I'm running PiHole on a VPS and have taken measures to prevent DNS amplification attacks (following this guide). Once per day I get visited by a few random IPs and also shadowserver.org. Is there any reason to be concerned by this?
The shadowserver.org and others, which may be the other IPs, are periodically scanning all possible IPv4 addresses (they are a finite number and actually less than you might assume). This is nothing unusual. Your IP gets added to a database with services that have been found at a certain address. If you are really sure that everything is okay, then these requests are neither something to worry about nor something you can easily avoid.
1 Like