Hey there! Sharing in case this helps your team investigate and alert other users.

I’ve received eight phishing emails impersonating Vercel between September 8 and 17 and wanted to flag them for investigation and community awareness.

There are two versions:

• September 8–9: Claim an automatic renewal payment failed and ask me to update my payment details to avoid suspension.
• September 17: Include the targeted domain in the email body, claim it expires that day, and ask for a renewal payment.It appears the the emails are changing their design to try to match Vercel's colours more.

Both use “Vercel” as the sender’s display name, but come from contact@financialservicesrecruitment.com or postmasters@lagemmanetro.it. Their payment buttons link to unrelated domains: custommanager.mishasamarsky[.]ru and manger-customer.aimodelka[.]online.

The headers report SPF, DKIM, and DMARC passes for those sending domains, which do not establish any connection to Vercel. The recipient or recipient's email-service identifiers have been removed. Feel free to reach out to me directly in case you need the headers or more info as I wasn't able to upload any other file than an image/video here.