Hi,
this does not look like you've been hacked, these are "normal" scans on the net in these days.
If it's a virtual server, what makes you sure it's related to your virtual server and not some other virtual server on the same node?
Maybe some other virtual server on the node is creating...