Unexplained ‘Noise Storms’ flood the Internet, puzzle experts

GreyNoise has observed recurring large waves of spoofed internet traffic called “Noise Storms” that originate from millions of spoofed IPs, concentrate on certain ISPs (e.g., Cogent, Lumen, Hurricane Electric), target TCP (notably port 443) and ICMP (recently containing an embedded "LOVE" ASCII string), and use packet attributes (TTL, window sizes) to mimic real hosts; GreyNoise released PCAPs and requests community assistance to determine whether this is covert comms, DDoS coordination, clandestine C2 activity, or a misconfiguration.