[▲ Vercel Community](/) · [Categories](/categories) · [Latest](/latest) · [Top](/top) · [Events](/events) · [Live](/live)

[Help](/c/help/9)

# 5 identical DETRAN-ES phishing kits still live on [verel.app](https://verel.app) - reported since Sep 15

0 views · 0 likes · 3 posts


Ciadamodavrb 4295 (@ciadamodavrb-4295) · 2026-09-19

Since September 15, 2026 I have reported through Vercel's official abuse form ([vercel.com/abuse](https://vercel.com/abuse)), with screenshots, five [vercel.app](https://vercel.app) deployments that serve the same phishing kit impersonating DETRAN-ES, the motor-vehicle authority of the Brazilian state of Espirito Santo (official site: [detran.es.gov.br](https://detran.es.gov.br)). The kit collects citizens' vehicle plate and RENAVAM numbers and shows fake vehicle-tax debts to be paid by PIX. Victims reach it through paid Google ads.

Deployments (all still online on September 19, 2026):
- `zoks-online-es.vercel.app` (reported Sep 15)
- `departamento-ve-es.vercel.app` (reported Sep 18)
- `agencia-debitante-es-buy.vercel.app` (reported Sep 18)
- `agencia-estadual-es-mx.vercel.app` (reported Sep 19)
- `cb-agencia-es.vercel.app` (reported Sep 19)

Other providers used in the same scheme (Cloudflare, Netlify, Weebly, Unbounce) removed their parts within hours. Vercel has not acted and its confirmation emails come from a no-reply address, so there is no way to follow up.

Desired resolution: Vercel's Trust & Safety team reviews these reports, removes the five deployments, suspends the account behind them, and provides a working contact for follow-up on abuse reports.


Ciadamodavrb 4295 (@ciadamodavrb-4295) · 2026-10-20

Update on 20 Oct 2026: the same DETRAN-ES phishing is still being deployed on [vercel.app](https://vercel.app), now with new project names. Seen today (the names are in code format on purpose, the pages are live):

- `cfcconde.vercel.app` : a driving-school facade whose first lines run location.href to the next one.
- `portais-onlines-veiculares-esp.vercel.app` : the fake "Servicos DETRAN-ES Veiculos" page with a plate + Renavam form. Reported on 19 Oct, still online. Its response headers include X-Render-Origin-Server: Render.
- `autoescolaauecfc.vercel.app` : a 233-byte page that is only a script redirecting to a gate on another domain.

Reports so far: the public abuse form (TNS_01CpK5ull2PyvRp9 on 19 Oct and a new one today) and Pro support cases CSE_01zLc3pGwxWAVDes (closed on 19 Oct with a message that the details were handed to the abuse team) and CSE_01LwnZVYhe3Xxpum (open today). The operator recreates the same pair of projects every few days, so each takedown lasts only until the next deploy. Could someone from Trust & Safety suspend the accounts behind these projects, not only the deployments? Thank you.


Amy Egan (@amyegan) · 2026-10-21

I'm checking with the abuse investigation team now. Thanks for sharing the case numbers