Report - telegahps.hair/

Report Overview

Visitedpublic

2025-07-05 23:06:40

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
telegahps.hair	unknown	2025-06-26	2025-07-04	2025-07-04	12 kB	1.4 MB	172.67.219.152

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2025-07-05	medium	telegahps.hair	Sinkholed

ThreatFox

No alerts detected

JavaScript (4)

	URL	From	Size	First Seen	Last Seen
	telegahps.hair/redirect.js	ScriptElement	325 B	2023-07-27	2025-08-05
URL telegahps.hair/redirect.js IP / ASN 172.67.219.152 #13335 CLOUDFLARENET Introduced by ScriptElement Embedded false Resource Info First Seen 2023-07-27 Last Seen 2025-08-05 Times Seen 10408 Size 325 B (325 bytes) MD5 17773b57b87a678c98e26a7cac72df6c SHA1 7422857aa75ee81cabcec2eed6c4a6168f363ee1 SHA256 375141f2d3f04c733276dbff5d9208ff36b2db6a64abcee723179ac24797974f Format Code Loading...

	telegahps.hair/compatTest.js	ScriptElement	2.5 kB	2024-06-30	2025-08-05
URL telegahps.hair/compatTest.js IP / ASN 172.67.219.152 #13335 CLOUDFLARENET Introduced by ScriptElement Embedded false Resource Info First Seen 2024-06-30 Last Seen 2025-08-05 Times Seen 11531 Size 2.5 kB (2544 bytes) MD5 da7800ea928a021f2539ab41e6f2323e SHA1 0141da1dc85ca8f34212f3dde2fac9bf61f5adb7 SHA256 15c24ec2b4cb94f24e66750f09e7071e5659e20a5ed926f69f565e20a81027cf Format Code Loading...

	telegahps.hair/main.d54bfa037348b154a941.js	ScriptElement	296 kB	2024-12-10	2025-08-05
URL telegahps.hair/main.d54bfa037348b154a941.js IP / ASN 172.67.219.152 #13335 CLOUDFLARENET Introduced by ScriptElement Embedded false Resource Info First Seen 2024-12-10 Last Seen 2025-08-05 Times Seen 8408 Size 296 kB (296503 bytes) MD5 a04bc08436674f0eba06d5c190dc6fe5 SHA1 3d0a8dbececd918da43706976766e246262d254d SHA256 4c70083f389a2fafc6a5f3c35179243623b4416cab07a1c6ce08d3f7c1ddb2ae Format Code Loading...

	telegahps.hair/8673.1b6dd8d303b0535cc1f8.js	ScriptElement	11 kB	2024-12-10	2025-08-05
URL telegahps.hair/8673.1b6dd8d303b0535cc1f8.js IP / ASN 172.67.219.152 #13335 CLOUDFLARENET Introduced by ScriptElement Embedded false Resource Info First Seen 2024-12-10 Last Seen 2025-08-05 Times Seen 10534 Size 11 kB (10696 bytes) MD5 ea8d5208dada45e8d0844877a7c93db6 SHA1 45d98fbe3dae09a988cccd836d39016c5100f313 SHA256 25f447387cefb643c04e0aa816e21edf562ebe9b7e3f7b808bdb179154fc17b8 Format Code Loading...

HTTP Transactions (26)

URL IP Response Size

GET telegahps.hair/icon-192x192.png

172.67.219.152

200 OK

3.1 kB

URL GET HTTPS

telegahps.hair/icon-192x192.png

IP / ASN

172.67.219.152

#13335 CLOUDFLARENET

Requested byhttps://telegahps.hair/

Resource Info

File typePNG image data, 192 x 192, 8-bit colormap, non-interlaced

First Seen2023-05-16

Last Seen2025-08-05

Times Seen12704

Size3.1 kB (3059 bytes)

MD51a1650d2c76bfc1ac484646c19e495b9

SHA1fe58d66042ce9241226f5da9370230285ff604fc

SHA2566e587a62c9d7a97f25265ab5eb29d101ad2e36810042a4116d2dd29da96b0bf8

Certificate Info

IssuerGoogle Trust Services

Subjecttelegahps.hair

Fingerprint92:BB:60:4B:8C:36:E9:C3:84:D4:6E:94:20:7F:E5:7A:4D:63:88:5D

ValidityThu, 26 Jun 2025 09:47:17 GMT - Wed, 24 Sep 2025 10:46:05 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /icon-192x192.png HTTP/1.1
Host: telegahps.hair
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://telegahps.hair/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Sat, 05 Jul 2025 23:06:20 GMT
content-type: image/png
content-length: 3059
vary: Accept-Encoding
last-modified: Thu, 13 Mar 2025 12:49:56 GMT
etag: "67d2d474-bf3"
accept-ranges: bytes
cache-control: max-age=14400
cf-cache-status: REVALIDATED
cf-ray: 95aa83228e6d5687-OSL
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qTZ2Wqcb2whmaCtgyT7Q7glAsgWs25F9TP9bL2%2FjGBe4qe%2BgFGapl6ISpFput0YofwuXpf3WdaBnI6va9pn0vu2i3TiH7wu%2Fv1A3TE4ZwbwJr85t%2FCbcbw3osmrL68iiOA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=10743&min_rtt=536&rtt_var=11674&sent=85&recv=99&lost=0&retrans=0&sent_bytes=8971&recv_bytes=6746&delivery_rate=157056&ss_exit_cwnd=0&ss_exit_reason=0&cwnd=18067&unsent_bytes=0&cid=1e214d4c448e1b3d&ts=1244&inflight_dur=45&x=40"

GET telegahps.hair/2976.4e6e9b1254ce313f06c5.js

172.67.219.152

200 OK

14 kB

URL GET HTTPS

telegahps.hair/2976.4e6e9b1254ce313f06c5.js

IP / ASN

172.67.219.152

#13335 CLOUDFLARENET

Requested byhttps://telegahps.hair/

Resource Info

File typeJavaScript source, ASCII text, with very long lines (14402)

First Seen2024-12-10

Last Seen2025-08-05

Times Seen8017

Size14 kB (14456 bytes)

MD56471dbad18ad444906e7a2bbac930e90

SHA12c1f84caf20c633205f7535b129ae069187ef14d

SHA2561fce51354cfb15e01d900a86d9806d476a4ceb7fd409a5f2744e8bb81fab56e8

Certificate Info

IssuerGoogle Trust Services

Subjecttelegahps.hair

Fingerprint92:BB:60:4B:8C:36:E9:C3:84:D4:6E:94:20:7F:E5:7A:4D:63:88:5D

ValidityThu, 26 Jun 2025 09:47:17 GMT - Wed, 24 Sep 2025 10:46:05 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /2976.4e6e9b1254ce313f06c5.js HTTP/1.1
Host: telegahps.hair
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://telegahps.hair/
Sec-Fetch-Dest: worker
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Sat, 05 Jul 2025 23:06:23 GMT
content-type: application/javascript
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=s%2BpXxSxWCQv4AGoJGNhQbU5IBQSdzkCusw85uY1F1Btcv3DrhiWQULsZOpHZir2cR9qTPkYLUOt7rN09CDFhd41qPYF4xd%2B4Yx49I2WbYadHJhnH7e5Qyy2SndzLG72EYQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
last-modified: Thu, 13 Mar 2025 12:49:56 GMT
vary: Accept-Encoding
etag: "67d2d474-3878"
content-encoding: gzip
age: 0
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 95aa83366f475687-OSL
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; preload
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2712&min_rtt=284&rtt_var=3651&sent=125&recv=117&lost=0&retrans=0&sent_bytes=50515&recv_bytes=8920&delivery_rate=9244524&ss_exit_cwnd=0&ss_exit_reason=0&cwnd=30350&unsent_bytes=0&cid=1e214d4c448e1b3d&ts=5000&inflight_dur=70&x=40"

