moonpay-commerce-j0m62jhpy-heliofi.vercel.app
Category: Phishing
To use full-featured product, you have to purchase a license for Combo Cleaner. Limited seven days free trial available. Combo Cleaner is owned and operated by RCS LT, the parent company of PCRisk.com.
Description of moonpay-commerce-j0m62jhpy-heliofi.vercel.app
This website appears to present itself as a MoonPay Commerce login or onboarding page related to cryptocurrency payments. The page title and visible branding reference “MoonPay Commerce,” and the metadata describes a service for accepting crypto payments through pay links, checkout widgets, subscriptions, and deposits. The screenshot shows a minimal landing page with an email entry field and a “Sign in with wallet” option, suggesting an account-access or merchant portal workflow.
Based on the domain structure, this page is hosted on a vercel.app subdomain rather than on the primary moonpay.com domain. It also references assets from hel.io and includes a link to commerce.moonpay.com in its page resources. That combination may indicate a third-party deployment, a staging environment, or a page designed to resemble a legitimate crypto-commerce service. Because the visible content is focused on crypto payments and merchant access, the site is best understood as a cryptocurrency-related web application or portal at the time of this scan.
Safety Assessment for moonpay-commerce-j0m62jhpy-heliofi.vercel.app
Multiple security signals indicate elevated risk at the time of this scan. The URL was flagged by 19 out of 91 security engines, with many of those detections classifying it as phishing or malicious. In addition, a major threat database listed the page for social-engineering activity, which is a stronger signal than a generic heuristic warning. Although the malware scan did not identify malicious files in the sampled page resources, phishing pages often rely on deceptive branding and credential collection rather than downloadable malware, so a clean file scan does not materially offset the reputation findings.
The domain itself also raises concern because it prominently uses the MoonPay brand name while operating from a vercel.app subdomain rather than an official moonpay.com host. The screenshot shows branding and login-style elements that could plausibly be used to collect email addresses or wallet-based sign-ins from users expecting the legitimate service. The domain's IP address is also listed on one mail-reputation blocklist, though that signal is secondary and less important than the multi-engine phishing detections and social-engineering listing.
Based on these findings, this website may pose potential risks to visitors.
Technical Description
The site is served over HTTPS with a valid TLS certificate issued by Google Trust Services, expiring in September 2026. It is hosted on Vercel infrastructure and resolves to IP address 216.198.79.67, with hosting attributed to CYPRESS COMMUNICATIONS, LLC in the United States. The page appears to be built with a modern JavaScript framework, with multiple _next/static assets indicating a Next.js deployment.
WHOIS data indicates the parent domain has existed for several years, but this does not by itself validate the specific subdomain or page content. DNSSEC is unsigned, which is common but means DNS responses do not benefit from DNSSEC validation. No malicious files or flagged external links were identified in the provided page-resource scan, but the main technical concern remains the apparent brand-linked login page hosted on a third-party subdomain alongside strong phishing-related reputation signals.
Share your experience with this website. Was it safe? Did you encounter any issues?