I’ve run responder on a digital ocean box (don’t ask) and seen large volumes of attempts to access a fake mssql server, the amount of zombie attacks is pretty eye opening.