As I understand it, greynoise is monitoring scanner traffic, so yes this would all be scans or attacks