Dear Vercel Abuse Team,

I am reporting a phishing deployment hosted on your platform:

https://autoescolaauecfc.vercel.app

https://portais-onlines-veiculares-esp.vercel.app/ https://agencia-veiculares-consulta-es.vercel.app/

The page impersonates Detran ES, the vehicle licensing authority of Espírito Santo, Brazil (official site: https://detran.es.gov.br/), to steal personal and financial data and collect fraudulent payments for vehicle tax and licensing — services only the government provides.

Traffic is acquired through paid Google Ads whose headline reads "DETRAN es", shown above the agency's own organic result. The page uses cloaking: only visitors arriving from those ads are served the fraudulent content, while direct visits, crawlers and automated security scanners receive benign content. An automated check will most likely show nothing suspicious — that is the cloaking working, not evidence that the deployment is legitimate.

Repeat abuse: another deployment of the same operation, autoescolaau.vercel.app, was reported earlier this month. The operation also runs on its own domains and on several other hosting platforms, creating a new address each time one is removed.

I request the immediate removal of this deployment and the suspension of the account behind it, with a review of its other projects. Impersonating a government agency to collect payments is a criminal offence under Brazilian law, and the operation is active.

I can provide screenshots of the ad and the page, timestamps and HTTP headers with and without an ad referrer.

Sincerely, João Silva