moonpay-commerce-git-fix-com2-2219-theme-page-forms-heliofi.vercel.app
Category: Phishing
To use full-featured product, you have to purchase a license for Combo Cleaner. Limited seven days free trial available. Combo Cleaner is owned and operated by RCS LT, the parent company of PCRisk.com.
Description of moonpay-commerce-git-fix-com2-2219-theme-page-forms-heliofi.vercel.app
This domain appears to host a web page branded as "MoonPay Commerce," presenting itself as a cryptocurrency payments or checkout service for merchants. The page title and metadata describe features such as pay links, checkout widgets, subscriptions, and instant crypto payments, which suggests a fintech or crypto-commerce onboarding flow rather than a general informational website.
The site is served from a vercel.app subdomain and references assets associated with hel.io as well as branding tied to MoonPay. Based on the screenshot, the page is minimal and centered around collecting an email address or prompting a wallet sign-in. That combination may indicate a landing page, login flow, or promotional clone intended to resemble a legitimate crypto payment platform rather than an independently branded business website.
Safety Assessment for moonpay-commerce-git-fix-com2-2219-theme-page-forms-heliofi.vercel.app
This domain was flagged by 11 out of 91 security engines at the time of this scan, with multiple detections describing it as phishing or otherwise malicious. The page also closely imitates the branding of MoonPay Commerce while operating from a long, unrelated vercel.app subdomain rather than an obvious official MoonPay domain, which may indicate a look-alike page intended to capture user credentials or wallet interactions.
The malware scan did not identify flagged files on the page itself, but that does not outweigh the broader reputation signals. In addition, the domain's IP address is listed on one mail-reputation blocklist, which is a weaker signal on its own but still worth noting. The screenshot shows a sparse login-style interface requesting an email address and offering wallet sign-in, a pattern commonly associated with credential harvesting when combined with brand imitation.
Based on these findings, this website may pose potential risks to visitors.
Technical Description
The site uses a valid SSL certificate issued by a mainstream certificate authority, with expiry listed in September 2026. It is hosted on Vercel infrastructure and resolves to an IP address in the United States. The page appears to be built with a modern JavaScript framework, with multiple _next/static assets indicating a Next.js deployment.
DNSSEC appears to be unsigned, which is not uncommon but does mean there is no DNSSEC validation layer present. The main technical concern is not the TLS setup but the hosting context and branding mismatch: a third-party hosted subdomain presenting itself as a MoonPay Commerce login or onboarding page, alongside multi-engine phishing detections at the time of the scan.
Share your experience with this website. Was it safe? Did you encounter any issues?