GET telegahps.hair/7784.df07a876b22e3b2a83e9.js

172.67.219.152

200 OK

22 kB

URL GET HTTPS

telegahps.hair/7784.df07a876b22e3b2a83e9.js

IP / ASN

172.67.219.152

#13335 CLOUDFLARENET

Requested byhttps://telegahps.hair/2976.4e6e9b1254ce313f06c5.js

Resource Info

File typeJavaScript source, ASCII text, with very long lines (21340)

First Seen2024-12-12

Last Seen2025-08-05

Times Seen10330

Size22 kB (21477 bytes)

MD5a0980d43cea486530c30f9f5e1c1b5e4

SHA1deec93f70f8b813b479137075afa6a0a3a25b8bd

SHA2564b5eeb1400e5118a1aff286d9a6cf893bd7c08fc8247c62116238ea587890e9e

Certificate Info

IssuerGoogle Trust Services

Subjecttelegahps.hair

Fingerprint92:BB:60:4B:8C:36:E9:C3:84:D4:6E:94:20:7F:E5:7A:4D:63:88:5D

ValidityThu, 26 Jun 2025 09:47:17 GMT - Wed, 24 Sep 2025 10:46:05 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /7784.df07a876b22e3b2a83e9.js HTTP/1.1
Host: telegahps.hair
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://telegahps.hair/2976.4e6e9b1254ce313f06c5.js
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Sat, 05 Jul 2025 23:06:24 GMT
content-type: application/javascript
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1aBQKZfI0DxtwiakrkRyGUGi%2BJsZ%2BYrJ7sY%2F36QaXenyFWUn3aORaMgCDs8pUS7b3H6saXqzDCQvCPFaAgMSkse6yKyAuZ3x9SsAIQJuIGQ03ce7grn9M7ajMuLw4I6FDg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
last-modified: Thu, 13 Mar 2025 12:49:56 GMT
vary: Accept-Encoding
etag: "67d2d474-53e5"
content-encoding: gzip
age: 0
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 95aa833b6f7c5687-OSL
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; preload
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2269&min_rtt=284&rtt_var=2819&sent=163&recv=123&lost=0&retrans=0&sent_bytes=91439&recv_bytes=10163&delivery_rate=9244524&ss_exit_cwnd=0&ss_exit_reason=0&cwnd=30350&unsent_bytes=0&cid=1e214d4c448e1b3d&ts=5438&inflight_dur=74&x=40"

GET telegahps.hair/5905.db5d2749ecb90aaf2752.js

172.67.219.152

200 OK

140 kB

URL GET HTTPS

telegahps.hair/5905.db5d2749ecb90aaf2752.js

IP / ASN

172.67.219.152

#13335 CLOUDFLARENET

Requested byhttps://telegahps.hair/2976.4e6e9b1254ce313f06c5.js

Resource Info

File typeASCII text, with very long lines (65536), with no line terminators

First Seen2024-12-10

Last Seen2025-08-05

Times Seen10361

Size140 kB (140233 bytes)

MD5fdd268f67cf5c4f79320041e3d156e98

SHA1d66194ee702467dd19130dee59bd824990f5bc71

SHA25636e5ef6880e869bdf9ef2119932dbac7330513aefc50839cc2a6fdde7b519967

Certificate Info

IssuerGoogle Trust Services

Subjecttelegahps.hair

Fingerprint92:BB:60:4B:8C:36:E9:C3:84:D4:6E:94:20:7F:E5:7A:4D:63:88:5D

ValidityThu, 26 Jun 2025 09:47:17 GMT - Wed, 24 Sep 2025 10:46:05 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /5905.db5d2749ecb90aaf2752.js HTTP/1.1
Host: telegahps.hair
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://telegahps.hair/2976.4e6e9b1254ce313f06c5.js
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Sat, 05 Jul 2025 23:06:24 GMT
content-type: application/javascript
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1yi5ttCSS%2BQXDl%2B0zmWxIT0Qor7lI6tlXzpIEGiPC56ICikzeKN%2BPlrk9Ey2N8AxnmpyDemEctdlHlN%2Fh3nBDok9897l6Wi9VhHN4pCtldKfZkzXR51c1NQrz%2BJ64hGZzw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
last-modified: Thu, 13 Mar 2025 12:49:56 GMT
vary: Accept-Encoding
etag: W/"67d2d474-223c9"
content-encoding: gzip
age: 0
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 95aa833e2f8a5687-OSL
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; preload
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2041&min_rtt=284&rtt_var=1941&sent=203&recv=128&lost=0&retrans=0&sent_bytes=139461&recv_bytes=11117&delivery_rate=14348702&ss_exit_cwnd=0&ss_exit_reason=0&cwnd=30350&unsent_bytes=0&cid=1e214d4c448e1b3d&ts=5468&inflight_dur=78&x=40"

GET telegahps.hair/main.949acaf34f3882f511ff.css

172.67.219.152

200 OK

113 kB

URL GET HTTPS

telegahps.hair/main.949acaf34f3882f511ff.css

IP / ASN

172.67.219.152

#13335 CLOUDFLARENET

Requested byhttps://telegahps.hair/

Resource Info

File typeASCII text, with very long lines (11396)

First Seen2024-12-20

Last Seen2025-08-05

Times Seen5708

Size113 kB (113301 bytes)

MD5aee6b880777f1918fcc9894e87cdcd1b

SHA1567e64fccfda3449f840168ee2bb8eb09a267218

SHA256d5e81ea05db27d47fa91e6bd4d675cc1c8eeec9341a4db7859359a7c5ee5fca3

Certificate Info

IssuerGoogle Trust Services

Subjecttelegahps.hair

Fingerprint92:BB:60:4B:8C:36:E9:C3:84:D4:6E:94:20:7F:E5:7A:4D:63:88:5D

ValidityThu, 26 Jun 2025 09:47:17 GMT - Wed, 24 Sep 2025 10:46:05 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /main.949acaf34f3882f511ff.css HTTP/1.1
Host: telegahps.hair
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://telegahps.hair/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sat, 05 Jul 2025 23:06:19 GMT
content-type: text/css
server: cloudflare
last-modified: Thu, 13 Mar 2025 12:49:57 GMT
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
vary: Accept-Encoding
etag: "67d2d475-1ba95"
content-encoding: gzip
cache-control: max-age=14400
cf-cache-status: REVALIDATED
strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
speculation-rules: "/cdn-cgi/speculation"
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=m6Y70L6iCUo%2FPcoeipsfY1n7K3lGfrUtFtB1%2Bj1xDzkwbrIpnA8MRwsDePj4lM5HaaSeRwY5BXizsQIBB2BCgpbT0cOyEy6tVrW5bA%3D%3D"}]}
cf-ray: 95aa831d8b4f56a8-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

GET telegahps.hair/rlottie-wasm.f013598f1b2ba719f25e.js

172.67.219.152

200 OK

66 kB

URL GET HTTPS

telegahps.hair/rlottie-wasm.f013598f1b2ba719f25e.js

IP / ASN

172.67.219.152

#13335 CLOUDFLARENET

Requested byhttps://telegahps.hair/2976.4e6e9b1254ce313f06c5.js

Resource Info

File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators

First Seen2024-05-16

Last Seen2025-08-05

Times Seen11636

Size66 kB (65591 bytes)

