moonpay-commerce-926l5f3gd-heliofi.vercel.app
Category: Phishing
To use full-featured product, you have to purchase a license for Combo Cleaner. Limited seven days free trial available. Combo Cleaner is owned and operated by RCS LT, the parent company of PCRisk.com.
Description of moonpay-commerce-926l5f3gd-heliofi.vercel.app
This website appears to present itself as a cryptocurrency payments and checkout portal branded as "MoonPay Commerce." Based on the page title, meta description, and visible interface, it claims to help merchants accept crypto payments through pay links, checkout widgets, subscriptions, and related commerce tools. The landing page includes an email entry field, a wallet sign-in option, and links to documentation and social platforms, which suggests it is intended to function as a login or onboarding page for a crypto-commerce service.
The domain itself is a Vercel-hosted subdomain rather than the primary moonpay.com domain, and the page references assets associated with hel.io as well as a link to commerce.moonpay.com. That combination may indicate a staging, campaign, partner, or cloned deployment rather than a clearly established primary corporate property. Based on the branding shown, the site appears to be targeting users interested in cryptocurrency payments, merchant onboarding, or wallet-based authentication.
Safety Assessment for moonpay-commerce-926l5f3gd-heliofi.vercel.app
Multiple security signals raise concern at the time of this scan. The domain was flagged by 14 out of 91 security engines, with many of those detections classifying it as phishing or otherwise malicious. In addition, the page strongly uses MoonPay branding while operating from a long, non-primary vercel.app subdomain, which may increase the risk of user confusion and could indicate a look-alike login or credential-harvesting setup rather than an official production portal.
Other signals are mixed but do not offset the phishing indicators. A malware file scan did not detect flagged files at the time of review, and major content-malice blacklist checks were otherwise clean. However, the domain's IP address is listed on one mail-reputation blocklist, which is a minor cautionary signal, and one referenced domain was marked with a generic suspicious label. The combination of strong multi-engine phishing detections, crypto-payment branding, and a hosted subdomain structure suggests elevated risk for visitors asked to enter email or connect a wallet.
Based on these findings, this website may pose potential risks to visitors.
Technical Description
The site is hosted on Vercel infrastructure and resolves to IP address 64.29.17.131 in the United States. It uses a valid SSL/TLS certificate issued by Google Trust Services, with expiry shown as 2026-09-26, which indicates encrypted HTTPS support was present at the time of this scan. The page appears to be built with a modern JavaScript framework, with multiple _next/static assets consistent with a Next.js deployment.
DNSSEC is unsigned, which is common but means DNS responses do not benefit from DNSSEC validation. The main technical concern is not the certificate or hosting stack, but the mismatch between prominent MoonPay branding and the use of a non-primary vercel.app deployment URL. In phishing investigations, hosted subdomains on cloud platforms can sometimes be used to imitate legitimate services while remaining easy to deploy and rotate.
Share your experience with this website. Was it safe? Did you encounter any issues?