[jesterson]

Thank you for sharing it.

> GreyNoise tells you whether an IP is internet-background scanning noise.

My somewhat poorly expressed point was that to make a decision whether IP is or isn't a "internet-background scanning noise" (btw how would you define that?) you need to have access to substantial volume of data. And also how the decision is made remains unclear. If some sysadmin on legitimate node does network scan to investiage something and you catch it - will it become positive "internet-background scanning noise"?