It helps but there are projects like censys.io and shadowserver ebay can use instead of a direct scan.

Bad guys do use compromised seevers and devices,often it's bind() shell (like a webshell) that can easily be detected. I think it helps when they use compromised hosts as proxies to avoid IP restrictions.