Probably neither. They’re probably taken down by the owners as they patch the PHP vulnerability affecting 70% of all websites.

www.wiz.io/blog/php2shell-php-rce