1. A method for operating a customer data collection and protection apparatus which has a processor configured by a software product and a computer-readable local store of categorized targets comprises: transmitting to a central server reports on traffic to targets not categorized, wherein targets comprise actual Internet Protocol addresses; receiving from the central server an update containing a list of uncategorized targets which are either a source or a destination of traffic patterns which suggest suspicious, malicious, or infectious behavior, wherein a target is an IP address for a real or fictitious host; presenting end users with at least one warning of possible infection, malicious code, or suspicious behavior and controls for a malware cleanup tool, detecting a system visiting or attempting to connect to at least one suspicious, malicious, and/or infectious target based on the list received from the central server; and observing, measuring, and recording meta data on traffic or attempts to connect to an uncategorized target, wherein meta data includes how many sources per unit time per destination.