Two IP addresses accounted for the majority of the 1.4 million exploitation attempts observed over the past week.