Security Report: ar24-sigma.vercel.app - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/9bfc4347-da38-41cb-b3bb-df01fb199c6b Domain and IP registration (RDAP)/api/v1/rdap/9bfc4347-da38-41cb-b3bb-df01fb199c6bHow often this domain was scanned/api/v1/domain/stats/ar24-sigma.vercel.app Scan history for this domain/api/v1/domain/history/ar24-sigma.vercel.app?limit=15

This website contacted 7 IPs in 3 countries across 5 domains to perform 10 HTTP transactions. The main domain is vercel.app and was registered 6 years ago.

Submitted URL: https://ar24-sigma.vercel.app/

AI Security Verdict

Confirmed Scam

Confidence: 96%

Risk Score

Phishing clone of AR24 hosted on a vercel.app subdomain: it impersonates the French AR24 service, harvests email/password via a login form and exfiltrates the credentials to Telegram via JS while blocking DevTools.

Risk Factors (7)

Impersonation of the AR24 brand on a domain unrelated to the brand's official domain

Credential (password) harvesting form with email field

JavaScript credential exfiltration pattern (sendToTelegram) sending email/password to an external service

Anti-analysis JavaScript blocking DevTools and right-click

Free hosting-platform subdomain (.vercel.app) with unknown creation date; page appears minutes old

Multi-source phishing threat-intelligence match on the primary domain

Cross-origin fetches to api.telegram.org, ipify.org and ipinfo.io for IP lookup / exfiltration infrastructure

Domain age information unavailable

Details

Page Title

Connexion - AR24

Scan Type

public

Domain Name Analysis

You're looking at domain 'ar24-sigma.vercel.app' on the application-focused generic top-level domain (.app) with subdomain 'ar24-sigma'. The second-level label 'vercel' is 6 characters long with two vowels and four consonants. Breaking it apart gives 2 words: ver, cel. Median word length comes out to three characters. No strong language cues emerged from the frequency lists.

Screenshot

AR24 Connexion Vous avez regu des documents sécurisés AR24 Pour des raisons de vérification, une Connexion est requise avec votre adresse e-mail de réception du message et votre mat de passe habitu...

Page Load Overview

0.51s

Total Load Time

61 KB

Total Size

Language Analysis

Primary Language

🇫🇷French

Code: fr

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:fr

Text Length:1,386 chars

Detector Agreement:100%

Website Classification

Primary Category

government public service63% confidence

Type: webapp

Method: ml+structural

All Detected Categories

government public service

63%

documentation technical

61%

download file sharing

51%

blog personal website

40%

corporate business

38%

Detected Features

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
4	64.29.17.195Aws · CLOUD	United States	AS16509Amazon.com, Inc.
1	185.183.140.161	France	AS211068AR24 SAS
1	173.231.16.77	United States	AS18450WebNX, Inc.
1	34.117.59.81Google · CDN	Kansas City, Missouri, United States	AS396982Google LLC
1	149.154.166.110	Amsterdam, North Holland, Netherlands	AS62041Telegram Messenger Inc
1	216.198.79.195Aws · CLOUD	United States	AS16509Amazon.com, Inc.
1	185.183.140.162	France	AS211068AR24 SAS
10	7	-	-