moonpay-commerce-git-fix-com2-2691-dialog-phanto-f001a8-heliofi.vercel.app
Category: Phishing
To use full-featured product, you have to purchase a license for Combo Cleaner. Limited seven days free trial available. Combo Cleaner is owned and operated by RCS LT, the parent company of PCRisk.com.
Description of moonpay-commerce-git-fix-com2-2691-dialog-phanto-f001a8-heliofi.vercel.app
This URL appears to present itself as a MoonPay Commerce login or onboarding page related to cryptocurrency payments. The page title and visible branding reference "MoonPay Commerce," and the metadata describes services such as crypto checkout widgets, pay links, subscriptions, and instant deposits. The screenshot shows an email entry field and a wallet sign-in option, which suggests the page is intended to collect account access details or initiate wallet-based authentication.
However, the site is hosted on a long vercel.app subdomain rather than on an obvious primary MoonPay-owned domain. The page also references assets associated with MoonPay branding and links to commerce.moonpay.com, which may indicate an attempt to resemble a legitimate financial-services interface. Based on the domain structure, branding, and category data, this page appears to be related to cryptocurrency or financial-service account access rather than a general informational website.
Safety Assessment for moonpay-commerce-git-fix-com2-2691-dialog-phanto-f001a8-heliofi.vercel.app
Multiple independent security signals raise concern about this URL at the time of this scan. It was flagged by 13 out of 91 security engines, and several web-classification sources categorized it as phishing or fraud-related. The page visually resembles a branded MoonPay Commerce sign-in experience, but it is served from a lengthy third-party hosting subdomain rather than a straightforward official brand domain, which may indicate a look-alike page intended to imitate a legitimate service.
The malware scan did not identify confirmed malicious files, but it did apply a generic suspicious heuristic to the domain and several static resources. In addition, the domain's IP address is listed on one mail-reputation blocklist, which is a weaker signal on its own but still worth noting. More importantly, one threat-database style result in the provided blacklist data also showed a listing, while other major blacklist checks were clean.
Taken together, the combination of multi-engine phishing detections, phishing-related categorization, financial-service branding, and the use of a hosted subdomain instead of a clearly official brand address suggests elevated risk. Based on these findings, this website may pose potential risks to visitors.
Technical Description
The site uses a valid SSL/TLS certificate issued by a mainstream certificate authority, with expiry shown as 2026-09-26. It is hosted on Vercel infrastructure and resolves to IP address 64.29.17.195 in the United States. The nameservers are Vercel-managed, and the page appears to be built with a modern JavaScript framework, with static assets served from _next paths consistent with a Next.js deployment.
From a domain-security perspective, DNSSEC appears to be unsigned. The underlying vercel.app domain is established, but this specific hostname is a deeply nested branded subdomain that may be easy to use for temporary campaign-style pages. While valid HTTPS helps protect transport, it does not by itself verify that the page is an official MoonPay property.
Share your experience with this website. Was it safe? Did you encounter any issues?