URLhaus Database

You are currently viewing the URLhaus database entry for http://45.95.147.178/z/wr.php which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry


ID:3884408
URL: http://45.95.147.178/z/wr.php
URL Status:flame Online (spreading malware for 3 days, 10 hours, 42 minutes)
Host: 45.95.147.178
Date added:2026-07-09 16:56:28 UTC
Threat:Malware download Malware download
Reporter: botnetkiller
Abuse complaint sent (?): Yes (2026-07-09 16:57:18 UTC to abuse{at}as49870[dot]net)
Tags:opendir sh ua-wget

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2026-07-12wr.phpsh 0383c4aaa366711c094df576babc604b41f133006c6f6d53ec5feab2d1cc56fdn/a
2026-07-12wr.phpsh 20ebc97afd3af41565d112c201bac8ad87c75ff32580a75a32b171218a19a132n/a
2026-07-12wr.phpsh 791cdbdf8e0053d6aa3dbcf4f714b17f284ee81e95c88def8ae45ececd271596n/a
2026-07-12wr.phpsh 46198462d69ded74fa2b0eb5b2ca7401f4e924c6f67707be43f761a937d01397n/a
2026-07-11wr.phpsh c8a2d4ff2c12a7f081244dfa55a14bc7b0a4e029afd96fa06111c21eaf44c096n/a
2026-07-11wr.phpsh da50ab4a0d77e1e1a518a0e3baeda28ede523deb958d28e33af8fdffb4d88c5an/a
2026-07-11wr.phpsh af3a21a5068bedaf9c5c6c6be8a45915e6d4480227b9c79fb7a55aae6c8cd05fn/a
2026-07-11wr.phpsh 67ac3dcea8bd9a75d1aabc0957a465e8952a725e780ee5091d5fc06cf57d11e0n/a
2026-07-11wr.phpsh a9ae957118ea2fe39582d935cdce037504cb343c216a0399260e6183dd3810fcn/a
2026-07-09wr.phpsh 7d2ae2a214a78507141ac7dff3e0757e392db7b626e30b925e555ccbc13ebe6fn/a
2026-07-09wr.phpsh 8a9deb782e5bfe62f10e129450509a90e8b7c18d813475396af9eefbbaab956an/a