MD54441938ee433d3657c20d454d352a336

SHA1dd67121d7fda7c17be196f60c72dfa06bcb5bc6f

SHA256659bf63501a8054ef0eedda3dec466dbc1e9a1b2c4d5d59a285b005215e16679

Certificate Info

IssuerGoogle Trust Services

Subjecttelegahps.hair

Fingerprint92:BB:60:4B:8C:36:E9:C3:84:D4:6E:94:20:7F:E5:7A:4D:63:88:5D

ValidityThu, 26 Jun 2025 09:47:17 GMT - Wed, 24 Sep 2025 10:46:05 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /rlottie-wasm.f013598f1b2ba719f25e.js HTTP/1.1
Host: telegahps.hair
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://telegahps.hair/2976.4e6e9b1254ce313f06c5.js
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Sat, 05 Jul 2025 23:06:24 GMT
content-type: application/javascript
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1YlSXStYlSoV1kOt%2FB5UCEvGVpU%2BkF9L%2Bss5hxRZMCnr8vt22pGAuesD2Wz9AE%2BYKxN8e3oHo9AmztGFPi%2FxHNmt%2B8256By6QsG35hfbmUMUM%2FQ7kx5N9WV5DzLPxEhx%2Fw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
last-modified: Thu, 13 Mar 2025 12:49:57 GMT
vary: Accept-Encoding
etag: "67d2d475-10037"
content-encoding: gzip
cache-control: max-age=14400
cf-cache-status: REVALIDATED
cf-ray: 95aa833f8f965687-OSL
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; preload
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=1120&min_rtt=284&rtt_var=553&sent=304&recv=142&lost=0&retrans=0&sent_bytes=260802&recv_bytes=12765&delivery_rate=34398754&ss_exit_cwnd=0&ss_exit_reason=0&cwnd=30350&unsent_bytes=0&cid=1e214d4c448e1b3d&ts=6099&inflight_dur=88&x=40"

GET telegahps.hair/5905.db5d2749ecb90aaf2752.js

172.67.219.152

200 OK

140 kB

URL GET HTTPS

telegahps.hair/5905.db5d2749ecb90aaf2752.js

IP / ASN

172.67.219.152

#13335 CLOUDFLARENET

Requested byhttps://telegahps.hair/2976.4e6e9b1254ce313f06c5.js

Resource Info

File typeASCII text, with very long lines (65536), with no line terminators

First Seen2024-12-10

Last Seen2025-08-05

Times Seen10361

Size140 kB (140233 bytes)

MD5fdd268f67cf5c4f79320041e3d156e98

SHA1d66194ee702467dd19130dee59bd824990f5bc71

SHA25636e5ef6880e869bdf9ef2119932dbac7330513aefc50839cc2a6fdde7b519967

Certificate Info

IssuerGoogle Trust Services

Subjecttelegahps.hair

Fingerprint92:BB:60:4B:8C:36:E9:C3:84:D4:6E:94:20:7F:E5:7A:4D:63:88:5D

ValidityThu, 26 Jun 2025 09:47:17 GMT - Wed, 24 Sep 2025 10:46:05 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /5905.db5d2749ecb90aaf2752.js HTTP/1.1
Host: telegahps.hair
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://telegahps.hair/2976.4e6e9b1254ce313f06c5.js
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Sat, 05 Jul 2025 23:06:24 GMT
content-type: application/javascript
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YYwvaJl9PlEwYPHKEzfUL3iXB5ESIoeQuA6yqTIFIs%2FfBKF40sq%2BxiN7owG9t%2BM9wAnHZpOsii55ybOlP7OdWb6tFKkYUKnUvQQO2gj46hwxmGiysXTITRuHpS2G8BnQLw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
last-modified: Thu, 13 Mar 2025 12:49:56 GMT
vary: Accept-Encoding
etag: W/"67d2d474-223c9"
content-encoding: gzip
age: 0
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 95aa833e2f8b5687-OSL
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; preload
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=1898&min_rtt=284&rtt_var=1743&sent=215&recv=129&lost=0&retrans=0&sent_bytes=154324&recv_bytes=11164&delivery_rate=14348702&ss_exit_cwnd=0&ss_exit_reason=0&cwnd=30350&unsent_bytes=0&cid=1e214d4c448e1b3d&ts=5469&inflight_dur=80&x=40"

GET telegahps.hair/rlottie-wasm.f013598f1b2ba719f25e.js

172.67.219.152

200 OK

66 kB

URL GET HTTPS

telegahps.hair/rlottie-wasm.f013598f1b2ba719f25e.js

IP / ASN

172.67.219.152

#13335 CLOUDFLARENET

Requested byhttps://telegahps.hair/2976.4e6e9b1254ce313f06c5.js

Resource Info

File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators

First Seen2024-05-16

Last Seen2025-08-05

Times Seen11636

Size66 kB (65591 bytes)

MD54441938ee433d3657c20d454d352a336

SHA1dd67121d7fda7c17be196f60c72dfa06bcb5bc6f

SHA256659bf63501a8054ef0eedda3dec466dbc1e9a1b2c4d5d59a285b005215e16679

Certificate Info

IssuerGoogle Trust Services

Subjecttelegahps.hair

Fingerprint92:BB:60:4B:8C:36:E9:C3:84:D4:6E:94:20:7F:E5:7A:4D:63:88:5D

ValidityThu, 26 Jun 2025 09:47:17 GMT - Wed, 24 Sep 2025 10:46:05 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /rlottie-wasm.f013598f1b2ba719f25e.js HTTP/1.1
Host: telegahps.hair
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://telegahps.hair/2976.4e6e9b1254ce313f06c5.js
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Sat, 05 Jul 2025 23:06:25 GMT
content-type: application/javascript
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0jiLiv0P2lYD73sNczkCKvkbdSGDCPd8vbW%2ByNSBRX3eLcNPlB5JWmTuSSy5gAyhoQuWdP%2FxOiNfVQpYBb1cBJ5f0O38mPPAILlJ5woQH1h%2FRNmyZr9vm172%2Fr5ZyQmgjw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
last-modified: Thu, 13 Mar 2025 12:49:57 GMT
vary: Accept-Encoding
etag: "67d2d475-10037"
content-encoding: gzip
cache-control: max-age=14400
cf-cache-status: REVALIDATED
cf-ray: 95aa833f9f985687-OSL
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; preload
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=1166&min_rtt=284&rtt_var=507&sent=345&recv=144&lost=0&retrans=0&sent_bytes=314588&recv_bytes=13071&delivery_rate=34398754&ss_exit_cwnd=0&ss_exit_reason=0&cwnd=30350&unsent_bytes=0&cid=1e214d4c448e1b3d&ts=6489&inflight_dur=91&x=40"

GET telegahps.hair/favicon.svg

172.67.219.152

200 OK

892 B

URL GET HTTPS

telegahps.hair/favicon.svg

IP / ASN

172.67.219.152

#13335 CLOUDFLARENET

Requested byhttps://telegahps.hair/

Resource Info

File typeSVG Scalable Vector Graphics image

First Seen2023-05-09

Last Seen2025-08-05

Times Seen10196

Size892 B (892 bytes)

MD5d9ee2d4b0edd9f8ba2fb7242162c2c47

SHA1398522893cf2cdefb5176f11bc67eab31c2d7382

SHA256a462f1c5333e16b48335054493cfd1d0a13a96847b4b9ffe2cf24403e6e86010

Certificate Info

IssuerGoogle Trust Services

Subjecttelegahps.hair

Fingerprint92:BB:60:4B:8C:36:E9:C3:84:D4:6E:94:20:7F:E5:7A:4D:63:88:5D

ValidityThu, 26 Jun 2025 09:47:17 GMT - Wed, 24 Sep 2025 10:46:05 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.svg HTTP/1.1
Host: telegahps.hair
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://telegahps.hair/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Sat, 05 Jul 2025 23:06:20 GMT
content-type: image/svg+xml
vary: Accept-Encoding
strict-transport-security: max-age=15552000; preload
last-modified: Thu, 13 Mar 2025 12:49:56 GMT
etag: W/"67d2d474-37c"
cache-control: max-age=14400
cf-cache-status: REVALIDATED
content-encoding: br
cf-ray: 95aa83228e6e5687-OSL
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OPMOyK1%2B4RYc9MCPorGk7Au79IZLJGAGzTetgDE9Npi27vbznXpO9kjADaTwyNdePEsECMi%2FPq731aLirt2TsbPVZTUgGCcZeDl%2BM4VmHuU1zz7u02O1DZ5%2FUTDp4iujLw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=4050&min_rtt=284&rtt_var=6117&sent=106&recv=107&lost=0&retrans=0&sent_bytes=36712&recv_bytes=7101&delivery_rate=3333761&ss_exit_cwnd=0&ss_exit_reason=0&cwnd=30350&unsent_bytes=0&cid=1e214d4c448e1b3d&ts=1431&inflight_dur=65&x=40"

