Phishing impersonating a Brazilian government agency hosted on vercel.app, recreated after takedowns

I am a Pro customer reporting phishing hosted on Vercel that impersonates DETRAN-ES, the vehicle authority of the Brazilian state of Espirito Santo (the only real site is www.detran.es.gov.br). It is advertised through paid Google ads titled "DETRAN es" and it asks visitors for the vehicle plate and the Renavam.

Seen on 20 Oct 2026 (these are live, please do not open them on a device you care about; the names are in code format on purpose):

cfcconde.vercel.app : new project, a driving-school facade whose first lines (before the doctype) run location.href to the next one.
portais-onlines-veiculares-esp.vercel.app : the fake "Servicos DETRAN-ES Veiculos" page with a plate + Renavam form. Reported on 19 Oct, still online. Its response headers include X-Render-Origin-Server: Render.
autoescolaauecfc.vercel.app : a 233-byte page that is only a script redirecting to a gate on another domain. On 16 Oct the same project pointed to another fake page.

What I already did: the public abuse form (report TNS_01CpK5ull2PyvRp9 on 19 Oct, and a new one today), and Pro support cases CSE_01zLc3pGwxWAVDes (closed on 19 Oct with a message that the details were handed to the abuse team) and CSE_01LwnZVYhe3Xxpum (open today). The operator recreates the same pair of projects every few days, so each takedown only lasts until the next deploy.

Could someone from Trust & Safety look at the accounts behind these projects and suspend them, not only the individual deployments? Thank you.

Thank you for bringing this to our attention. To ensure this is investigated with the necessary priority and privacy, please report all security-related concerns, potential exploits, or abuse directly to the Vercel Security Team.

Please submit your report here: vercel.com/abuse

Reporting via this official channel is the fastest way to reach our security engineers and ensures that sensitive information is handled in a secure environment rather than a public forum.

Seen on 20 Oct 2026 (these are live, please do not open them on a device you care about; the names are in code format on purpose):

cfcconde.vercel.app : new project, a driving-school facade whose first lines (before the doctype) run location.href to the next one.
portais-onlines-veiculares-esp.vercel.app : the fake "Servicos DETRAN-ES Veiculos" page with a plate + Renavam form. Reported on 19 Oct, still online. Its response headers include X-Render-Origin-Server: Render.
autoescolaauecfc.vercel.app : a 233-byte page that is only a script redirecting to a gate on another domain. On 16 Oct the same project pointed to another fake page.

Could someone from Trust & Safety look at the accounts behind these projects and suspend them, not only the individual deployments? Thank you.

Please submit your report here: vercel.com/abuse

Reporting via this official channel is the fastest way to reach our security engineers and ensures that sensitive information is handled in a secure environment rather than a public forum.