moonpay-commerce-jql3k2i1g-heliofi.vercel.app
Category: Phishing
To use full-featured product, you have to purchase a license for Combo Cleaner. Limited seven days free trial available. Combo Cleaner is owned and operated by RCS LT, the parent company of PCRisk.com.
Description of moonpay-commerce-jql3k2i1g-heliofi.vercel.app
This domain appears to present itself as a cryptocurrency payments and merchant onboarding page branded as "MoonPay Commerce." The page title and metadata describe a service for accepting crypto payments through pay links, checkout widgets, subscriptions, and deposits, and the screenshot shows a login or sign-in style landing page asking for an email address or wallet-based access.
The site is hosted on a vercel.app subdomain rather than on the better-known moonpay.com domain, while also referencing commerce.moonpay.com and MoonPay-branded assets in its page resources. Based on the branding, wording, and layout, it appears to be imitating a financial-services or crypto-commerce portal associated with MoonPay, but it does not use the primary official brand domain in the scanned URL.
Because the page is framed as a crypto payment or merchant service, it falls into a financial-services / cryptocurrency context. That type of workflow can involve account access, wallet connections, or payment credentials, which makes domain authenticity especially important for visitors.
Safety Assessment for moonpay-commerce-jql3k2i1g-heliofi.vercel.app
Multiple independent security signals indicate elevated risk at the time of this scan. The domain was flagged by 20 out of 91 security engines, and several web-classification providers categorized it as phishing or fraud-related. In addition, a major threat database listed the URL for social-engineering activity, which is a stronger warning sign than a generic heuristic alert.
The domain name and page presentation also raise concern because the site uses MoonPay branding while operating from a long, non-primary vercel.app subdomain rather than an official-looking MoonPay domain. That resemblance may indicate a look-alike page intended to capture email addresses, wallet sign-ins, or other sensitive information. Although the malware scan did not detect malicious files at the time of analysis, phishing pages often contain little or no overt malware and can still pose risk through credential harvesting.
There is also a secondary caution signal: the domain's IP address is listed on one mail-reputation blocklist, though that alone is weaker evidence than the phishing detections above. Based on these findings, this website may pose potential risks to visitors.
Technical Description
The site was served over HTTPS with a valid TLS certificate issued by a mainstream certificate authority, and it appears to be hosted on Vercel infrastructure at IP address 64.29.17.131 in the United States. The page loads modern static assets consistent with a JavaScript web application and references external resources from hel.io, Google font infrastructure, and several third-party domains.
The domain uses Vercel nameservers and DNSSEC appears to be unsigned. While the TLS setup appears functional, a valid certificate and reputable hosting platform do not by themselves establish legitimacy. In this case, the more notable technical concern is the mismatch between the branded financial-service presentation and the unofficial-looking hosted subdomain, alongside the strong phishing detections reported at the time of the scan.
Share your experience with this website. Was it safe? Did you encounter any issues?