“We also limit how often we run scans to ensure we don’t risk disrupting the normal operation of systems.”
GCHQ’s cyber arm now scans every internet-facing system hosted in the UK. It comes from two published IP addresses and tags its requests with an X-NCSC-Scan header. You can opt out by email. The criminals have done this for decades without asking. The difference is that a spy agency now keeps a running list of every vulnerable box in the country.