The Shadowserver Scanning projects performs regular Internet wide scans for many protocols. They scan for four main types of protocols:
- Amplification protocols, e.g., DNS or NTP
- Botnet protocols, e.g., Gameover Zeus or Sality
- Protocols that should not be exposed, e.g., Elastic Search, LDAP, or RDP
- Vulnerable Protocols, e.g., SSLv3
The website is a great resource to get general statistics about the protocols, like the number of hosts speaking the protocol, their geographic distribution, associated ASNs, and the historic information.