two fake attacks after website install