Legality of Network companies scanning TCP ports - how has my consent been obtained?

Question

In my firewall and IIS logs I constantly see entries for servers from companies like ZenLayer, Dedipath, DigitalOcean and other Network-related businesses that appear to ping/scan my systems to establish the presence of content, whether certain ports are open, and so on.

I have never asked for such services, nor am I interested in them being offered, and I certainly have no desire to be included on some list of any kind (whether "good" or "bad"). I have port 3389 (RDP) and 1433 (SQL) open but not used for their actual purpose, and a scan of either two will auto-ban the IP in question to all traffic. Some of these businesses use a whole /24 IP range to do the scanning, as I have noticed in the slowly accumulating list of IPs over the course of about 12 months now.

What right do these companies have to actually do such a scan? Just exactly how are they allowed to use that information (presumably they don't scan for the hell of it, so unless they like wasting resources on useless nonsense, something has to occur with those results. Consequently, they are a data processor as far as I can see. Seeing as an IP address is personally identifiable information how is this actually alright?

How is whatever ends up happening with those scan outcomes not a violation of the GDPR (I am in Europe) and if it's not, what recourse do I have?

The servers I am running are not hosting anything particularly known, definitely nothing controversial or even remotely suspect, them having been "reported" by some other third party to be scanned is extremely improbable. The scans being done are either for specific ports, or specific files (like the Word Press manifest, the latter also by a server belonging to Oracle, or so IP2Location tells me)

Any advice is greatly welcome. I imagine these pretend do-gooder pests eat their unfair share of network traffic for no cause, reason or purpose I am aware of or, given the way they go about it, will ever approve.

Answer 1

This can maybe be argued to be a GDPR compliance issue, but that misses the point. These scans do not come from do-gooders. These scans typically come from criminals looking for vulnerable services, for example to add systems to their botnets. And as criminals, they are not really concerned with being criminal in a GDPR-compliant way.

The companies you listed are hosting providers, i.e. they offer cloud or VPS services. Criminals use such services to run their crawlers, jumping to another provider when they are detected. This also helps them with avoiding IP-based blocklists. You could report such malicious actions to the hosting provider, and they all have forms where you can report such behaviour. E.g. Digital Ocean's report page explicitly lets you report kinds of abuse such as port scans.

In practice, it is not feasible to report every instance. Getting port-scans is an unfortunate part of having a routeable IP on the internet. Instead of legal solutions, technical solutions such as fail2ban or complex event processing based firewalls are much more useful.