These are no longer loaded by default due to the performance impact they cause simply by being loaded (they have event handlers for commonly generated events) and they aren't generally useful enough to justify it.
We should now quite reliably detect scans/attacks, even when encrypted and not succesful.
