moonpay-commerce-fv5d1zirm-heliofi.vercel.app
Category: Phishing
To use full-featured product, you have to purchase a license for Combo Cleaner. Limited seven days free trial available. Combo Cleaner is owned and operated by RCS LT, the parent company of PCRisk.com.
Description of moonpay-commerce-fv5d1zirm-heliofi.vercel.app
This website appears to present itself as a cryptocurrency payments and commerce portal branded as "MoonPay Commerce." Based on the page title, meta description, and visible interface, it claims to help merchants accept crypto payments through pay links, checkout widgets, subscriptions, and related e-commerce tools. The landing page includes an email entry field, wallet sign-in option, and links to documentation and policies, which suggests it is intended to function as a merchant onboarding or login page.
The domain structure is notable because the page is hosted on a vercel.app subdomain rather than on the primary moonpay.com domain, even though it references MoonPay branding and links to commerce.moonpay.com and assets hosted under hel.io. That setup may indicate a temporary deployment, staging environment, campaign page, or an unofficial page imitating a known crypto-payment brand. Based on the available branding and content, the site appears related to cryptocurrency commerce services, but the exact operator cannot be independently confirmed from the scan data alone.
Safety Assessment for moonpay-commerce-fv5d1zirm-heliofi.vercel.app
This domain was flagged by 14 out of 91 security engines at the time of this scan, with multiple detections describing it as phishing or malicious. That level of multi-engine agreement is a meaningful warning sign, especially because the page is presented as a login or onboarding interface for a financial or cryptocurrency-related service. The domain also uses a branded name within a third-party hosting subdomain rather than the brand's main domain, which may increase the risk that visitors could mistake it for an official service page.
The malware scan did not detect malicious files in the sampled page resources, and major content-focused threat databases listed in the scan were otherwise clean at the time of review. However, the domain's IP address was listed on one mail-reputation blocklist, which is a weaker signal than phishing detections but still worth noting. In this case, the stronger concern comes from the number of security engines flagging the page and the brand-linked login presentation. Based on these findings, this website may pose potential risks to visitors.
Technical Description
The site is hosted on Vercel infrastructure and resolves to IP address 64.29.17.131 in the United States. It uses a valid SSL/TLS certificate issued by Google Trust Services, expiring in September 2026, which means the connection appears encrypted in transit. The page loads static assets from the same vercel.app deployment and from assets.hel.io, and the nameservers are Vercel-managed.
DNSSEC appears to be unsigned, so there is no DNSSEC validation layer visible from the provided data. No malicious files or flagged external links were identified in the page-resource scan, but the use of a branded cryptocurrency login flow on a hosted subdomain rather than a clearly official primary domain may be a technical trust concern for users verifying authenticity.
Share your experience with this website. Was it safe? Did you encounter any issues?