moonpay-commerce-17unme5eo-heliofi.vercel.app
Category: Phishing
To use full-featured product, you have to purchase a license for Combo Cleaner. Limited seven days free trial available. Combo Cleaner is owned and operated by RCS LT, the parent company of PCRisk.com.
Description of moonpay-commerce-17unme5eo-heliofi.vercel.app
This domain appears to present itself as a "MoonPay Commerce" login or onboarding page related to cryptocurrency payments. The page title and metadata describe a service for accepting crypto payments, subscriptions, deposits, and checkout widgets, and the screenshot shows a branded landing page with an email entry field and a wallet sign-in option.
However, the site is hosted on a vercel.app subdomain rather than on an official-looking MoonPay-owned domain. It also references branding assets associated with MoonPay and hel.io, which suggests the page may be attempting to imitate a legitimate crypto-commerce service rather than serving as a clearly independent business website.
Based on the domain structure, page branding, and content, this page appears to target users interested in cryptocurrency payments or merchant onboarding. The operator is not clearly identified on the page beyond the displayed branding, so the true ownership and authorization of this deployment are not evident from the available data.
Safety Assessment for moonpay-commerce-17unme5eo-heliofi.vercel.app
Scan results indicate substantial risk signals at the time of this scan. The URL was flagged by 19 out of 91 security engines, with many classifying it as phishing or otherwise malicious, and a major threat database listed it for social-engineering activity. In addition, the domain's IP address appears on one mail-reputation blocklist, which is a weaker signal than phishing detections but still worth noting.
The page also uses branding that closely resembles MoonPay while operating from a third-party hosting subdomain, which may indicate a look-alike or impersonation setup. That pattern is commonly associated with credential harvesting or wallet-targeting pages, especially when the visible content is limited to sign-in or email capture rather than a full corporate website.
Although the malware scan did not detect malicious files in the sampled page resources, that does not outweigh the broader phishing-related detections and branding concerns. Based on these findings, this website may pose potential risks to visitors.
Technical Description
The site is hosted on Vercel infrastructure and resolves to IP address 216.198.79.67, with hosting attributed to CYPRESS COMMUNICATIONS, LLC in the United States. It uses a valid TLS certificate issued by Google Trust Services, expiring on 2026-09-26. The page appears to be built with a modern JavaScript framework, with multiple _next/static assets indicating a Next.js deployment.
The domain is relatively old at about 6 years, but DNSSEC appears to be unsigned. While the TLS setup appears valid, certificate presence alone does not establish legitimacy. In this case, the more notable technical concern is the use of a branded crypto-payment login experience on a hosted vercel.app subdomain rather than a clearly official primary domain.
Share your experience with this website. Was it safe? Did you encounter any issues?