GET telegahps.hair/2976.4e6e9b1254ce313f06c5.js

172.67.219.152

200 OK

14 kB

URL GET HTTPS

telegahps.hair/2976.4e6e9b1254ce313f06c5.js

IP / ASN

172.67.219.152

#13335 CLOUDFLARENET

Requested byhttps://telegahps.hair/

Resource Info

File typeJavaScript source, ASCII text, with very long lines (14402)

First Seen2024-12-10

Last Seen2025-08-05

Times Seen8017

Size14 kB (14456 bytes)

MD56471dbad18ad444906e7a2bbac930e90

SHA12c1f84caf20c633205f7535b129ae069187ef14d

SHA2561fce51354cfb15e01d900a86d9806d476a4ceb7fd409a5f2744e8bb81fab56e8

Certificate Info

IssuerGoogle Trust Services

Subjecttelegahps.hair

Fingerprint92:BB:60:4B:8C:36:E9:C3:84:D4:6E:94:20:7F:E5:7A:4D:63:88:5D

ValidityThu, 26 Jun 2025 09:47:17 GMT - Wed, 24 Sep 2025 10:46:05 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /2976.4e6e9b1254ce313f06c5.js HTTP/1.1
Host: telegahps.hair
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://telegahps.hair/
Sec-Fetch-Dest: worker
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Sat, 05 Jul 2025 23:06:23 GMT
content-type: application/javascript
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=N3HGfaU4PZnS0q%2BLMM64%2BjIWyFwPWS9GklORAviFK4rYHFzbDVUg2svYOCyVZjBFKrErzLHa0zuTDQa3ojewZmBAfvdN%2Fls3mKK%2BrJq46PgscXn29I1q43pxigG3yUeiFg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
last-modified: Thu, 13 Mar 2025 12:49:56 GMT
vary: Accept-Encoding
etag: "67d2d474-3878"
content-encoding: gzip
cache-control: max-age=14400
cf-cache-status: REVALIDATED
cf-ray: 95aa83365f445687-OSL
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; preload
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3268&min_rtt=284&rtt_var=4798&sent=118&recv=114&lost=0&retrans=0&sent_bytes=42983&recv_bytes=8543&delivery_rate=3333761&ss_exit_cwnd=0&ss_exit_reason=0&cwnd=30350&unsent_bytes=0&cid=1e214d4c448e1b3d&ts=4629&inflight_dur=68&x=40"

GET telegahps.hair/5905.db5d2749ecb90aaf2752.js

172.67.219.152

200 OK

140 kB

URL GET HTTPS

telegahps.hair/5905.db5d2749ecb90aaf2752.js

IP / ASN

172.67.219.152

#13335 CLOUDFLARENET

Requested byhttps://telegahps.hair/2976.4e6e9b1254ce313f06c5.js

Resource Info

File typeASCII text, with very long lines (65536), with no line terminators

First Seen2024-12-10

Last Seen2025-08-05

Times Seen10361

Size140 kB (140233 bytes)

MD5fdd268f67cf5c4f79320041e3d156e98

SHA1d66194ee702467dd19130dee59bd824990f5bc71

SHA25636e5ef6880e869bdf9ef2119932dbac7330513aefc50839cc2a6fdde7b519967

Certificate Info

IssuerGoogle Trust Services

Subjecttelegahps.hair

Fingerprint92:BB:60:4B:8C:36:E9:C3:84:D4:6E:94:20:7F:E5:7A:4D:63:88:5D

ValidityThu, 26 Jun 2025 09:47:17 GMT - Wed, 24 Sep 2025 10:46:05 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /5905.db5d2749ecb90aaf2752.js HTTP/1.1
Host: telegahps.hair
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://telegahps.hair/2976.4e6e9b1254ce313f06c5.js
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Sat, 05 Jul 2025 23:06:24 GMT
content-type: application/javascript
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=n46YgKN%2B15GGfaFa%2Fs8Dmr%2Fe2c%2FNCtJbFttnBzBiSEGr8Y7Ndyf7oSv61vkcjqxbin%2BWdBpNf3OGMnLEDJgtiyQdynKqJAysQDUIN3jP%2FWyQZiHvlPPpNpaOf0qWDBcajg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
last-modified: Thu, 13 Mar 2025 12:49:56 GMT
vary: Accept-Encoding
etag: W/"67d2d474-223c9"
content-encoding: gzip
age: 0
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 95aa833e2f895687-OSL
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; preload
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2041&min_rtt=284&rtt_var=1941&sent=180&recv=128&lost=0&retrans=0&sent_bytes=109769&recv_bytes=11117&delivery_rate=14348702&ss_exit_cwnd=0&ss_exit_reason=0&cwnd=30350&unsent_bytes=0&cid=1e214d4c448e1b3d&ts=5466&inflight_dur=77&x=40"

GET telegahps.hair/

172.67.219.152

200 OK

3.1 kB

URL User Request GET HTTPS

telegahps.hair/

IP / ASN

172.67.219.152

#13335 CLOUDFLARENET

Requested byN/A

Resource Info

File typeHTML document, ASCII text, with very long lines (501)

First Seen2025-07-05

Last Seen2025-07-05

Times Seen1

Size3.1 kB (3066 bytes)

MD5fa01c884c221da2081792301bbe07a6e

SHA1468810724fb6914cb824a092758bc135eb56e6fb

SHA25679b3626e1496a0f3273927067dc15c0c5e723f60dc1ebe087e2de74707a9e40d

Certificate Info

IssuerGoogle Trust Services

Subjecttelegahps.hair

Fingerprint92:BB:60:4B:8C:36:E9:C3:84:D4:6E:94:20:7F:E5:7A:4D:63:88:5D

ValidityThu, 26 Jun 2025 09:47:17 GMT - Wed, 24 Sep 2025 10:46:05 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET / HTTP/1.1
Host: telegahps.hair
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sat, 05 Jul 2025 23:06:18 GMT
content-type: text/html
content-encoding: br
last-modified: Sun, 30 Mar 2025 14:44:55 GMT
vary: Accept-Encoding
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cgkX%2BFz8VLpaPYd1HZ5yMjFSNs0bp1APx%2BpP%2BcHHfVDoENuk3psNloe4knvBMAhxsMrr4LyD8YycT1e4lryxjrcZyMlIRsHXZorxt960BtH40V0mt%2F4rUZS64SLeK1DWSg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
speculation-rules: "/cdn-cgi/speculation"
server: cloudflare
cf-ray: 95aa83195efd56a8-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfCacheStatus;desc="DYNAMIC", cfOrigin;dur=401,cfEdge;dur=21, cfL4;desc="?proto=TCP&rtt=6111&min_rtt=455&rtt_var=11268&sent=8&recv=11&lost=0&retrans=0&sent_bytes=3282&recv_bytes=1251&delivery_rate=6703703&cwnd=254&unsent_bytes=0&cid=10a5008444cc25fe&ts=446&x=0"
X-Firefox-Spdy: h2

GET telegahps.hair/redirect.js

172.67.219.152

200 OK

325 B

URL GET HTTPS

telegahps.hair/redirect.js

IP / ASN

172.67.219.152

#13335 CLOUDFLARENET

Requested byhttps://telegahps.hair/

Resource Info

File typeASCII text

First Seen2023-07-27

Last Seen2025-08-05

Times Seen10408

Size325 B (325 bytes)

