A system comprising: at least one processor; and a computer-readable medium configured to store instructions for execution by the at least one processor, wherein the instructions, when executed, cause the system to perform a method comprising: obtaining a dictionary of a first set of clusters of vulnerability scanner activities, generated from a first set of web requests associated with a plurality of vulnerability scanners; receiving data for a second set of web requests transmitted to a set of web services; identifying a set of clients that transmitted the second set of web requests; generating a second set of feature vectors, wherein for each feature vector in the second set of feature vectors: the feature vector corresponds to one of the set of web services and to one of the set of clients, and each element in the feature vector corresponds respectively to an entry in the dictionary; clustering the second set of feature vectors into a second set of clusters; and in response to a first distance between a selected cluster of the second set of clusters and one of the first set of clusters being less than a first predetermined distance, (i) identifying one of the set of web services that received web requests corresponding to feature vectors in the selected cluster and (ii) generating an alert for an administrator of the one of the set of web services. at least one processor; and a computer-readable medium configured to store instructions for execution by the at least one processor, wherein the instructions, when executed, cause the system to perform a method comprising: obtaining a dictionary of a first set of clusters of vulnerability scanner activities, generated from a first set of web requests associated with a plurality of vulnerability scanners; receiving data for a second set of web requests transmitted to a set of web services; identifying a set of clients that transmitted the second set of web requests; generating a second set of feature vectors, wherein for each feature vector in the second set of feature vectors: the feature vector corresponds to one of the set of web services and to one of the set of clients, and each element in the feature vector corresponds respectively to an entry in the dictionary; clustering the second set of feature vectors into a second set of clusters; and in response to a first distance between a selected cluster of the second set of clusters and one of the first set of clusters being less than a first predetermined distance, (i) identifying one of the set of web services that received web requests corresponding to feature vectors in the selected cluster and (ii) generating an alert for an administrator of the one of the set of web services. obtaining a dictionary of a first set of clusters of vulnerability scanner activities, generated from a first set of web requests associated with a plurality of vulnerability scanners; receiving data for a second set of web requests transmitted to a set of web services; identifying a set of clients that transmitted the second set of web requests; generating a second set of feature vectors, wherein for each feature vector in the second set of feature vectors: the feature vector corresponds to one of the set of web services and to one of the set of clients, and each element in the feature vector corresponds respectively to an entry in the dictionary; the feature vector corresponds to one of the set of web services and to one of the set of clients, and each element in the feature vector corresponds respectively to an entry in the dictionary; clustering the second set of feature vectors into a second set of clusters; and in response to a first distance between a selected cluster of the second set of clusters and one of the first set of clusters being less than a first predetermined distance, (i) identifying one of the set of web services that received web requests corresponding to feature vectors in the selected cluster and (ii) generating an alert for an administrator of the one of the set of web services. (i) identifying one of the set of web services that received web requests corresponding to feature vectors in the selected cluster and (ii) generating an alert for an administrator of the one of the set of web services.