moonpay-commerce-5jacj9p4a-heliofi.vercel.app
Category: Phishing
To use full-featured product, you have to purchase a license for Combo Cleaner. Limited seven days free trial available. Combo Cleaner is owned and operated by RCS LT, the parent company of PCRisk.com.
Description of moonpay-commerce-5jacj9p4a-heliofi.vercel.app
This website appears to present itself as a cryptocurrency payments and commerce portal branded as "MoonPay Commerce." Based on the page title, meta description, and visible homepage elements, it claims to help merchants accept crypto payments through pay links, checkout widgets, subscriptions, and related e-commerce tools. The page includes sign-in prompts, documentation links, and branding that resembles a commercial fintech or crypto-payment service.
The domain itself is a subdomain hosted on vercel.app rather than an obvious primary corporate domain, while the page references commerce.moonpay.com and assets hosted under hel.io. That combination suggests the site may be attempting to mirror or support a crypto-commerce workflow associated with MoonPay-related branding, but it is not operating from the main branded domain shown in the page references.
Based on the content and branding, the site would most likely be categorized as a cryptocurrency or fintech-related login/commerce page. However, because it uses a hosted subdomain with brand-oriented naming rather than a clearly official primary domain, its relationship to the brand it references is not independently confirmed by the scan data alone.
Safety Assessment for moonpay-commerce-5jacj9p4a-heliofi.vercel.app
Multiple security signals indicate elevated risk at the time of this scan. The domain was flagged by 18 out of 91 security engines, with many of those detections classifying it as phishing or otherwise malicious. In addition, a major threat database listed the URL for social-engineering activity, which is a stronger warning sign than a generic heuristic match. Although the malware scan reported no flagged files, it still associated the domain and several static resources with a generic malicious-object label, which adds context but is less conclusive than the broader multi-engine phishing consensus.
The page also appears to use MoonPay branding while operating from a vercel.app subdomain rather than an obvious official MoonPay domain. In plain terms, the address closely resembles a branded commerce login page but may not be an official brand-owned login location. That kind of mismatch can be consistent with credential-harvesting or wallet-targeting campaigns, especially on crypto-related pages that request sign-in details. The domain's IP address is also listed on one mail-reputation blocklist, though that signal on its own is weaker and should be treated as secondary compared with the phishing detections and social-engineering listing.
Based on these findings, this website may pose potential risks to visitors.
Technical Description
The site is hosted on Vercel infrastructure and resolves to IP address 64.29.17.67 in Walnut, United States. It presents a valid SSL/TLS certificate issued by Google Trust Services, expiring in September 2026. A valid certificate helps encrypt traffic in transit, but it does not by itself verify that the site is trustworthy or officially affiliated with the brand shown on the page.
WHOIS data indicates the domain has existed for several years, but this is a hosted subdomain under vercel.app rather than a standalone corporate domain. DNSSEC appears to be unsigned. The page loads Next.js-style static assets and references external resources from hel.io and commerce.moonpay.com. The main technical concern is not the hosting stack itself, but the combination of brand-themed presentation on a third-party hosted subdomain and the strong phishing-related detection consensus at the time of this scan.
Share your experience with this website. Was it safe? Did you encounter any issues?