The numbers indicate a sharp decrease in vulnerable systems for the NTP monlist issue. The month of May showed an extensive effort for patching and truing up patch levels because of the Heartbleed issue. This effort likely assisted in the patching along with it. The following graph was taken from ISC data gathered here:https://isc.sans.edu/port.html?&port=123. NTP Reflection Attack. Ongoing NTP Amplification Attacks Continue. .NTP reflection Attacks. receivea number of NTP DDoS attacks in recent months.”]
Source: https://isc.sans.edu/diary/NTP+DDoS+Counts+Have+Dropped/18299