After I read your question I thought other people would wonder the same thing and I already had some ideas about greynoise. I'm going to go ahead and add this to the site for other people. Thanks. https://tunnelmind.ai/compare
> GreyNoise tells you whether an IP is internet-background scanning noise.
My somewhat poorly expressed point was that to make a decision whether IP is or isn't a "internet-background scanning noise" (btw how would you define that?) you need to have access to substantial volume of data. And also how the decision is made remains unclear. If some sysadmin on legitimate node does network scan to investiage something and you catch it - will it become positive "internet-background scanning noise"?