MD517773b57b87a678c98e26a7cac72df6c

SHA17422857aa75ee81cabcec2eed6c4a6168f363ee1

SHA256375141f2d3f04c733276dbff5d9208ff36b2db6a64abcee723179ac24797974f

Certificate Info

IssuerGoogle Trust Services

Subjecttelegahps.hair

Fingerprint92:BB:60:4B:8C:36:E9:C3:84:D4:6E:94:20:7F:E5:7A:4D:63:88:5D

ValidityThu, 26 Jun 2025 09:47:17 GMT - Wed, 24 Sep 2025 10:46:05 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /redirect.js HTTP/1.1
Host: telegahps.hair
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://telegahps.hair/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sat, 05 Jul 2025 23:06:19 GMT
content-type: application/javascript
server: cloudflare
last-modified: Thu, 13 Mar 2025 12:49:57 GMT
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
vary: accept-encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=wz%2FuU5Ac8Zkaz9eWnVQIrULnxFPiCCdJxpFljDEDBvE9ORs7LFm5pGRaoWJeXNsVmt1pS98nIjf1WUbBxhhu1L4c48LCd4Ye6tbSEw%3D%3D"}]}
cache-control: max-age=14400
cf-cache-status: REVALIDATED
strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
speculation-rules: "/cdn-cgi/speculation"
etag: W/"67d2d475-145"
content-encoding: br
cf-ray: 95aa831d8b4a56a8-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

GET telegahps.hair/compatTest.js

172.67.219.152

200 OK

2.5 kB

URL GET HTTPS

telegahps.hair/compatTest.js

IP / ASN

172.67.219.152

#13335 CLOUDFLARENET

Requested byhttps://telegahps.hair/

Resource Info

File typeJavaScript source, ASCII text, with very long lines (413)

First Seen2024-06-30

Last Seen2025-08-05

Times Seen11531

Size2.5 kB (2544 bytes)

MD5da7800ea928a021f2539ab41e6f2323e

SHA10141da1dc85ca8f34212f3dde2fac9bf61f5adb7

SHA25615c24ec2b4cb94f24e66750f09e7071e5659e20a5ed926f69f565e20a81027cf

Certificate Info

IssuerGoogle Trust Services

Subjecttelegahps.hair

Fingerprint92:BB:60:4B:8C:36:E9:C3:84:D4:6E:94:20:7F:E5:7A:4D:63:88:5D

ValidityThu, 26 Jun 2025 09:47:17 GMT - Wed, 24 Sep 2025 10:46:05 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /compatTest.js HTTP/1.1
Host: telegahps.hair
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://telegahps.hair/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sat, 05 Jul 2025 23:06:19 GMT
content-type: application/javascript
server: cloudflare
last-modified: Thu, 13 Mar 2025 12:49:56 GMT
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
vary: Accept-Encoding
etag: W/"67d2d474-9f0"
content-encoding: gzip
cache-control: max-age=14400
cf-cache-status: MISS
strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
speculation-rules: "/cdn-cgi/speculation"
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=UZ143tv5y4dUoyo3Kp01iFUxZY%2Ba2VZGDU295KkjOfghHbrsCK8a2BHtfl2b4JDD7d%2Bld86pJmewPWgEDll0tSE1xucPmn7vHCCrpA%3D%3D"}]}
cf-ray: 95aa831d8b5356a8-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

GET telegahps.hair/5905.db5d2749ecb90aaf2752.js

172.67.219.152

200 OK

140 kB

URL GET HTTPS

telegahps.hair/5905.db5d2749ecb90aaf2752.js

IP / ASN

172.67.219.152

#13335 CLOUDFLARENET

Requested byhttps://telegahps.hair/2976.4e6e9b1254ce313f06c5.js

Resource Info

File typeASCII text, with very long lines (65536), with no line terminators

First Seen2024-12-10

Last Seen2025-08-05

Times Seen10361

Size140 kB (140233 bytes)

MD5fdd268f67cf5c4f79320041e3d156e98

SHA1d66194ee702467dd19130dee59bd824990f5bc71

SHA25636e5ef6880e869bdf9ef2119932dbac7330513aefc50839cc2a6fdde7b519967

Certificate Info

IssuerGoogle Trust Services

Subjecttelegahps.hair

Fingerprint92:BB:60:4B:8C:36:E9:C3:84:D4:6E:94:20:7F:E5:7A:4D:63:88:5D

ValidityThu, 26 Jun 2025 09:47:17 GMT - Wed, 24 Sep 2025 10:46:05 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /5905.db5d2749ecb90aaf2752.js HTTP/1.1
Host: telegahps.hair
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://telegahps.hair/2976.4e6e9b1254ce313f06c5.js
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Sat, 05 Jul 2025 23:06:24 GMT
content-type: application/javascript
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=seJ7h1huQZag3fMiHqJ9lMywKZ4PhrFsrco9%2FewXb2DElNEWaWjJyKNuR9p4hMCpWjAjYL1WvswuxxptiMQBquR%2FrExJpfg6ENNjMZAR7ePRwjIOdAIfh0kGnh6cwS4AGQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
last-modified: Thu, 13 Mar 2025 12:49:56 GMT
vary: Accept-Encoding
etag: W/"67d2d474-223c9"
content-encoding: gzip
cache-control: max-age=14400
cf-cache-status: MISS
cf-ray: 95aa833baf7f5687-OSL
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; preload
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2041&min_rtt=284&rtt_var=1941&sent=192&recv=128&lost=0&retrans=0&sent_bytes=124631&recv_bytes=11117&delivery_rate=14348702&ss_exit_cwnd=0&ss_exit_reason=0&cwnd=30350&unsent_bytes=0&cid=1e214d4c448e1b3d&ts=5466&inflight_dur=78&x=40"

GET telegahps.hair/rlottie-wasm.f013598f1b2ba719f25e.js

172.67.219.152

200 OK

66 kB

URL GET HTTPS

telegahps.hair/rlottie-wasm.f013598f1b2ba719f25e.js

IP / ASN

172.67.219.152

#13335 CLOUDFLARENET

Requested byhttps://telegahps.hair/2976.4e6e9b1254ce313f06c5.js

Resource Info

File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators

First Seen2024-05-16

Last Seen2025-08-05

Times Seen11636

Size66 kB (65591 bytes)

MD54441938ee433d3657c20d454d352a336

SHA1dd67121d7fda7c17be196f60c72dfa06bcb5bc6f

SHA256659bf63501a8054ef0eedda3dec466dbc1e9a1b2c4d5d59a285b005215e16679

Certificate Info

IssuerGoogle Trust Services

Subjecttelegahps.hair

Fingerprint92:BB:60:4B:8C:36:E9:C3:84:D4:6E:94:20:7F:E5:7A:4D:63:88:5D

ValidityThu, 26 Jun 2025 09:47:17 GMT - Wed, 24 Sep 2025 10:46:05 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /rlottie-wasm.f013598f1b2ba719f25e.js HTTP/1.1
Host: telegahps.hair
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://telegahps.hair/2976.4e6e9b1254ce313f06c5.js
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Sat, 05 Jul 2025 23:06:25 GMT
content-type: application/javascript
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Fmn3LQV3tj%2Bu%2FJdYUKDJRJZJukgAcqDXGEjahg1rs%2Fg1dPrQ%2FPe1hjHjG1%2BwqEHHkD%2BT5xJ00VZt4KO9LaxOKsBVn564lJhFHTHFjUXJISMSVDlYjoxDCBUTobvlH5c6Bw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
last-modified: Thu, 13 Mar 2025 12:49:57 GMT
vary: Accept-Encoding
etag: "67d2d475-10037"
content-encoding: gzip
age: 0
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 95aa833f9f9a5687-OSL
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; preload
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=1166&min_rtt=284&rtt_var=507&sent=340&recv=144&lost=0&retrans=0&sent_bytes=307603&recv_bytes=13071&delivery_rate=34398754&ss_exit_cwnd=0&ss_exit_reason=0&cwnd=30350&unsent_bytes=0&cid=1e214d4c448e1b3d&ts=6486&inflight_dur=91&x=40"

