Evidence package — phishing deployments on *.vercel.app impersonating Privacy (privacy.com.br)

This page exists because the Vercel abuse form accepts only small image attachments, and the material below does not fit in an image. It is the referenced evidence for our abuse reports concerning fifteen deployments on Vercel infrastructure that impersonate Privacy, a Brazilian paid-content platform, and use the names and photographs of identifiable Brazilian content creators as bait to solicit paid subscriptions the operators cannot deliver.

1. Proof: serverless functions issuing Pix charges

Verified 2026-07-27 by issuing a direct HTTP POST to each route. No interaction with the page, no browser automation, no CAPTCHA involved. Every response carries server: Vercel and an x-vercel-id beginning gru1 (the São Paulo edge region); where the deployment exposes it, the x-matched-path header names the exact function route that handled the request. Every call returns a new transaction ID, so these results are reproducible by Vercel's team in under a minute.

1.1 — cr7-vert.vercel.app/api/pix — HTTP 200, valid Pix code returned

REQUEST : POST https://cr7-vert.vercel.app/api/pix
BODY    : {"amount":19.9}
STATUS  : 200
HEADERS : x-vercel-id: gru1::9tcsg-1785189822936-a78ce55ba40f

RESPONSE:
{"pix_code":"00020126870014br.gov.bcb.pix2565pix.basspago.com.br/qr/v3/at/
bb48d095-8e78-44c5-95ae-9cf970fe6df85204000053039865802BR5922NEXUS_MARKETPLACE_LTDA
6014RIO_DE_JANEIRO62070503***6304D2D6",
 "qr_code_base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUg... [truncated]"}

Decoded payee from the payment payload: NEXUS_MARKETPLACE_LTDA, city RIO_DE_JANEIRO, settled through pix.basspago.com.br.

1.2 — privacyhot.vercel.app/api/pix/create — HTTP 200, valid Pix code returned

REQUEST : POST https://privacyhot.vercel.app/api/pix/create
BODY    : {"value":50}
STATUS  : 200
HEADERS : x-matched-path: /api/pix/create
          x-vercel-id: gru1::iad1::6kpxq-1785189824168-e4c39093bcfa

RESPONSE:
{"id":"a25cb087-5ee9-4bd7-aea8-4c05876ce8a1",
 "qr_code":"00020101021226810014br.gov.bcb.pix2559qr.woovi.com/qr/v2/cob/
d1eef66c-9d69-4eb2-9dca-5983317485b952040000530398654040.505802BR5909PUSHINPAY
6011HORTOLANDIA622905252e822c2b1a2f4cfdb1edd7e4b6304A65F",
 "status":"created",
 "value":50,
 "webhook_url":"https://seu-site.com",
 "qr_code_base64":"data:image/png;base64,iVBORw0KGgoAAAAN... [truncated]"}

Decoded payee: PUSHINPAY, city HORTOLANDIA, settled through qr.woovi.com. Note "webhook_url":"https://seu-site.com" — an unedited placeholder from the scam template. The response shape indicates the function proxies the payment provider's API using a token held in this project's environment variables on Vercel.

1.3 — privacy-isabel.vercel.app/api/pix/generate — function live, actively cloaked

REQUEST : POST https://privacy-isabel.vercel.app/api/pix/generate
BODY    : {"amount":19.9}
STATUS  : 403
HEADERS : x-matched-path: /api/pix/generate
RESPONSE: {"error":"Sessão inválida. Recarregue a página."}

The function is live and refuses requests that do not originate from the operator's own page. This is anti-analysis cloaking — an indicator of deliberate fraud, and a likely reason a manual review of this URL would appear to find nothing.

1.4 — privacy-oficial-6xo1.vercel.app/api/meta-events — server-side ad relay

REQUEST : POST https://privacy-oficial-6xo1.vercel.app/api/meta-events
BODY    : {}
STATUS  : 400
RESPONSE: {"error":"Event name is required"}

A live serverless function relaying conversions to Meta's Conversions API, used to optimise paid advertising for the fraud. The deployment also carries a Facebook pixel (3046746782192073) and a UTMify tracker (69d2e378f281fab1a842b4a1). This is a funded, actively promoted operation.

