Dear Abuse Team,

I am reporting a phishing operation using cloaking, hosted on your infrastructure:

https://autoescolasinalverde.vercel.app/

These pages clone the official portal of Detran ES (https://detran.es.gov.br/), the vehicle licensing authority of Espírito Santo, Brazil. Victims are induced to enter personal data (CPF, licence plate, Renavam) and are then presented with fraudulent payment slips for vehicle licensing fees, diverting payments to the criminals.

Traffic is acquired through paid search advertising on Google Ads. The operation uses cloaking: only visitors arriving from the search terms "Detran ES" and "Licenciamento ES" are served the phishing page. Direct visitors, crawlers and automated security scanners receive benign content, which allows the scheme to evade detection. To reproduce: search "Detran ES" or "Licenciamento ES" on Google and click the sponsored result pointing to these domains. Accessing the same URLs directly does not display the fraudulent content. I request the immediate suspension of these domains for violating your Terms of Service and facilitating financial fraud against Brazilian citizens. Impersonating a government agency to collect payments is a criminal offence under Brazilian law.

I am avilable to provide screenshots, HTTP headers, timestamps and further technical evidence. Sincerely, Joao Carlettis