Query on IPS reports

Question

In the IPS reports i see multiple counts of the same exploit from the same source ip. I wonder why would someone continue to attempt exploiting a vulnerability when he must have realized in the first attempt only that the exploit was blocked?

Answer 1

I would guess that this is an automated attack which does not have too much intelligence built-in. A sign of an automated script would be other (possibly unrelated) attempts from the same IP.