 While identifying a suitable zombie takes some initial work, you can keep re-using the good ones.Alternatively, there have been some research on utilizing unintended public web services as zombie hosts to perform similar idle scans.Leveraging the way some of these services perform outbound connections upon user submissions can serve as some kind of poor's man idle scanning.