SHA-256 on record
sha256, shown defanged for safety: 3ba161ca7b8dcf389ec3236c9ddfb943e9d1766181b1b81a227649cad46132a8
Ownership assessment
Ownership does not apply to a file hash.
A hash identifies an exact sequence of bytes. It has no registrar, no hosting provider and no owner, so the ownership classes we apply to domains and addresses are not meaningful here. What matters for a file is which campaigns it was seen in and who reported it — both are recorded below.
Using it
A hash is the most durable thing on this site. Unlike a domain, it never changes hands: matching bytes are matching bytes, on any date.
Campaigns referencing this file
Where this came from
Reported by Check Point Research on 2026-08-18
Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect
Recorded as sha256, shown defanged for safety: 3ba161ca7b8dcf389ec3236c9ddfb943e9d1766181b1b81a227649cad46132a8 · Sample · extracted by Machine-extracted, human-reviewed
Observation timeline
No checks are recorded for this file. It has not been through enrichment, which means nobody has looked at whether it still resolves, where it points, or whether it has been taken down.
An empty timeline is a statement about our coverage and nothing else. It is not evidence that the file is inactive, and it is not evidence that it is live. The dated observations from published sources, further up this page, are the only claims we are making.
What to do with this
Match this against your file inventory or endpoint telemetry. A match means these exact bytes, on any date; a miss proves little, because a rebuilt sample carries a different hash.
Found an error? Tell us — disputed entries come down the same working day, before we decide whether the dispute is right.
Cite as
ClickFixReport, “3ba161ca7b8dcf389ec3236c9ddfb943e9d1766181b1b81a227649cad46132a8”, indicator ID 028a5bf4-b641-464b-a22b-2e7ce0e17b94, retrieved 2026-08-29.
https://clickfixreport.com/hashes/3ba161ca7b8dcf389ec3236c9ddfb943e9d1766181b1b81a227649cad46132a8
Published under CC BY 4.0. Reuse it, including commercially, with attribution. The date above is when this record last changed, not when you opened it — the page is a versioned record, so that is the date a reader needs to find what you saw.