Finding anomaly in a list that has number of account logins in a day for a month I am trying to develop a model that captures anomaly in the number of account login attempts made in a day. 
For example:
5,8,11,6,... will not have an anomaly
but
1,5,3,120,... will have an anomaly at 120
I tried to approach this by finding the mean and deviation and checking for those that have value greater than 3*dev, while for some this works, some lists like 
0,0,123,0,0 
does not work.
Any help will be appreciated.
 A: With the possibility of multiple anomalies per month, if you're going to look at some multiple of an estimate of the spread above a location measure you need a high-breakdown estimate of both.
So for example you might look at a scale measure based on the median absolute deviations from the median ("MADM") and take some multiple of that above the median (say median + 5*MADM -- or perhaps more). I'd also be tempted to put some lower bound on the scale measure (so that 29 1's and a 2 doesn't raise a flag!). You might be able to say "well, even if you always get in once per day, five times still should be okay", which might have you say that the scale used in the rule would be perhaps max(1,MADM) or max(2,MADM) say (try out a few scenarios to see what makes sense for your cases).
Another option might be to take a weighted average of the individual scale and some overall measure of relative scale (so if MADM/median is typically 3, and someone has a ratio of 0, they might get pulled up from say 0 to 0.6, perhaps)
Or one might assume that the base model for logins is some zero-modified negative binomial (say) contaminated by some anomaly process, and then perhaps have some form of hierarchical mixed effects model across users - but that sort of thing will require a lot more detail about what you understand about the process, and what you need.
However, for a first stab at it you might consider something like the upper end of either of the boxplot rules (which marks Q3+1.5*(Q3-Q1) and Q3+3*(Q3-Q1) as possible outliers) -- though it could suffer the same issue with 29 1's and a 2, 
so you might again need to say the scale is max(1,Q3-Q1) say.
Do you have some real data to try? Failing that can you give some data that has one or more value that are nearly anomalous but you don't want flagged or data that has values that are just anomalous that you would want flagged (or better, both) so we can get a better sense of what your needs are? It would help to rule out some of the huge number of possibilities.

It occurs to me with count data like this, there's a somewhat "natural" scale -- if we look at say an Anscombe or Freeman-Tukey transform -- which gives us a different way to deal with the tendency of say a MADM to be 0.
A: It might be helpful to apply some outlier detection techniques. Since I'm assuming you don't have any labeled data to try, you are going to be making a final decision manually.
One possible solution I would try to help with this problem would be to take each data point to be the center of some distribution, say normal centered at that point and the standard deviation something reasonable to the spread of the data set.
You could then asses how many points fall within the 95% confidence interval for that distribution or within some confidence boundary of that distribution. The points who have the lowest number within that interval or capture the smallest percentage of all the points would be the observations to consider.
A: Assuming one has enough data, I would make a histogram and fit it with $n$ possible mixture distributions to find the best mixture as a first step. The reason for this is that the safest assumption is that the unusual login attempts come from independent causes, and that there may be several types, robots, highly incompetent people, etc. Each different cause may, however, leave its own distribution 'fingerprint' as it were, and each is separately actionable. An incompetent human may need help, but a robot would not, so that action classification by distribution type becomes relevant. 
