Security testing, port scanning, and pen testing

The short answer#

Network scanning from your VPS is not allowed. That means no port scanning, no vulnerability scanning, no brute-force or credential-guessing runs, and no other probing of hosts over the network, against any target. Authorization from the target's owner does not change this: a bug bounty program's scope, a signed penetration-testing contract, or a red-team engagement is an agreement between you and that target, and it doesn't make the traffic permitted on our network.

If an engagement needs scanning, it needs to run from somewhere other than a VPSDime VPS.

What the rule covers#

The rule is about what your VPS sends to other hosts. Which tool produces the traffic doesn't matter.

• Port and service scanning of any host or range (nmap, masscan, zmap, and similar), including slow, stealth, or "just a few ports" scans.
• Vulnerability scanning (Nessus, OpenVAS, Nikto, Nuclei, sqlmap, web application scanners, and the like) against any site or server.
• Brute-force and credential testing against SSH, RDP, web logins, mail, or any other service.
• Exploitation frameworks and attack traffic (Metasploit and similar) aimed at any host.
• Recon that touches the target over the network: banner grabbing, directory brute-forcing, subdomain brute-forcing, and the like.
• Denial-of-service or amplification traffic, which has its own prohibition under the DDoS policy. A "stress test" against a target you don't own is an attack.

This applies no matter whose systems the target belongs to: a third party, a bug bounty program, a client who hired you, a practice lab, or your own servers elsewhere.

Why authorization doesn't change it#

• Our terms don't make an exception. The Terms of Service prohibit outbound port scanning, vulnerability scanning, and brute-force activity, and the Acceptable Use Policy treats a port scan, stealth scan, or other information-gathering activity as a precursor to intrusion. Neither document has an "unless authorized" clause.
• The target sees our IP, not your paperwork. A scanned host reports the source address to the network it belongs to, which is us. We receive the abuse complaint, our IP space is what gets listed, and other customers on the same range feel it. "It was authorized" is a conversation between you and the target, and it doesn't undo the report.
• The consequences land on your service. A VPS found scanning is subject to suspension under the TOS. The path back is the same as for any other violation and is described in What you can run, and what isn't allowed.

What this doesn't cover#

• Your own VPS, from inside. Checking what your VPS is listening on with ss -tlnp or netstat, reviewing your firewall rules, or auditing the packages installed on it is local administration, not network scanning.
• Incoming scans against your VPS. Every public IP is probed constantly; that's background noise, not something you need to report. Our SSH firewall blunts the common brute-force class automatically.
• Reporting a vulnerability in VPSDime itself. If you come across one, tell us through a ticket. Don't probe our systems or other customers to confirm it; a description of what you noticed is enough and we'll take it from there.

Still need help?#

If you're not sure whether something you plan to run counts as scanning, ask us first and describe what you'd be running and against what. For anything that probes other hosts over the network the answer will be no, but we'd rather say so before you order than suspend a VPS afterwards.

Related questions#

• "Can I run nmap or a port scanner from my VPS?"
• "Is penetration testing allowed on VPSDime?"
• "Can I run a vulnerability scanner from my server if I have the owner's permission?"
• "Can I test my own website's security from my VPS?"
• "Am I allowed to scan other servers?"
• "Can I use my VPS for HackTheBox or CTF practice?"