moonpay-commerce-git-feat-com2-2323-manual-crypto-send-heliofi.vercel.app
Category: Phishing
To use full-featured product, you have to purchase a license for Combo Cleaner. Limited seven days free trial available. Combo Cleaner is owned and operated by RCS LT, the parent company of PCRisk.com.
Description of moonpay-commerce-git-feat-com2-2323-manual-crypto-send-heliofi.vercel.app
This domain appears to host a cryptocurrency payments landing page branded as "MoonPay Commerce." Based on the page title, metadata, and screenshot, it presents itself as a service for accepting crypto payments through pay links, checkout widgets, deposits, subscriptions, and wallet-based sign-in. The page uses a polished fintech-style design and references crypto-related assets and branding elements associated with MoonPay Commerce and Helio infrastructure.
Safety Assessment for moonpay-commerce-git-feat-com2-2323-manual-crypto-send-heliofi.vercel.app
Several independent security signals indicate elevated risk at the time of this scan. The domain was flagged by 14 out of 91 security engines, and multiple web-classification providers categorized it as phishing or fraud-related. Although some blacklist databases focused on known malware and phishing URLs did not report a listing at the time of this scan, the domain's IP address was listed on one mail-reputation blocklist, which is a weaker but still cautionary signal.
The domain name itself also raises concern because it embeds the well-known MoonPay brand inside a long Vercel subdomain rather than using an obvious official MoonPay web address. Combined with the screenshot showing MoonPay Commerce branding, email capture, and wallet sign-in prompts, this setup may be consistent with a look-alike page intended to collect credentials or wallet interactions. The malware scan did not detect flagged files, but that does not outweigh the broader phishing consensus from multiple security engines.
Based on these findings, this website may pose potential risks to visitors.
Technical Description
The site is served over HTTPS with a valid TLS certificate issued by a mainstream certificate authority, expiring in September 2026. It appears to be hosted on Vercel infrastructure, with Vercel nameservers and a reported server IP in the United States. The page loads modern Next.js-style static assets and references external resources from hel.io, along with links to Discord and Telegram.
DNSSEC appears to be unsigned, which is not uncommon but provides less DNS-layer assurance than a signed configuration. The use of a hosted subdomain on a cloud deployment platform can make rapid page deployment easy, which is common for legitimate projects but can also be abused for short-lived phishing pages. No malicious files were flagged in the file scan, though one referenced external domain received a generic suspicious label.
Share your experience with this website. Was it safe? Did you encounter any issues?