Finding family: Exposure
Report
Scan, Stage, Command: Tracing a Potassium Cluster From PHP2Shell-Labelled Attempts to Its C2 Infrastructure
An address on a shared hosting range tried a PHP2Shell-labelled chain, then React2Shell, against the same target two hours apart. Both pointed to one staging server and one Potassium bot. Decode the bot's DNS answers and one of its configured C2 addresses sits in the same /24 as the scanners. A field note on correlating scanning, staging and command infrastructure, and on why a request labelled "PHP2Shell" is not proof that PHP2Shell was exploited.