active attacker response