Dude there is a weird disconnect going on in the comments. Yes bots are thing, yes services are abused, yes not everyone plays nice on the Internet, yes you can’t control what traffic comes in. I know I’m going to be seeing more this and yes I’m obviously not going to be responding to every one of them.

It was my brand new server’s first and I felt like celebrating the event by filling out the AWS abuse form. It was literally copy and paste.

Also, I’m not fussed about what ever services they are running. I didn’t ask for it or want it. I told them as much and I going to leave it at that.

No one got schooled. There is nothing wrong with telling someone who shows up at your business to please don’t come back. Y’all need to chill.

Well this whole thing was fun but I’m going to get on with my day

Amen

For SSH it will have to be attempted connections. Ain’t no way I’m putting a forward facing SSH. I’ll deal with any downtime that comes from not being able to access my server remotely

The sad reality of the Internet. Being the first for this new server feels like a “Welcome to the Internet, glad you are here” kind of message

That’s what automation is for

And abuse forms get filled out

Not on AWS and yes I know I can’t stop port scanning and bad traffic is a thing. Doesn’t stop me from filling out the form. I think to piss off you and the other commenters, I’ll write a script to auto fill out AWS abuse forms. Also script kiddy or bot, all the same to me, their hosting provider is getting a message from me

Not on AWS

I don’t have any open ports. I do not care if I did. Port scanning is not authorized traffic.

I would love to see the support request from AWS for this.

Here you go:

Mandiant ASM scanners perform a variety of security-related data-gathering tasks, all intended to positively identify assets and their security posture. The gathered information is analyzed by our research team and proactively published to the owners of this information through our freemium product. No Collection task performed requires authorized access. It is intentionally designed to be light. While your IDS or WAF may have alerted on these scans, these are benign flags and are not indicative of malicious behavior.

If you have further questions, or would like to opt-out, please reply to this message and you will be routed to the appropriate team.

Yes. Don’t port scan my shit.