1

In my firewall and IIS logs I constantly see entries for servers from companies like ZenLayer, Dedipath, DigitalOcean and other Network-related businesses that appear to ping/scan my systems to establish the presence of content, whether certain ports are open, and so on.

I have never asked for such services, nor am I interested in them being offered, and I certainly have no desire to be included on some list of any kind (whether "good" or "bad"). I have port 3389 (RDP) and 1433 (SQL) open but not used for their actual purpose, and a scan of either two will auto-ban the IP in question to all traffic. Some of these businesses use a whole /24 IP range to do the scanning, as I have noticed in the slowly accumulating list of IPs over the course of about 12 months now.

What right do these companies have to actually do such a scan? Just exactly how are they allowed to use that information (presumably they don't scan for the hell of it, so unless they like wasting resources on useless nonsense, something has to occur with those results. Consequently, they are a data processor as far as I can see. Seeing as an IP address is personally identifiable information how is this actually alright?

How is whatever ends up happening with those scan outcomes not a violation of the GDPR (I am in Europe) and if it's not, what recourse do I have?

The servers I am running are not hosting anything particularly known, definitely nothing controversial or even remotely suspect, them having been "reported" by some other third party to be scanned is extremely improbable. The scans being done are either for specific ports, or specific files (like the Word Press manifest, the latter also by a server belonging to Oracle, or so IP2Location tells me)

Any advice is greatly welcome. I imagine these pretend do-gooder pests eat their unfair share of network traffic for no cause, reason or purpose I am aware of or, given the way they go about it, will ever approve.

2

This can maybe be argued to be a GDPR compliance issue, but that misses the point. These scans do not come from do-gooders. These scans typically come from criminals looking for vulnerable services, for example to add systems to their botnets. And as criminals, they are not really concerned with being criminal in a GDPR-compliant way.

The companies you listed are hosting providers, i.e. they offer cloud or VPS services. Criminals use such services to run their crawlers, jumping to another provider when they are detected. This also helps them with avoiding IP-based blocklists. You could report such malicious actions to the hosting provider, and they all have forms where you can report such behaviour. E.g. Digital Ocean's report page explicitly lets you report kinds of abuse such as port scans.

In practice, it is not feasible to report every instance. Getting port-scans is an unfortunate part of having a routeable IP on the internet. Instead of legal solutions, technical solutions such as fail2ban or complex event processing based firewalls are much more useful.

1
  • Hello. Digital Ocean is indeed a hosting provider, and in that case your answer applies. However the other two companies I mention are businesses that offer some kind of Network Protection system; another example is censys.io - definitely not a hosting provider. I imagine they are running some sort of pro-active scan bot that compiles a list of "vulnerable" hosts. While I can see the utility and market value of such a list, that is none of my concern, and they have no right to include my IPs on such a list without my explicit consent and awareness. Dec 15 '20 at 12:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.