Yes. People have alerts set up on portscanning, both inbound (to detect recon attempts) and outbound (to detect compromised/abusive internal hosts). There are lots of legitimate reasons to do large-scale network surveys, but you have to be careful about them, because they are also strong abuse signals --- meaning: when providers go after people who are port scanning, more often than not it turns out that the port scanning source was in fact clearly abusive.

>Suspicious, OK. Straight up abuse, though?

Depending on the situation, it could be.

While not an issue any longer (well, at least for those without data caps -- man do I hate those!), ~30 years ago I worked for a network equipment manufacturer as an integrator/tester/3rd level support guy (yes, it was a small company) and was testing our IP stack.

I got the (not so) bright idea of running continuous pings to random IP addresses (changing them every couple days) to verify stability and identify possible memory leaks.

One of the addresses was someone in Australia who was charged by the byte (or packet...it was a long time ago) and after a day or two, we received some very angry telephone calls from them. Oops.

This person (and rightly so) felt I was abusing their internet link, even though I didn't know or care about them or the contents of their network.

Like I said, this isn't (or at least not for the most part) an issue any more, nor is it something more intrusive than port scanning, but it points up the idea that "abuse" is not a black and white thing.

Run port scans against my IP addresses and the absolute worst that might happen is me scanning you right back (yes, I know, that sort of thing is generally frowned upon. So sue me -- nobody has yet).

Run those same scans against government/military sites and you may well soon have a knock (or a battering ram) on your door.

Context matters.

Because your incompetent enterprise hired incompetent contractors (on an eye watering day rate) to migrate firewall rules from an old firewall to a new one, and they did so by running an incompetently-implemented automated tool in an in incompetent manner such that 4000 'allow' rules were moved over but that the source and destination address were set to 0.0.0.0/0...

There are two "they"s involved in the conversation but generally when using someone else's stuff the more apt question is "why should I have an expectation I can use their stuff however I want without limit".

For the "they" of your provider, who is held accountable for allowing abusive traffic, the goal is to provide you outbound connectivity but to do that they also need to ensure they don't get de-peered or their network ranges blocked for hosting abusive traffic. Even for things which don't transit a 4th party there is negative incentive to let your customers abuse each other just because the addresses are reachable. This almost always results in automated systems with limited incentive for good uses of port scanning to be allowed.

For the "they" of the end system is (most likely) they didn't make the entire system available to you, just some select services for use in a certain way (e.g. loading their website). Doing that does not provide them an obligation to continuously allow all traffic received at the address to be processed and it's very likely they'll just block you entirely as another layer of defense.

This is not how authorization to use other people's services work. In practice you're vanishingly unlikely (in the US at least) to get into legal trouble for port scanning, but if you take this logic to its conclusion --- a service exposes some capability without authentication, ergo you're authorized to use it --- you very definitely can get prosecuted.

“It’s just jiggling a door handle. Why would they make a door accessible to me if they don’t want me jiggling the handle?”

Welcome to the age-old conversation which can well be analog'd as why would someone leave the front door of their house open if they didn't want you walking in? Or checking door knobs?

Because they're making it available to someone else, who (unlike you) is authorized to connect from anywhere in the world.

> It's just network connections.

Stealing someone's bitcoin? It's just network connections. Logging in to some admin portal with default passwords? It's just network connections.

> Why would they make a computer accessible to me if they don't want me connecting to it?

Why would they write bugs in software if they don't want to write bugs?

DDoS attacks are “just network connections” too.

The alerts tend to be geared more toward attempts to reach a secured system that isn't accessible to you.

Have you tried seriously answering your own question?