Selfhosted

My servers that have been around for a while get thousands of scans per day. In fact I am going to move away from crowdsec because I exceed the free limits on log entries within the first day of the month usually, sometimes just an hour or so. I mean it still works and blocks stuff, but the web portal is basically useless for any research into what I need to give attention to. That and the fact that you can no longer delete decisions on the web portal with the free account.

It wasn't a script kiddy. It wasn't even a human. You are going to be a very busy individual if you decide to report every port scan you find.

I think a lot of peope understandably misunderstand this post because it doesn't really explain the situation. After reading OP's comments I gather that OP put a new server online (not on AWS) and was immediately port scanned by a host that is on AWS. Since OP did not consent to being port scanned, they filled out an abuse complaint with AWS, the hoster the scan came from, out of principle, knowing that it probably won't do much. Which is totally fine if that is how you want to spend your time.

I think what most commenters thought is that OP was hosting with AWS and complained to them that someone else scanned their server. This does not seem to be the case.

You contacted Amazon over a port scan?

Uh sorry dude, but no this isn't a script kiddy, these are bots that scan every IP address every day for any open ports, it's a constant thing. If you have a public IP, you have people, govs, nefarious groups scanning it. AWS will tell you the same as if you were hosting it locally, close up the ports, put it on a private network. Use a vpc and WAF in AWS' case.

I get scanned constantly. Every hour of every day dark forced attempt to penetrate our defences.

I have 750 bots stuck in HTTP tarpits right now, and another 13 stuck in an SSH tarpit.

You can fight back! If we all fight back just a little bit, then mass-scanning and scraping becomes too expensive to do.

If I showed you my WAN-side firewall logs you'd have a panic attack. I have a /29 block and about 10 scans tap one IP or another every second. It's part of being on the internet.

Your domestic home router experiences the exact same thing. Every moment of every day.

Will you report every scan? Every Chinese IP? Every US IP? It's completely common place to have someone 'knock on the door'.

Get off IPv4 anyway and onto IPv6. Good luck to them finding you by chance in there.

Switch to IPv6 only and the port scans will go away. The address space is so big that port scanning is difficult, so the usual bots don't bother.

Trying to learn here, are these SSH login attempts on the root user? If not, is it just the firewall logs?

Haha, I get one of those every other day.

Remember to also report ssh login attempts and unauthorized wordpress access (even if wordpress isn't installed).

I am reminded of a Richard Pryor skit in which he tells about a football player he knew who bit the fingers off of an opponent who was trying to gouge his eyes through his helmet. When Pryor asked him why he bit the guy's fingers off he said 'Everything outside the mask is his. Everything inside the mask is mine.'