detran-es-govbr[.]vercel[.]app

PhishDestroy identifies active brand impersonation phishing targeting Brazil's Departamento Estadual de Trânsito do Espírito Santo (DETRAN-ES) via the deceptive domain detran-es-govbr.vercel.app. This domain leverages Vercel's hosting infrastructure to impersonate official government services, attempting to harvest sensitive user credentials under the guise of legitimacy. The campaign's sophistication lies in its abuse of legitimate cloud services (Vercel) and Google Trust Services SSL certificates, which may bypass traditional security filters that rely on domain reputation or certificate scrutiny. Initial analysis indicates this is part of a broader trend where threat actors exploit trusted cloud platforms to host spoofed government portals, particularly in regions with high digital government service adoption. This domain was flagged with a risk level of under_investigation but is assessed as HIGH due to its active status and direct impersonation of a regional government authority. Technical indicators include resolution to IP 216.198.79.67, an SSL certificate issued by Google Trust Services (commonly trusted by browsers), and 0 detections out of 95 on VirusTotal as of initial analysis. The domain is registered through Vercel Inc., a legitimate cloud platform provider, which complicates takedown efforts due to Vercel's acceptable use policies regarding impersonation. Notably, the domain does not appear on any major blocklists at the time of writing, and no trust score degradation was observed in initial scans. The combination of a deceptive naming convention (mimicking the official detran-es-gov.br domain), abuse of a reputable hosting provider, and absence of immediate detection flags suggests an elevated risk of successful credential theft among unsuspecting users. Mitigation steps for this credential theft campaign require a multi-layered approach. Users should immediately block access to detran-es-govbr.vercel.app at the network level (DNS sinkholing or firewall rules) and verify any DETRAN-ES communications directly through official channels (e.g., detran-es.gov.br). Organizations should deploy email filtering rules targeting domains with Vercel.app suffixes in government-themed lures, and implement browser security policies to flag or block sites with recently issued SSL certificates from lesser-known CAs (though Google Trust Services is trusted, its use in impersonation warrants scrutiny). Additionally, users interacting with Brazilian government services should enable multi-factor authentication (MFA) on all accounts and verify website URLs via official government portals before inputting credentials. Threat intelligence teams are advised to monitor for similar campaigns leveraging Vercel's infrastructure, as this tactic is increasingly prevalent in brand impersonation phishing.