differentiate between login attempts and probes

close #162