In my firewall and IIS logs I constantly see entries for servers from companies like ZenLayer, Dedipath, DigitalOcean and other Network-related businesses that appear to ping/scan my systems to establish the presence of content, whether certain ports are open, and so on.
I have never asked for such services, nor am I interested in them being offered, and I certainly have no desire to be included on some list of any kind (whether "good" or "bad"). I have port 3389 (RDP) and 1433 (SQL) open but not used for their actual purpose, and a scan of either two will auto-ban the IP in question to all traffic. Some of these businesses use a whole /24 IP range to do the scanning, as I have noticed in the slowly accumulating list of IPs over the course of about 12 months now.
What right do these companies have to actually do such a scan? Just exactly how are they allowed to use that information (presumably they don't scan for the hell of it, so unless they like wasting resources on useless nonsense, something has to occur with those results. Consequently, they are a data processor as far as I can see. Seeing as an IP address is personally identifiable information how is this actually alright?
How is whatever ends up happening with those scan outcomes not a violation of the GDPR (I am in Europe) and if it's not, what recourse do I have?
The servers I am running are not hosting anything particularly known, definitely nothing controversial or even remotely suspect, them having been "reported" by some other third party to be scanned is extremely improbable. The scans being done are either for specific ports, or specific files (like the Word Press manifest, the latter also by a server belonging to Oracle, or so IP2Location tells me)
Any advice is greatly welcome. I imagine these pretend do-gooder pests eat their unfair share of network traffic for no cause, reason or purpose I am aware of or, given the way they go about it, will ever approve.