen that week. 99.7% never completed a TCP handshake, so GreyNoise classes them as "spoofable" (unverified source addresses). They carried no payloads and triggered no signatures. GNET INC. (AS9294) alone contributed 143,340 IPs, none classified malicious. The real signal is UCLOUD (AS135377): only 1,746 IPs, but session volume rose 472% (9.7M to 55.4M), making it the top ASN by session volume, with about 38% of its IPs classified malicious and scanning of MySQL, SSH, SMB and RDP across sensors in 20+ countries. GreyNoise does not attribute the activity to any named actor or state, and notes that geolocation reflects IP registration, not operator location.

    Technical Details

    • Only 702 Hong Kong-geolocated IPs completed TCP handshakes; 362 of them are classified malicious. UCLOUD accounts for 663 malicious IPs.
    • Six hosting providers account for 93.3% of the new Hong Kong IPs. 241,964 of the 242,666 IPs are spoofable and classified "unknown", mostly categorized as hosting (92.3%).
    • Targeted services: MySQL (3306), SSH (22), SMB (445), RDP (3389).
    • The scanning landscape rotated within a week: AS213438 (10.7M sessions the prior week) disappeared entirely, traffic from Australia-geolocated IPs fell 72%, and new infrastructure geolocating to Poland and Germany appeared.
    • Cross-referencing with Censys and VirusTotal showed templated deployments: a Germany-geolocated cluster registered to a Seychelles entity consistent with a single VM image, and a Windows VPS cluster across Bulgaria, Romania and France over three ASNs with identical service configurations.
    • Censys shows traffic relay and tunneling software on UCLOUD at a density atypical of legitimate hosting, with repeating non-standard ports across subnets. The top scanning IPs have low reputation detection.
    • GreyNoise cannot determine the purpose of the ghost fleet from its own data.

    Remediation

    • Review detection stacks that weight activity by IP count without distinguishing spoofable from confirmed (handshake-completing) sources.
    • Update blocklists, as the dominant scanning sources changed within seven days.
    • Monitor UCLOUD (AS135377) for scanning of ports 3306, 22, 445 and 3389.
    • Track the ghost fleet ASNs (AS9294, AS138415, AS55933, AS135097, AS17561, AS45753) for behavioral change; if they begin completing handshakes and delivering payloads, the assessment changes.