moonpay-commerce-git-remove-withdraw-feature-flag-heliofi.vercel.app
Category: Phishing
To use full-featured product, you have to purchase a license for Combo Cleaner. Limited seven days free trial available. Combo Cleaner is owned and operated by RCS LT, the parent company of PCRisk.com.
Description of moonpay-commerce-git-remove-withdraw-feature-flag-heliofi.vercel.app
This URL appears to host a web page branded as "MoonPay Commerce," presenting itself as a cryptocurrency payments and checkout service for merchants. The page title and meta description suggest functionality related to accepting crypto payments, pay links, subscriptions, and e-commerce checkout flows. The visible interface is minimal and includes an email entry field, a wallet sign-in option, and links to documentation and policy pages.
Based on the domain structure, this is not hosted on MoonPay's primary corporate domain but on a vercel.app deployment subdomain. It also references assets from hel.io and mentions commerce.moonpay.com among related domains, which may indicate a staging, preview, partner, or imitation deployment. Because the branding closely matches a known crypto payments company while being served from a third-party hosting subdomain, the page may warrant additional scrutiny regarding who operates it and whether it is officially authorized.
Safety Assessment for moonpay-commerce-git-remove-withdraw-feature-flag-heliofi.vercel.app
Multiple security signals indicate elevated risk at the time of this scan. The domain was flagged by 16 out of 91 security engines, with many of those detections classifying it as phishing or otherwise malicious. In addition, one threat-database style listing in the provided blacklist data marked the site, and the domain's IP address is listed on one mail-reputation blocklist. While the malware scan did not identify confirmed malicious files, its generic suspicious-object findings on numerous page resources are lower-confidence indicators and are outweighed here by the broader multi-engine phishing consensus.
The page also uses the branding of a well-known cryptocurrency payments company while being hosted on a long, unusual vercel.app subdomain rather than an obvious primary brand domain. That kind of presentation may resemble a look-alike or unauthorized deployment, especially for a login or wallet-connected page that requests user interaction. The combination of brand-style presentation, phishing-oriented detections, and lack of established traffic ranking increases the likelihood of user risk.
Based on these findings, this website may pose potential risks to visitors at the time of this scan.
Technical Description
The site is hosted on Vercel infrastructure and resolves to IP address 216.198.79.131 in Walnut, United States. It presents a valid SSL/TLS certificate issued by Google Trust Services, which means the connection appears encrypted in transit. The domain uses Vercel nameservers and the web assets appear to be delivered through a modern JavaScript application stack, likely Next.js, based on the referenced _next/static resources.
DNSSEC is unsigned, which is common but provides no additional DNS integrity protection. The domain itself is several years old, but this age reflects the vercel.app base domain rather than necessarily the specific project deployment path. From a security perspective, the main concerns are not certificate validity or hosting quality, but the phishing-related detections, brand-style presentation on a hosted subdomain, and the presence of a mail-reputation blocklist hit on the serving IP at the time of the scan.
Share your experience with this website. Was it safe? Did you encounter any issues?