In addition to my day job as a technical support specialist, I operate a shared web hosting environment and run a number of servers for this purpose. I run a LAMP environment.
Beginning at 4am Eastern Time today, my firewall has alerted me to numerous port scans being performed on my server. When they didn't stop, I lowered the amount of port scans allowed before blocking the IP address outright for a set amount of time - and I increased the time limit (from 3600 seconds to 6900 seconds).
The scans just keep coming - and my firewall keeps blocking the IP addresses. Now, I'm beginning to consider blocking about 3 or 4 different Class B subnets.
I also remembered that I had Telnet installed, so because it's not doing anything useful, I went ahead and removed it. As of about a week or so ago, I have all security updates installed, although I do have some packages that have some outstanding non-security updates available.
How worried should I be that whoever this is is going to follow up these port scans with an attempted attack? Would you recommend I outright block these Class B subnets?
Edit: I should mention, of course, that I'm keeping a very close eye on my logs right now.