Today my firewall blocked an incoming NTP (port 123) connection from 134.147.203.115. A quick reverse DNS lookup reveals its current domain name to be scanresearch1.syssec.ruhr-uni-bochum.de, so presumably someone at RUB is doing some kind of experiment involving scanning internet users. My question is: how would this sort of thing find my PC? If my public IP address is shared with all those on my chosen VPN server, then why me? How me? Are they just trying all the ports on the AirVPN server, hoping that one of them is translated to a valid NTP connection?