From the report:

> A few hours after they find the site, [the agents] start probing it for cross-site scripting (XSS) vulnerabilities.