What were the most common activities done by the IPs that were "new" in the last twelve hours? New compared to the history of IPs available. Just wondering if it was orchestrated or whether it would give a clue as to the resource that was consumed.