⌘K
Ciadamodavrb 4295 Update on 20 Oct 2026: the same DETRAN-ES phishing is still being deployed on vercel.app, now with new project names. Seen today (the names are in code format on purpose, the pages are live): - `cfcconde.vercel.app` : a driving-school facade whose first lines run location.href to the next one. - `portais-onlines-veiculares-esp.vercel.app` : the fake "Servicos DETRAN-ES Veiculos" page with a plate + Renavam form. Reported on 19 Oct, still online. Its response headers include X-Render-Origin-Server: Render. - `autoescolaauecfc.vercel.app` : a 233-byte page that is only a script redirecting to a gate on another domain. Reports so far: the public abuse form (TNS_01CpK5ull2PyvRp9 on 19 Oct and a new one today) and Pro support cases CSE_01zLc3pGwxWAVDes (closed on 19 Oct with a message that the details were handed to the abuse team) and CSE_01LwnZVYhe3Xxpum (open today). The operator recreates the same pair of projects every few days, so each takedown lasts only until the next deploy. Could someone from Trust & Safety suspend the accounts behind these projects, not only the deployments? Thank you.
Amy Egan I'm checking with the abuse investigation team now. Thanks for sharing the case numbers
Ciadamodavrb 4295 Update for Amy and the abuse team, 23 Oct 2026 (measured 13:43 UTC). The names are in code format on purpose; the pages are live. New lure: `autoescolasuperjcv.vercel.app` - a 233-byte page (changed today at 13:37 GMT) that is only a script redirecting to the same fixed gate on another domain as `autoescolaauecfc`. It is the display URL of a paid Google ad titled "DETRAN es". Abuse form: `TNS_01YZkayyoAolPwVX`. New Pro support case: `CSE_0144xLOaa2Seugll` (open). Lure takedowns work: `autoescolaideialfilial` and `autoescolareal` (reported 22 Oct) fail the TLS handshake today. The two kit projects are still online: First kit: `pl-index-online-es.vercel.app`, reported 22 Oct (`TNS_01z8muWcbINxgdb6`); the fake "Servicos DETRAN-ES Veiculos" page with a plate + Renavam form; answers 200, 13,405 bytes; header X-Render-Origin-Server: Render. Second kit: `agencia-veiculares-consulta-es.vercel.app`, reported 21 Oct (`TNS_01K93G02CiRBsmjg`); same page, 13,306 bytes, 200 today. The operator adds a new lure every day (autoescolaauecfc 20 Oct, autoescolasaojose 21 Oct, autoescolaideialfilial and autoescolareal 22 Oct, autoescolasuperjcv 23 Oct), so removing only the lures does not stop it. Could someone confirm that the accounts behind the two kit projects are being reviewed? Thank you.
joshsoup looking into this now. could you try and running that in a new chat and see if the `authorize_team_access` tool works?
TMDZN I'm experiencing the same ChatGPT–Vercel MCP integration issue. **Confirmed diagnostics:** - My connected Vercel account is the Owner of the affected team. - The team and its projects are accessible in the Vercel dashboard. - Team-scoped API requests return `403 Forbidden`. - Unscoped `list_projects`, `get_project`, and deployment-list requests succeed. - `list_teams` returns an empty array. - SAML and SSO enforcement are both false. - The error explicitly recommends `authorize_team_access`, but neither `authorize_team_access` nor `authorize_team_sso` is exposed in the ChatGPT connector. **Could Vercel investigate why team-scoped authorization fails while unscoped access works, and provide the missing team authorization flow?** I can provide the team ID and request details privately if needed.
Mr Robot 655 btw is deploying a minecraft bot against policy?
Amy Egan Thanks for sharing the project name. I think that's actually be why you're getting an error on the build. VCR's push path doesn't want to accept the project slug with an underscore. Can you try removing the underscore or replacing it with a dash and let me know if that makes a difference?
Mr Robot 655 Thank you Amy Egan, Thank you so much for the help! I changed the project name to use a dash instead of an underscore, and it worked! The daemon deployed successfully and my Minecraft bot is finally running. 😭🙏 Really appreciate you taking the time to look into this and point me in the right direction. I did not expect a reply but vercel actually reached out and would recommend vercel to others as well.
Drahmadadelawad Update on the same TEST deployment: We have now confirmed through the authenticated Vercel dashboard and store metadata that its connected private Blob store is suspended with `usageQuotaExceeded: true` and status `limits-exceeded-suspended`. The displayed Sep 22–Oct 22 usage window shows 2,968 / 2,000 Blob Advanced Operations. The dashboard describes this as usage across Blob stores; we are not attributing all operations to this deployment. This is Vercel Blob usage, not Firebase quota. We are evaluating an ownership-verification-only approach: one project routing rule matching the exact original deployment hostname and the exact Google-provided HTML verification filename, serving an owner-controlled public static verification file through a rewrite. Application paths, the existing deployment build, deployment protection and the primary Stable TEST alias would be preserved. Is this officially supported for that existing generated deployment URL? With Blob currently suspended, is there an approved no-cost verification-file path or another official ownership/diagnostic option that preserves those constraints? No private store was made public, no second store was created to bypass limits, no paid plan or trial was enabled, and no routing change or deployment has been made. The application remains on hold while the Google warning is unresolved. No additional Google report has been submitted.
Amy Egan Google offers multiple ownership verification options through simple site additions that do not require DNS changes. You can use whichever of them makes sense for your educational test deployment. Vercel does not control Google's website ownership verification process. https://support.google.com/webmasters/answer/9008080?hl=en
