Does netcup allow port scanning?

jerome87

Hello,

I work as a penetration tester / bug bounty hunter and my line of work inevitably involves performing some (light) port scanning for customers or companies who have a bug bounty program. I am currently renting a server at Hetz-ner but they apparently do not permit any form of port scanning, and recently temporarily disabled my root server (despite me providing feedback on the scanning activity) so I am looking for a new hosting provider.

Just to make this abundantly clear, I am not talking about

- scanning the whole internet

- brute forcing ssh credentials

- running scans 24/7

The only thing I found in the T&C is the following:

Zitat

In using the services as provided by netcup, the customer undertakes to maintain compliance with the applicable provisions of the law and to refrain from activities that could result in service disruptions affecting servers operated by netcup. The following activities are expressly prohibited:

Bulk mailing

Actions intended to store and provide access to material of a pornographic or commercially erotic character and any material protected by copyright for whose dissemination the user is not authorised (e.g. hosting of warez sites, illegal MP3 downloads, etc.).

Operation of mining-services such as "Bitcoin", "Ethereum", "OneCoin" or "Monero".

Actions intended to store and provide access to files and material concerning left-or right-wing radicalism, with offensive content, or encouraging terrorism or acts of violence

Running server services that cause a particularly high CPU load; this does not apply in the case of dedicated server and virtual servers.

However, in the FAQ section on Abuse Notices (https://helpcenter.netcup.com/en/wiki/general/abuse-notices/) I found:

Zitat

Upon receiving an abuse notification, the cause is often due to incorrect configurations, non-updated systems, compromised login credentials, or attacks. These reports can come from affected parties, regulatory authorities, or our IDS systems.

Our team reviews each case and will get in touch with you. In case of acute danger, there may be a temporary suspension of your netcup products. This is for your protection.

As an infrastructure provider, netcup must comply with legal regulations. In the event of a violation, it is your responsibility to ensure that it does not happen again.

Please reply to any abuse notifications you receive immediately using the provided field.

Does anyone have experience running some (professionally motivated) scans on their netcup server?

Thanks,

Jerome

webdesignheld

I would get a dedicated server and tell Netcup in the process what you need it for and if they have any guidelines for you regarding your usecase to stay on the safe side.

MichaelOF

... INCOMING port scans from OUTSIDE Netcup are "allowed"

(Sarcasm off): IMHO any server owner sees

"- brute forcing ssh credentials

- running scans 24/7"

In my case summarized in my daily logwatch email.

So as this technically possible, not covered by any DDoS or whatever provider side protections, why shouldn't it be possible that you rent your own server and port scan it from outside as long as you want?? As both parties are/is "YOU", it IMHO couldn't even be a legal issue... I can burgle into my home as long as I want

Olivetti

Zitat von MichaelOF

As both parties are/is "YOU", it IMHO couldn't even be a legal issue... I can burgle into my home as long as I want

But we are not owning, we are renting services and infrastructure.

The TS should clarify his demands directly with netcup.

MichaelOF

Make sense, being polite is of course always a good idea.

But still IMHO as the TS wrote "... my line of work inevitably involves performing some (light) port scanning ..." - why should this be forbidden for his "own", yes rented VM?

In fact I did this for myself (not as "bounty hunter"), but for proofing that REALLY only the ports I want to open are open. From a Linux box at home, or even via Android apps like "Ping"... Was a while ago pretty "funny" that e.g. docker was pretty free on a normal user level to open each and every port......

NaN

As you are portscanning systems operated by potentially unaware sysadmins and defended by automated abuse detection systems, you must expect Netcup to receive abuse reports about your activity in addition to Netcup's own abuse monitoring which is designed to catch malicious behavior to detect compromised systems. This is an additional workload that you would have to clear with Netcup.

I expect that this is not acceptable behavior because how could Netcup tell if you're actually authorized to perform these scans. Even if you can provide documentation in some cases, you could still run unauthorized scans and nobody would be the wiser.

My recommendation would be to use end-user networks for something like this. Nobody cares what DSL and mobile phone users do.

MichaelOF

NaN My misunderstanding, wrong direction You read the TS initial post in way that he wants to peform OUTGOING port scans, he rents a VPS, and wants to use for outgoing scans, destination wherever, his "customers or companies who have a bug bounty program".

Based on mistake by me, pls forget everthing misleading written by me.

Although "customers" probably expect the port scans, and maybe even "companies who have a bug bounty program" would not really have "potentially unaware sysadmins", the outgoing port scan as a traffic pattern should trigger Netcup's abuse monitoring.

[netcup] Sarah G. 25. Juni 2025 um 09:14