diff --git a/CHANGELOG b/CHANGELOG
index 50f681539..9429786d0 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,5 +1,9 @@
 #Nmap Changelog ($Id$); -*-text-*-
 
+o New XML output "hosthint" tag emitted during host discovery when a target is
+  found to be up. This gives earlier notification than waiting for the
+  hostgroup to finish all scan phases. [Paul Miseiko]
+
 o [GH#917] New UDP payloads for GPRS Tunneling Protocol (GTP) on ports 2123,
   2152, and 3386. [Guillaume Teissier]
 
diff --git a/docs/nmap.dtd b/docs/nmap.dtd
index d4bcf05c6..dac561c85 100644
--- a/docs/nmap.dtd
+++ b/docs/nmap.dtd
@@ -150,6 +150,9 @@
 			comment		CDATA		#IMPLIED
 >
 
+<!-- these elements are written by scan_engine.c:ultrascan_host_pspec_update() -->
+<!ELEMENT hosthint (status,address,hostnames)* >
+
 <!-- these elements are written by output.c:write_xml_initial_hostinfo() -->
 <!ELEMENT status	EMPTY >
 <!ATTLIST status	state		%host_states;	#REQUIRED 
diff --git a/output.cc b/output.cc
index 00bff1994..a6f0fdbcc 100644
--- a/output.cc
+++ b/output.cc
@@ -1389,6 +1389,14 @@ static void write_xml_initial_hostinfo(Target *currenths,
   log_flush_all();
 }
 
+void write_xml_hosthint(Target *currenths) {
+  xml_start_tag("hosthint");
+  write_xml_initial_hostinfo(currenths, (currenths->flags & HOST_UP) ? "up" : "down");
+  xml_end_tag();
+  xml_newline();
+  log_flush_all();
+}
+
 static void write_xml_osclass(const OS_Classification *osclass, double accuracy) {
   xml_open_start_tag("osclass");
   xml_attribute("type", "%s", osclass->Device_Type);
diff --git a/output.h b/output.h
index 24a76bc03..12d71c1a2 100644
--- a/output.h
+++ b/output.h
@@ -264,6 +264,9 @@ void write_host_header(Target *currenths);
    machine log. */
 void write_host_status(Target *currenths);
 
+/* Writes host status info to the XML stream wrapped in a <hosthint> tag */
+void write_xml_hosthint(Target *currenths);
+
 /* Prints the formatted OS Scan output to stdout, logfiles, etc (but only
    if an OS Scan was performed */
 void printosscanoutput(Target *currenths);
diff --git a/scan_engine.cc b/scan_engine.cc
index 2eee48d18..40210ab60 100644
--- a/scan_engine.cc
+++ b/scan_engine.cc
@@ -148,6 +148,7 @@
 #include "targets.h"
 #include "utils.h"
 #include "nmap_error.h"
+#include "output.h"
 
 #include "struct_ip.h"
 
@@ -2036,6 +2037,13 @@ static bool ultrascan_host_pspec_update(UltraScanInfo *USI, HostScanStats *hss,
   if (hss->target->flags != HOST_UP) {
     assert(newstate == HOST_UP || newstate == HOST_DOWN);
     hss->target->flags = newstate;
+    /* For port scans (not -sn) where output may be delayed until more scan
+     * phases are done, emit a hosthint element during host discovery when a
+     * target is found to be up. */
+    if (oldstate != newstate && newstate == HOST_UP &&
+        !o.noportscan && USI->ping_scan) {
+      write_xml_hosthint(hss->target);
+    }
   }
   return hss->target->flags != oldstate;
 }