[sylware]

"Monitoring their network for suspicious activity" does not mean to scan ports.

It means they have to monitor if one of their hosted "boxes" is actually generating nasty traffic. Once detected, they have to inform the owner of the "box" that they have been pown, well, careful if the owner of the "box" is actually the mob...

And I can tell you, I get attacks/scans mostly from those "clouds", like I start to wonder if they are not "closing their eyes" on purpose because with their huge network resources it is wrecking "small hosting", or more "business" for them.