The exploiter then attempts to access the script to verify that the server was successfully exploited. Ullrich says the exploitation has only been detected from a single IP address, 169.150.226.162.