GET telegahps.hair/main.d54bfa037348b154a941.js

172.67.219.152

200 OK

296 kB

URL GET HTTPS

telegahps.hair/main.d54bfa037348b154a941.js

IP / ASN

172.67.219.152

#13335 CLOUDFLARENET

Requested byhttps://telegahps.hair/

Resource Info

File typeJavaScript source, Unicode text, UTF-8 text, with very long lines (65529), with no line terminators

First Seen2024-12-10

Last Seen2025-08-05

Times Seen8408

Size296 kB (296503 bytes)

MD5a04bc08436674f0eba06d5c190dc6fe5

SHA13d0a8dbececd918da43706976766e246262d254d

SHA2564c70083f389a2fafc6a5f3c35179243623b4416cab07a1c6ce08d3f7c1ddb2ae

Certificate Info

IssuerGoogle Trust Services

Subjecttelegahps.hair

Fingerprint92:BB:60:4B:8C:36:E9:C3:84:D4:6E:94:20:7F:E5:7A:4D:63:88:5D

ValidityThu, 26 Jun 2025 09:47:17 GMT - Wed, 24 Sep 2025 10:46:05 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /main.d54bfa037348b154a941.js HTTP/1.1
Host: telegahps.hair
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://telegahps.hair/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sat, 05 Jul 2025 23:06:19 GMT
content-type: application/javascript
server: cloudflare
last-modified: Thu, 13 Mar 2025 12:49:57 GMT
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
vary: Accept-Encoding
etag: "67d2d475-48637"
content-encoding: gzip
cache-control: max-age=14400
cf-cache-status: REVALIDATED
strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
speculation-rules: "/cdn-cgi/speculation"
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=ZgLUrrI3OVxFwSxifFoJJqAS5wlZDMMRHm%2Bppzm94D5019oRQ7tNb6tKtFYWCySx9bLscBqdqXbBcXPxDJSVhOnFsGuw8fxCj0UKJw%3D%3D"}]}
cf-ray: 95aa831d8b4c56a8-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

GET telegahps.hair/notification.mp3

172.67.219.152

206 Partial Content

11 kB

URL GET HTTPS

telegahps.hair/notification.mp3

IP / ASN

172.67.219.152

#13335 CLOUDFLARENET

Requested byhttps://telegahps.hair/

Resource Info

File typeAudio file with ID3 version 2.3.0, contains: MPEG ADTS, layer III, v1, 128 kbps, 44.1 kHz, JntStereo

First Seen2023-05-16

Last Seen2025-08-05

Times Seen12988

Size11 kB (10880 bytes)

MD5eba09b6a457792c52fc610b5f9f974b3

SHA195e6e0f7648e28ea21bc434054ea59aba3a35aea

SHA25686093551f5a7f68c7dcac947bd8dc54c6a79dd9a5d83f7e40116d640eb28c7d6

Certificate Info

IssuerGoogle Trust Services

Subjecttelegahps.hair

Fingerprint92:BB:60:4B:8C:36:E9:C3:84:D4:6E:94:20:7F:E5:7A:4D:63:88:5D

ValidityThu, 26 Jun 2025 09:47:17 GMT - Wed, 24 Sep 2025 10:46:05 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /notification.mp3 HTTP/1.1
Host: telegahps.hair
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: audio/webm,audio/ogg,audio/wav,audio/*;q=0.9,application/ogg;q=0.7,video/*;q=0.6,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Range: bytes=0-
DNT: 1
Connection: keep-alive
Referer: https://telegahps.hair/
Sec-Fetch-Dest: audio
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Accept-Encoding: identity
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 206 Partial Content
date: Sat, 05 Jul 2025 23:06:20 GMT
content-type: audio/mpeg
content-length: 10880
vary: Accept-Encoding
last-modified: Thu, 13 Mar 2025 12:49:57 GMT
etag: "67d2d475-2a80"
accept-ranges: bytes
content-range: bytes 0-10879/10880
cache-control: max-age=14400
cf-cache-status: REVALIDATED
cf-ray: 95aa83215e645687-OSL
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8yItJjKqR2Z8PyUOuzROrL08MKnmOj8vXgh7xFIRPB7mJsENKaw%2FfpqSWDhgcq0WoR%2BHHg7kdDUmtObyyEJo6pHjzn4liYhIoJr6QwOCBhjL%2BxXHzVM9ywa669R%2BxwwKVw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=5729&min_rtt=284&rtt_var=8498&sent=97&recv=104&lost=0&retrans=0&sent_bytes=24836&recv_bytes=6967&delivery_rate=3333761&ss_exit_cwnd=0&ss_exit_reason=0&cwnd=30350&unsent_bytes=0&cid=1e214d4c448e1b3d&ts=1271&inflight_dur=51&x=40"

GET telegahps.hair/7784.df07a876b22e3b2a83e9.js

172.67.219.152

200 OK

22 kB

URL GET HTTPS

telegahps.hair/7784.df07a876b22e3b2a83e9.js

IP / ASN

172.67.219.152

#13335 CLOUDFLARENET

Requested byhttps://telegahps.hair/2976.4e6e9b1254ce313f06c5.js

Resource Info

File typeJavaScript source, ASCII text, with very long lines (21340)

First Seen2024-12-12

Last Seen2025-08-05

Times Seen10330

Size22 kB (21477 bytes)

MD5a0980d43cea486530c30f9f5e1c1b5e4

SHA1deec93f70f8b813b479137075afa6a0a3a25b8bd

SHA2564b5eeb1400e5118a1aff286d9a6cf893bd7c08fc8247c62116238ea587890e9e

Certificate Info

IssuerGoogle Trust Services

Subjecttelegahps.hair

Fingerprint92:BB:60:4B:8C:36:E9:C3:84:D4:6E:94:20:7F:E5:7A:4D:63:88:5D

ValidityThu, 26 Jun 2025 09:47:17 GMT - Wed, 24 Sep 2025 10:46:05 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /7784.df07a876b22e3b2a83e9.js HTTP/1.1
Host: telegahps.hair
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://telegahps.hair/2976.4e6e9b1254ce313f06c5.js
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Sat, 05 Jul 2025 23:06:24 GMT
content-type: application/javascript
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=g1%2B7siZUjlpWZODVa6llxXm88EZ6o3MFhzBen2VsuvRl6BfTINehBdQeMpR901%2BkRTqKx3yEW9IeOfQvoKuUqYg%2BRE6TjvudkCa76FsVHoUWQuLnByT1CzLdnzzelj9ULQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
last-modified: Thu, 13 Mar 2025 12:49:56 GMT
vary: Accept-Encoding
etag: "67d2d474-53e5"
content-encoding: gzip
age: 0
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 95aa833b6f7d5687-OSL
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; preload
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2269&min_rtt=284&rtt_var=2819&sent=163&recv=123&lost=0&retrans=0&sent_bytes=91439&recv_bytes=10163&delivery_rate=9244524&ss_exit_cwnd=0&ss_exit_reason=0&cwnd=30350&unsent_bytes=0&cid=1e214d4c448e1b3d&ts=5438&inflight_dur=74&x=40"

GET telegahps.hair/rlottie-wasm.f013598f1b2ba719f25e.js

172.67.219.152

200 OK

66 kB

URL GET HTTPS

telegahps.hair/rlottie-wasm.f013598f1b2ba719f25e.js

IP / ASN

172.67.219.152

#13335 CLOUDFLARENET

Requested byhttps://telegahps.hair/2976.4e6e9b1254ce313f06c5.js

Resource Info

File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators

First Seen2024-05-16

Last Seen2025-08-05

Times Seen11636

Size66 kB (65591 bytes)

