The public WXA IASC research explained the ILOVEPOOP React2Shell toolkit and the infrastructure behind it. Attaxion helped show which real organizations sat behind the signal, which hosted environments mapped to identifiable corporate users, and why the resulting exposure picture was operationally useful.
From Raw Telemetry to Owner-Level Attribution
Recent research from WhoisXML API and the WXA Internet Abuse Signal Collective (WXA IASC) documented a cohesive React2Shell exploitation toolkit calling itself “ILOVEPOOP,” tied to highly centralized infrastructure and large-scale scanning activity. That work established the shape of the campaign. Attaxion’s role was to make the signal more actionable by helping determine which real organizations sat behind the observed IP space, which environments were dedicated rather than shared, and which classes of likely targets appeared most exposed.
At internet scale, raw IP telemetry and hosting labels only go so far. An ASN, a netname, or a hosting-provider label can tell you where traffic landed, but not necessarily who actually owns or operates the application stack behind that infrastructure. For defenders, the difference between “this hit a hosting company” and “this touched a specific SaaS operator, retailer, workforce platform, or public-sector environment running on hosted infrastructure” is the difference between background noise and something worth investigating.
This is where Attaxion’s core platform capabilities mattered. Using the same discovery, attribution, and monitoring approach behind its exposure management product line, Attaxion combined RDAP, WHOIS, DNS, passive DNS, SSL, IP netblock, and related ownership signals with machine-learning-driven entity resolution to map internet-facing infrastructure back to identifiable organizations. In hosted environments, that meant moving beyond the front-facing hosting label and resolving the actual network owner or corporate user whenever the signal supported it, while also separating dedicated enterprise allocations from shared or multi-tenant space when full attribution was not possible.
From Network Names to Victim Microcategories
That attribution layer materially changed the value of the research. Instead of stopping at broad macro-categories such as commercial, government, or internet and hosting, the dataset could be interpreted through much more operationally useful microcategories. Within the WXA IASC’s high-identifiability slice of 65,821 NetFlow records across 3,420 unique U.S.-sourced netnames, the microcategory view showed that SaaS and software platforms dominated the signal. In the published breakdown, that segment alone accounted for 39,140 records, or 59.5 percent of the high-identifiability subset.
The rest of the picture was just as important. The same enrichment surfaced meaningful concentration across retail and eCommerce, workforce management and security platforms, government agencies, ISP customer-assigned address space, education and research institutions, healthcare and life sciences, media and entertainment, email security platforms, and energy and utilities. In other words, Attaxion helped turn generalized infrastructure observations into plausible victim classes and reachability context. That is a much stronger basis for prioritization than simply saying that traffic was seen at a hosting provider or cloud network.
This distinction matters because so much internet-exposed infrastructure now lives inside third-party hosting, cloud, VPS, CDN, and managed-service environments. Without attribution, a large part of the exposure picture collapses into misleading “hosting noise.” Attaxion’s models help separate the infrastructure operator from the business actually running the exposed service. That is how broad telemetry becomes useful for identifying which organizations may need to investigate specific React2Shell-related exposure first.
What Attaxion Continues to Find Across Affected Networks
Attaxion’s contribution here was not limited to naming organizations. Across the company’s broader product line, the same discovery, vulnerability assessment, and continuous monitoring workflow keeps showing that many affected networks present existing and exploitable React or Next.js issues. They often expose vulnerable React configurations alongside other familiar OWASP Top 10 classes, including security misconfiguration, broken access control patterns, injection exposure, weak security headers, and other externally visible web-application weaknesses.
That broader context matters because attackers almost never benefit from one flaw in isolation. They benefit from accumulation: an exposed React surface, an overlooked admin path, a permissive configuration, a stale dependency, or another weakness on the same attack surface. Attaxion is seeing that pattern repeatedly. Without naming any specific customer, Attaxion is working with WXA IASC to responsibly route findings to affected network owners and has already identified dozens of actionable cases where the right organization can be contacted and the right exposure can be validated or remediated.
This is also where the platform story becomes relevant in a grounded way. The same system that can attribute an asset to the right organization can also discover related assets, enumerate technologies, scan web applications, surface exploitable issues, and help teams prioritize what deserves immediate action. In practice, that means Attaxion is not just adding labels to a report. It is helping convert wide-area signals into an owner-level remediation workflow.
To continue reading this story and learn about Kimwolf intersection with ILOVEPOOP toolkit download the report here.