Hacker News Reader

I've had this, too, and it later turned out that it was the VPS provider itself scanning my new instance for vulnerabilities.

Was it actually the provider scanning, or just a compromised VPS host using that same provider?

It does seem proactive to scan customers' hosts then notify them if exploits are found.