MD54441938ee433d3657c20d454d352a336

SHA1dd67121d7fda7c17be196f60c72dfa06bcb5bc6f

SHA256659bf63501a8054ef0eedda3dec466dbc1e9a1b2c4d5d59a285b005215e16679

Certificate Info

IssuerGoogle Trust Services

Subjecttelegahps.hair

Fingerprint92:BB:60:4B:8C:36:E9:C3:84:D4:6E:94:20:7F:E5:7A:4D:63:88:5D

ValidityThu, 26 Jun 2025 09:47:17 GMT - Wed, 24 Sep 2025 10:46:05 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /rlottie-wasm.f013598f1b2ba719f25e.js HTTP/1.1
Host: telegahps.hair
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://telegahps.hair/2976.4e6e9b1254ce313f06c5.js
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Sat, 05 Jul 2025 23:06:25 GMT
content-type: application/javascript
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ra6q1hd3S8IhXqtIDCruMMIuzo5WtwIiWlFtVy6MrwQ4U4HvrrpywrVyYRDXXQOGFhcuh6DBme93WWGZikUM%2B1w0c3Cqp4MHn0SvUMf4bFPQDh2M%2BfNAcY05185yec3AkA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
last-modified: Thu, 13 Mar 2025 12:49:57 GMT
vary: Accept-Encoding
etag: "67d2d475-10037"
content-encoding: gzip
age: 0
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 95aa833f9f975687-OSL
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; preload
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=1166&min_rtt=284&rtt_var=507&sent=323&recv=144&lost=0&retrans=0&sent_bytes=284238&recv_bytes=13071&delivery_rate=34398754&ss_exit_cwnd=0&ss_exit_reason=0&cwnd=30350&unsent_bytes=0&cid=1e214d4c448e1b3d&ts=6485&inflight_dur=91&x=40"

GET telegahps.hair/8673.1b6dd8d303b0535cc1f8.js

172.67.219.152

200 OK

11 kB

URL GET HTTPS

telegahps.hair/8673.1b6dd8d303b0535cc1f8.js

IP / ASN

172.67.219.152

#13335 CLOUDFLARENET

Requested byhttps://telegahps.hair/

Resource Info

File typeJavaScript source, ASCII text, with very long lines (10642)

First Seen2024-12-10

Last Seen2025-08-05

Times Seen10534

Size11 kB (10696 bytes)

MD5ea8d5208dada45e8d0844877a7c93db6

SHA145d98fbe3dae09a988cccd836d39016c5100f313

SHA25625f447387cefb643c04e0aa816e21edf562ebe9b7e3f7b808bdb179154fc17b8

Certificate Info

IssuerGoogle Trust Services

Subjecttelegahps.hair

Fingerprint92:BB:60:4B:8C:36:E9:C3:84:D4:6E:94:20:7F:E5:7A:4D:63:88:5D

ValidityThu, 26 Jun 2025 09:47:17 GMT - Wed, 24 Sep 2025 10:46:05 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /8673.1b6dd8d303b0535cc1f8.js HTTP/1.1
Host: telegahps.hair
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://telegahps.hair/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Sat, 05 Jul 2025 23:06:23 GMT
content-type: application/javascript
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YPz8986uF62NuDyzimtt8TlJuv25sdYP4epr6WPKh9KaAUarZfu6wGpkkY%2BDSNt40GP80IKqsNI%2BQKYWL6hH8kxdF9lBr%2F8lVp2YbzxkZMhW5ekdP84J2HiZ3tkhJntHeQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
last-modified: Thu, 13 Mar 2025 12:49:56 GMT
vary: Accept-Encoding
etag: "67d2d474-29c8"
content-encoding: gzip
cache-control: max-age=14400
cf-cache-status: REVALIDATED
cf-ray: 95aa8333df0c5687-OSL
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; preload
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3637&min_rtt=284&rtt_var=5413&sent=110&recv=109&lost=0&retrans=0&sent_bytes=38087&recv_bytes=7406&delivery_rate=3333761&ss_exit_cwnd=0&ss_exit_reason=0&cwnd=30350&unsent_bytes=0&cid=1e214d4c448e1b3d&ts=4188&inflight_dur=66&x=40"

GET telegahps.hair/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.465390c6e54c60f4a15f.woff2

172.67.219.152

200 OK

11 kB

URL GET HTTPS

telegahps.hair/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.465390c6e54c60f4a15f.woff2

IP / ASN

172.67.219.152

#13335 CLOUDFLARENET

Requested byhttps://telegahps.hair/

Resource Info

File typeWeb Open Font Format (Version 2), TrueType, length 11016, version 1.0

First Seen2023-04-05

Last Seen2025-08-05

Times Seen26907

Size11 kB (11016 bytes)

MD515fa3062f8929bd3b05fdca5259db412

SHA16ff06a34f68ad0324ddec1bbe4d453c959178b36

SHA2565d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479

Certificate Info

IssuerGoogle Trust Services

Subjecttelegahps.hair

Fingerprint92:BB:60:4B:8C:36:E9:C3:84:D4:6E:94:20:7F:E5:7A:4D:63:88:5D

ValidityThu, 26 Jun 2025 09:47:17 GMT - Wed, 24 Sep 2025 10:46:05 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /KFOmCnqEu92Fr1Mu4mxKKTU1Kg.465390c6e54c60f4a15f.woff2 HTTP/1.1
Host: telegahps.hair
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://telegahps.hair/main.949acaf34f3882f511ff.css
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Sat, 05 Jul 2025 23:06:20 GMT
content-type: font/woff2
content-length: 11016
vary: Accept-Encoding
last-modified: Thu, 13 Mar 2025 12:49:56 GMT
etag: "67d2d474-2b08"
accept-ranges: bytes
cache-control: max-age=14400
cf-cache-status: MISS
cf-ray: 95aa83212e4e5687-OSL
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nqyYd1EVdp2BYIzMf5iJMe%2Ffu6gF3XnPAehd6jdu0%2FhTHg6eUi52zIX%2BqfJxbNbCe%2BhwWyPLGJYu7rGOenb%2B6QVnWEEFS2%2FK51WkVtiG8UIebNInYGZiZdj4%2FbkIYxhbXQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=9502&min_rtt=536&rtt_var=11238&sent=88&recv=100&lost=0&retrans=0&sent_bytes=12854&recv_bytes=6791&delivery_rate=1202221&ss_exit_cwnd=0&ss_exit_reason=0&cwnd=21950&unsent_bytes=0&cid=1e214d4c448e1b3d&ts=1257&inflight_dur=48&x=40"

GET telegahps.hair/2976.4e6e9b1254ce313f06c5.js

172.67.219.152

200 OK

14 kB

URL GET HTTPS

telegahps.hair/2976.4e6e9b1254ce313f06c5.js

IP / ASN

172.67.219.152

#13335 CLOUDFLARENET

Requested byhttps://telegahps.hair/

Resource Info

File typeJavaScript source, ASCII text, with very long lines (14402)

First Seen2024-12-10

Last Seen2025-08-05

Times Seen8017

Size14 kB (14456 bytes)

MD56471dbad18ad444906e7a2bbac930e90

SHA12c1f84caf20c633205f7535b129ae069187ef14d

SHA2561fce51354cfb15e01d900a86d9806d476a4ceb7fd409a5f2744e8bb81fab56e8

Certificate Info

IssuerGoogle Trust Services

Subjecttelegahps.hair

Fingerprint92:BB:60:4B:8C:36:E9:C3:84:D4:6E:94:20:7F:E5:7A:4D:63:88:5D

ValidityThu, 26 Jun 2025 09:47:17 GMT - Wed, 24 Sep 2025 10:46:05 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /2976.4e6e9b1254ce313f06c5.js HTTP/1.1
Host: telegahps.hair
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://telegahps.hair/
Sec-Fetch-Dest: worker
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Sat, 05 Jul 2025 23:06:23 GMT
content-type: application/javascript
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v0uNvmvvxOro2fFqx5Rd6euEQREq4gIl%2BWzWYAe5zCwvkjyIPVlK4JIW13Tl%2Fr15hGhtSFrEj8ObLcGs4c%2FMfENsSTh3PH0dYBKZ1%2FDnxgKCiwGftCqOJPmxT3SKsZ8E%2BA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
last-modified: Thu, 13 Mar 2025 12:49:56 GMT
vary: Accept-Encoding
etag: "67d2d474-3878"
content-encoding: gzip
age: 0
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 95aa83366f455687-OSL
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; preload
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2712&min_rtt=284&rtt_var=3651&sent=125&recv=117&lost=0&retrans=0&sent_bytes=50515&recv_bytes=8920&delivery_rate=9244524&ss_exit_cwnd=0&ss_exit_reason=0&cwnd=30350&unsent_bytes=0&cid=1e214d4c448e1b3d&ts=5000&inflight_dur=70&x=40"