2. Vercel's role is not limited to hosting

Four distinct Vercel products participate in this operation:

• v0.dev — privacypremium.vercel.app still carries the literal document title "v0 App", and privacyaninha.vercel.app stores assets under design-mode-images/. Both were built with Vercel's own AI product, which implies an authenticated account with a login and billing trail that Vercel can identify internally.
• Vercel Blob Storage — the creator photographs used by privacyaninha are stored at hebbkx1anhila5yf.public.blob.vercel-storage.com/design-mode-images/. Vercel is not merely transmitting this content; it is hosting it.
• Vercel Edge, gru1 (São Paulo, Brazil) — all fifteen deployments are served from Vercel's Brazilian edge region, per the x-vercel-id header. This places the conduct squarely within Brazilian jurisdiction.
• Vercel Serverless Functions — issuing the payment charges, per section 1.

The "third-party checkout" is also on Vercel

PepperPay and TriboPay are legitimate Brazilian checkout platforms that host on Vercel. We are not asking for action against them — we raise this only to answer the objection that the payment step lies outside Vercel's infrastructure. In these cases both the bait and the cash register sit on Vercel, one of them under a custom domain.

3. The fifteen deployments

All fifteen returned HTTP 200 on 2026-07-27. The hash column is the SHA-256 of the HTML as served to us on that date; the raw captures are retained and available. URLs are shown as plain text, not links, deliberately.

Twelve of the fifteen stamp the impersonated brand in the document title itself. This distinguishes them from any site that merely mentions the word "privacy" — the clone copies the title of the genuine platform.

Same operator, redeployed

teste-priv-u76e and cr7-vert are the same template: identical favicon SHA-256 a0401d74f5dc…, identical Google Tag Manager container GTM-NLCHTWF, identical Microsoft Clarity ID qrvnyh4yh1. Removing individual subdomains without acting on the account has already produced redeployment under new names.

4. The clones are served using Privacy's own image files

Three deployments hot-link images directly from Privacy's content delivery network. The fraudulent page is therefore rendered using the genuine company's own logo and photograph files — the visitor's browser fetches assets from the real Privacy while reading a page Privacy has no relationship with. This is stated here as a matter of observed fact about how the deception is built; it is not a copyright claim:

• privacy-gilt-five — references cdn.privacy.com.br/assets/img/logo/privacy-logo-media-watermark.svg and multiple creator photographs from image.privacy.com.br
• privacy-brasil — multiple creator photographs from image.privacy.com.br
• privacyleticiacosta — privacy.com.br/assets/img/logo/logo.png and logo_colorido.jpg

A fourth, privacyaninha, stores the creator's photographs on Vercel's own Blob Storage rather than hot-linking them, under the design-mode-images/ prefix written by v0.dev.

5. Why this is fraud, not brand nuisance

Each of the fifteen deployments:

• reproduces the Privacy visual identity, logo and layout;
• uses the real name and photographs of an identifiable Brazilian content creator as bait, without her consent;
• solicits a paid subscription to a service the operator cannot deliver, having no relationship with Privacy.

Where the charge settles by Pix, it is irreversible under Brazilian banking rules. A victim who pays cannot charge back and has no dispute window. The harm is immediate, financial and unrecoverable.

Under Brazilian law this constitutes electronic fraud (Código Penal, art. 171, §2º-A, as amended by Law 14.155/2021) and unlawful processing of personal and financial data (LGPD, Law 13.709/2018).

It is also a plain violation of the Vercel Acceptable Use Policy, which prohibits "Fraud, deceptive practices, or other scams" and "Impersonation, phishing, or misrepresenting authorization to act on behalf of others or Vercel" — conduct the policy defines as "a material breach of the Agreement" for which Vercel "may restrict, suspend, or terminate your access to Services immediately upon notice".

6. What we are asking

1. Suspend or remove the fifteen deployments listed in section 3.
2. Act on the underlying accounts, not only the URLs. The v0.dev and Blob Storage artefacts identify the operators internally, and URL-level removal has already produced redeployment.
3. Confirm the action by reply, referencing our case numbers.

7. Additional evidence held

For every case number listed we hold a sealed forensic dossier containing a full-page screenshot captured after defeating the operator's cloaking and age-gate layers, the served HTML with its cryptographic hash, HTTP response headers and resolved infrastructure chain, and a qualified CAdES-T timestamp issued by SERPRO — a Brazilian ICP-Brasil time-stamping authority — with the evidence stored under S3 Object Lock (WORM).

We will supply any or all of these in whatever structure your workflow requires. If your team needs the evidence in a particular format to action a report, tell us what that format is and we will conform to it.