We are experiencing what appears to be an ISP-specific connectivity or TLS issue affecting our production custom domain:
The issue appears to affect users on the Yettel Bulgaria mobile network. Multiple customers report that they cannot open the website and receive errors such as “certificate is not trusted,” “hostile server,” or failure to establish a secure connection. The issue also occurs in Instagram’s in-app browser.
The same website works normally from other Bulgarian networks, including Vivacom home internet.
Our Vercel project is “tigre-tigre,” and the Vercel dashboard reports:
www.tigre-tigre.com — Valid Configuration — Production
The domain uses the Vercel-provided CNAME:
www.tigre-tigre.com → 847f322cf22d9aba.vercel-dns-017.com
From a Vivacom connection, we successfully tested both Vercel edge IPs directly using SNI:
216.198.79.1 64.29.17.1
Both tests completed successfully with TLS 1.3, the correct Let’s Encrypt certificate for www.tigre-tigre.com, successful certificate verification, and HTTP 200 responses.
SSL Labs has intermittently reported “Unexpected failure” when testing the Vercel endpoints, although it successfully reads the correct and trusted certificate chain.
This appears to be network-dependent and may involve BGP/anycast routing, reachability, TLS handling, IPv6, or a specific Vercel edge path used by Yettel Bulgaria.
Could you please investigate:
- Routing and reachability from Yettel Bulgaria to the Vercel IP ranges containing 216.198.79.1 and 64.29.17.1.
- Whether Yettel traffic is reaching a different Vercel PoP or edge than Vivacom traffic.
- TLS handshake and certificate delivery for www.tigre-tigre.com from Bulgarian mobile networks.
- IPv4 and IPv6 routing for this domain.
- Whether there are known reachability issues involving these newer Vercel IP ranges.
This is affecting paid advertising traffic and preventing customers from accessing our store.