moonpay-commerce-gqlf07hkp-heliofi.vercel.app
Category: Phishing
To use full-featured product, you have to purchase a license for Combo Cleaner. Limited seven days free trial available. Combo Cleaner is owned and operated by RCS LT, the parent company of PCRisk.com.
Description of moonpay-commerce-gqlf07hkp-heliofi.vercel.app
This website appears to present itself as a cryptocurrency payments and commerce portal branded as "MoonPay Commerce." Based on the page title, meta description, and screenshot, it claims to help merchants accept crypto payments through pay links, checkout widgets, subscriptions, and related e-commerce tools. The page includes an email entry field, a wallet sign-in option, and links to documentation and social platforms, which suggests it is intended to function as a login or onboarding page for a crypto-payment service.
The domain itself is a subdomain hosted on vercel.app rather than the better-known moonpay.com domain, although the page references commerce.moonpay.com and loads branding assets from hel.io. That combination may indicate a staging, campaign, or third-party hosted deployment, but it also creates ambiguity about who directly operates this specific page. Based on the branding and content alone, the site appears to be associated with cryptocurrency commerce and merchant payments, but the hosting pattern does not clearly establish that this particular subdomain is an official MoonPay property.
Safety Assessment for moonpay-commerce-gqlf07hkp-heliofi.vercel.app
Scan results raise substantial concerns at the time of this scan. The URL was flagged by 20 out of 91 security engines, with many of those detections classifying it as phishing or otherwise malicious. In addition, a major threat database listed the page for social-engineering activity, which is a strong signal compared with weaker reputation-only indicators. Although one malware scan reported no malicious files and found no flagged external links or iframes, file-level cleanliness does not rule out credential harvesting or deceptive login behavior.
The page also appears to imitate the branding of a known cryptocurrency payments company while operating from a long, non-official-looking vercel.app subdomain rather than a primary corporate domain. That mismatch may indicate a look-alike or unauthorized hosted copy designed to collect email addresses or wallet sign-ins. The domain's IP address is also listed on one mail-reputation blocklist, which is a secondary cautionary signal but less important than the multi-engine phishing detections and social-engineering listing.
Based on these findings, this website may pose potential risks to visitors.
Technical Description
The site is hosted on Vercel infrastructure and resolves to IP address 64.29.17.3 in the United States. It uses a valid SSL/TLS certificate issued by Google Trust Services, expiring in September 2026, which means the connection appears encrypted in transit. However, HTTPS alone does not verify that the page is legitimate or authorized by the brand it displays.
DNSSEC appears to be unsigned, so there is no DNSSEC-based authenticity protection visible in the scan data. The page loads Next.js static assets and references external resources including assets.hel.io and commerce.moonpay.com. From a security perspective, the main concern is not the TLS setup but the combination of brand-style presentation on a third-party-hosted subdomain and the strong phishing consensus across multiple security engines.
Share your experience with this website. Was it safe? Did you encounter any issues?