moonpay-commerce-1jap5gmnw-heliofi.vercel.app
Category: Phishing
To use full-featured product, you have to purchase a license for Combo Cleaner. Limited seven days free trial available. Combo Cleaner is owned and operated by RCS LT, the parent company of PCRisk.com.
Description of moonpay-commerce-1jap5gmnw-heliofi.vercel.app
This website appears to present itself as a cryptocurrency payments and merchant-services page branded as “MoonPay Commerce.” Based on the page title, meta description, and visible interface, it claims to help businesses accept crypto payments through pay links, checkout widgets, subscriptions, and wallet-based sign-in. The page includes branding elements, documentation links, and references to commerce.moonpay.com, suggesting it is attempting to resemble a legitimate crypto-commerce onboarding or login portal.
The domain itself is a subdomain hosted on vercel.app rather than a primary branded corporate domain. Its structure, "moonpay-commerce-1jap5gmnw-heliofi.vercel.app," does not match the cleaner naming convention typically expected for an official customer-facing service. The page also references assets from hel.io and includes MoonPay-themed favicon resources, which may indicate a campaign, integration, clone, or look-alike deployment rather than a standard official property.
Based on the branding and content shown, the site appears to target users interested in cryptocurrency payments, merchant onboarding, or wallet-based authentication. Because it uses a hosted subdomain and imitates a recognizable financial-technology brand experience, visitors may want to verify carefully whether they are interacting with an officially operated MoonPay property.
Safety Assessment for moonpay-commerce-1jap5gmnw-heliofi.vercel.app
This domain was flagged by 11 out of 91 security engines at the time of this scan, with multiple detections describing it as phishing or malicious. That level of multi-engine agreement is a strong warning sign, especially because the page appears to imitate a recognizable crypto-payment brand while operating from a third-party hosting subdomain rather than an obvious primary brand domain. The combination of brand-style presentation, login or sign-in prompts, and a hosted subdomain may increase the risk of credential harvesting or wallet-targeted social engineering.
The malware scan did not identify flagged files on the page itself, which can happen when a phishing page relies on deceptive branding and form collection rather than downloadable malware. Blacklist-style threat databases were otherwise largely clean at the time of this scan, but the domain's IP address was listed on one mail-reputation blocklist, which is a weaker secondary signal and not, by itself, proof of harmful website content. A referenced domain was also marked with a generic suspicious heuristic, though that signal alone would be low confidence.
Overall, the stronger indicators here are the repeated phishing classifications from multiple security engines, the use of a hosted subdomain, and the apparent attempt to resemble a known crypto-commerce service. Based on these findings, this website may pose potential risks to visitors.
Technical Description
The site is hosted on Vercel infrastructure and resolves to IP address 216.198.79.195 in Walnut, United States. It presents a valid SSL/TLS certificate issued by Google Trust Services with an expiry in September 2026, which indicates encrypted transport is available. However, a valid certificate only confirms HTTPS availability and does not by itself verify that the site is trustworthy or officially affiliated with the brand it displays.
DNSSEC appears to be unsigned, so DNS responses do not benefit from DNSSEC validation. The page structure and asset paths suggest a modern JavaScript application, likely built with a framework such as Next.js and deployed as a hosted frontend. From a security perspective, the main concern is not the TLS setup but the mismatch between the branded content and the non-primary hosted subdomain, alongside the phishing detections reported by multiple security engines.
Share your experience with this website. Was it safe? Did you encounter any issues?