moonpay-commerce-61iaa4ldn-heliofi.vercel.app
Category: Phishing
To use full-featured product, you have to purchase a license for Combo Cleaner. Limited seven days free trial available. Combo Cleaner is owned and operated by RCS LT, the parent company of PCRisk.com.
Description of moonpay-commerce-61iaa4ldn-heliofi.vercel.app
This website appears to present itself as a cryptocurrency payments and commerce portal branded as “MoonPay Commerce.” Based on the page title, meta description, and screenshot, it claims to help merchants accept crypto payments through pay links, checkout widgets, subscriptions, and related payment flows. The page includes an email entry field, a wallet sign-in option, and links styled as documentation and policy pages, which suggests it is designed to resemble a fintech onboarding or merchant login experience.
The domain itself is a subdomain hosted on vercel.app rather than an apparent primary corporate domain. It also references assets from hel.io and mentions MoonPay branding, which may indicate either a hosted project deployment, a partner integration, or a page attempting to imitate a known crypto-payment brand. Based on the available data, the site appears to target users interested in crypto commerce or merchant payment services rather than functioning as a general informational website.
Safety Assessment for moonpay-commerce-61iaa4ldn-heliofi.vercel.app
Multiple security signals indicate elevated risk at the time of this scan. The domain was flagged by 19 out of 91 security engines, with many of those detections classifying it as phishing or otherwise malicious. In addition, it was listed by a major threat database for social-engineering activity, and web-classification data also categorized it as phishing. Although the malware scan did not identify malicious files in the sampled page resources, phishing pages often rely on deceptive branding and credential collection rather than downloadable malware, so a clean file scan does not materially offset the reputation findings.
There are also contextual concerns in the way this page is presented. The site uses MoonPay branding on a vercel.app subdomain rather than an apparent official primary domain, which may indicate an impersonation attempt or an unauthorized look-alike deployment. The page is not ranked in major traffic data, and the screenshot shows a login-style interface asking for email or wallet sign-in, which is consistent with the type of workflow commonly abused in credential-harvesting campaigns.
A secondary signal shows the domain's IP address listed on one mail-reputation blocklist, though that alone would be a weaker indicator than the phishing detections and social-engineering listing. Based on these findings, this website may pose potential risks to visitors.
Technical Description
The site is hosted on Vercel infrastructure and resolves to IP address 216.198.79.195 in Walnut, United States. It presents a valid SSL/TLS certificate issued by Google Trust Services, expiring in September 2026. The page appears to be built with a modern JavaScript framework, with multiple _next/static assets indicating a Next.js-style deployment. DNS uses Vercel nameservers, and DNSSEC is unsigned.
From a technical standpoint, the certificate validity and mainstream hosting platform do not by themselves establish legitimacy, since phishing pages can also be deployed on reputable cloud infrastructure with valid HTTPS. No malicious files were flagged in the sampled resources, and no flagged external links or iframes were reported in the page scan. The primary technical concern is therefore reputational and behavioral rather than exploit-based: a branded login-style page hosted on a third-party app platform and heavily flagged by security engines.
Share your experience with this website. Was it safe? Did you encounter any issues?