I'm running a few EC2/Scalr instances with zabbix monitoring.
I received complaints about one of my servers port scanning other servers. the logs show it is accessing port 22 on consecutive IP addresses.

I looked at the processes list and saw scanssh is running under the user Zabbix....