As noted below, this data is very obsolete. Go see this data instead:

• DShield: PC Survival Time
• DShield: Port Trends
• DShield: Port Reports

• Two Week Rolling Attack/Scan Summary
• Two Week Rolling Port-Attack/Scan Details
• Monthly Attacks/Scans by Volume and Service (Historical)

These numbers from the drop rule on my firewall appliance on a Comcast cable modem which has never allowed incoming services into the network from the world. Thus, any traffic (packets) originating from the world and hitting this firewall is almost certainly malicious.

I stopped updating this when I changed firewalls in mid 2005. I would have to re-write the parsers and other tool to deal with the new log format. I'll do this eventually, but right now I'm too busy.

Monthly Attacks/Scans by Service (Historical)