GET telegahps.hair/2976.4e6e9b1254ce313f06c5.js

172.67.219.152

200 OK

14 kB

URL GET HTTPS

telegahps.hair/2976.4e6e9b1254ce313f06c5.js

IP / ASN

172.67.219.152

#13335 CLOUDFLARENET

Requested byhttps://telegahps.hair/

Resource Info

File typeJavaScript source, ASCII text, with very long lines (14402)

First Seen2024-12-10

Last Seen2025-08-05

Times Seen8017

Size14 kB (14456 bytes)

MD56471dbad18ad444906e7a2bbac930e90

SHA12c1f84caf20c633205f7535b129ae069187ef14d

SHA2561fce51354cfb15e01d900a86d9806d476a4ceb7fd409a5f2744e8bb81fab56e8

Certificate Info

IssuerGoogle Trust Services

Subjecttelegahps.hair

Fingerprint92:BB:60:4B:8C:36:E9:C3:84:D4:6E:94:20:7F:E5:7A:4D:63:88:5D

ValidityThu, 26 Jun 2025 09:47:17 GMT - Wed, 24 Sep 2025 10:46:05 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /2976.4e6e9b1254ce313f06c5.js HTTP/1.1
Host: telegahps.hair
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://telegahps.hair/
Sec-Fetch-Dest: worker
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Sat, 05 Jul 2025 23:06:23 GMT
content-type: application/javascript
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TjkVbhZ2mA1sF9dYXqU6%2FXKA20%2BMq75wNMStNq%2B9JEQOvu5enfODCCJyB0nRIRU2n2qsMpcZGTmTBCIeG3SsFP6ZPbeHo5kjWbiX6EmxqFfYooHQMo946LZ4L6y%2B%2F%2F5VXA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
last-modified: Thu, 13 Mar 2025 12:49:56 GMT
vary: Accept-Encoding
etag: "67d2d474-3878"
content-encoding: gzip
cache-control: max-age=14400
cf-cache-status: REVALIDATED
cf-ray: 95aa83366f465687-OSL
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; preload
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2712&min_rtt=284&rtt_var=3651&sent=131&recv=117&lost=0&retrans=0&sent_bytes=58016&recv_bytes=8920&delivery_rate=9244524&ss_exit_cwnd=0&ss_exit_reason=0&cwnd=30350&unsent_bytes=0&cid=1e214d4c448e1b3d&ts=5000&inflight_dur=70&x=40"

GET telegahps.hair/7784.df07a876b22e3b2a83e9.js

172.67.219.152

200 OK

22 kB

URL GET HTTPS

telegahps.hair/7784.df07a876b22e3b2a83e9.js

IP / ASN

172.67.219.152

#13335 CLOUDFLARENET

Requested byhttps://telegahps.hair/2976.4e6e9b1254ce313f06c5.js

Resource Info

File typeJavaScript source, ASCII text, with very long lines (21340)

First Seen2024-12-12

Last Seen2025-08-05

Times Seen10330

Size22 kB (21477 bytes)

MD5a0980d43cea486530c30f9f5e1c1b5e4

SHA1deec93f70f8b813b479137075afa6a0a3a25b8bd

SHA2564b5eeb1400e5118a1aff286d9a6cf893bd7c08fc8247c62116238ea587890e9e

Certificate Info

IssuerGoogle Trust Services

Subjecttelegahps.hair

Fingerprint92:BB:60:4B:8C:36:E9:C3:84:D4:6E:94:20:7F:E5:7A:4D:63:88:5D

ValidityThu, 26 Jun 2025 09:47:17 GMT - Wed, 24 Sep 2025 10:46:05 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /7784.df07a876b22e3b2a83e9.js HTTP/1.1
Host: telegahps.hair
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://telegahps.hair/2976.4e6e9b1254ce313f06c5.js
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Sat, 05 Jul 2025 23:06:23 GMT
content-type: application/javascript
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nbPbebrkHMtlRtBmbgOgpMD35TFluhj77hK8U15WMXjXH37jh4aBdsD0uGwCo4e1Hs2HgfSuVweFSc3%2BKLp44PuncCTGWAecVHToiaSE1DWwdMFrCcF0GmmUYiN2bg9OyQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
last-modified: Thu, 13 Mar 2025 12:49:56 GMT
vary: Accept-Encoding
etag: "67d2d474-53e5"
content-encoding: gzip
cache-control: max-age=14400
cf-cache-status: REVALIDATED
cf-ray: 95aa83390f6f5687-OSL
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; preload
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2470&min_rtt=284&rtt_var=3222&sent=147&recv=121&lost=0&retrans=0&sent_bytes=73125&recv_bytes=9831&delivery_rate=9244524&ss_exit_cwnd=0&ss_exit_reason=0&cwnd=30350&unsent_bytes=0&cid=1e214d4c448e1b3d&ts=5045&inflight_dur=72&x=40"

GET telegahps.hair/7784.df07a876b22e3b2a83e9.js

172.67.219.152

200 OK

22 kB

URL GET HTTPS

telegahps.hair/7784.df07a876b22e3b2a83e9.js

IP / ASN

172.67.219.152

#13335 CLOUDFLARENET

Requested byhttps://telegahps.hair/2976.4e6e9b1254ce313f06c5.js

Resource Info

File typeJavaScript source, ASCII text, with very long lines (21340)

First Seen2024-12-12

Last Seen2025-08-05

Times Seen10330

Size22 kB (21477 bytes)

MD5a0980d43cea486530c30f9f5e1c1b5e4

SHA1deec93f70f8b813b479137075afa6a0a3a25b8bd

SHA2564b5eeb1400e5118a1aff286d9a6cf893bd7c08fc8247c62116238ea587890e9e

Certificate Info

IssuerGoogle Trust Services

Subjecttelegahps.hair

Fingerprint92:BB:60:4B:8C:36:E9:C3:84:D4:6E:94:20:7F:E5:7A:4D:63:88:5D

ValidityThu, 26 Jun 2025 09:47:17 GMT - Wed, 24 Sep 2025 10:46:05 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /7784.df07a876b22e3b2a83e9.js HTTP/1.1
Host: telegahps.hair
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://telegahps.hair/2976.4e6e9b1254ce313f06c5.js
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Sat, 05 Jul 2025 23:06:24 GMT
content-type: application/javascript
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oVN6%2FXx%2FtQvW31X9tS6jRzybTkFEnAbu%2B9J2gwfv1OBNk81Ak%2FAagE74ISnn8KwnzmZWUYAGYw4nP%2BciSjMsvZMrKDixpQsJ0T2171w6W4AMuKdTKZXo8GT%2FxR0vZ2o8Fg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
last-modified: Thu, 13 Mar 2025 12:49:56 GMT
vary: Accept-Encoding
etag: "67d2d474-53e5"
content-encoding: gzip
cache-control: max-age=14400
cf-cache-status: REVALIDATED
cf-ray: 95aa833b6f7e5687-OSL
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; preload
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2269&min_rtt=284&rtt_var=2819&sent=156&recv=123&lost=0&retrans=0&sent_bytes=82303&recv_bytes=10163&delivery_rate=9244524&ss_exit_cwnd=0&ss_exit_reason=0&cwnd=30350&unsent_bytes=0&cid=1e214d4c448e1b3d&ts=5438&inflight_dur=74&x=40"