"Back when I had an ISDN connection, I'd see 5-10 attempts a day (and I would sometimes send emails to the abuse@ address for that IP range). Now I see 5-10 a second and it's pointless to try and stop them at the source."

There is nothing inherently wrong with port scanning and it should not, by default, be considered "abuse".

> I'm somewhat curious if all those attempts count against my data cap.

I don't see why they wouldn't. IP (which is really the layer ISPs should operate at) does not distinguish between packets that you have "requested" and unsolicited packets, being connectionless protocol and all.

Same. I have about 500 different IP every month trying to RDP into my servers. I add them automatically to the firewall of my servers.