moonpay-commerce-p197ibwvq-heliofi.vercel.app
Category: Phishing
To use full-featured product, you have to purchase a license for Combo Cleaner. Limited seven days free trial available. Combo Cleaner is owned and operated by RCS LT, the parent company of PCRisk.com.
Description of moonpay-commerce-p197ibwvq-heliofi.vercel.app
This domain presents itself as a MoonPay Commerce login or onboarding page related to cryptocurrency payments. The page title and metadata describe a service for accepting crypto payments through pay links, checkout widgets, subscriptions, and deposits, and the screenshot shows a branded sign-in interface asking for an email address or wallet-based sign-in.
Based on the domain structure, this does not appear to be the primary official MoonPay domain. Instead, it is hosted on a vercel.app subdomain with a long generated hostname, which may indicate a deployed web app or landing page rather than a main corporate website. The page also references assets associated with hel.io and commerce.moonpay.com, suggesting it may be attempting to resemble or integrate with crypto-payment branding.
The site appears to target users interested in financial technology or cryptocurrency commerce services. Because it requests sign-in details and uses branding associated with a known crypto payments company, visitors would typically expect a high level of authenticity and trust verification before entering credentials or connecting a wallet.
Safety Assessment for moonpay-commerce-p197ibwvq-heliofi.vercel.app
Multiple independent security signals indicate elevated risk at the time of this scan. The domain was flagged by 20 out of 91 security engines, and several web-classification providers categorized it as phishing or fraud-related. In addition, a major threat database listed the URL for social-engineering activity, which is a strong content-risk signal compared with weaker heuristic-only detections.
The page visually presents itself as "MoonPay Commerce," but it is hosted on a vercel.app subdomain rather than an obvious primary MoonPay-owned domain. That branding mismatch may indicate an attempt to imitate a legitimate financial or cryptocurrency service. The site also asks users to enter an email address or sign in with a wallet, which increases the potential impact if the page is not authentic.
A malware scan did not identify malicious files, but that does not outweigh the broader phishing consensus. The domain's IP address is also listed on one mail-reputation blocklist, which is a minor supporting caution rather than primary evidence of website abuse. Based on these findings, this website may pose potential risks to visitors.
Technical Description
The site uses a valid SSL/TLS certificate issued by a mainstream certificate authority, with expiry shown as 2026-09-26. It is hosted on Vercel infrastructure and resolves to IP address 216.198.79.131 in the United States. The nameservers are Vercel-operated, and the page appears to be built with a modern JavaScript framework, with multiple _next/static assets consistent with a Next.js deployment.
DNSSEC is unsigned, which is common but means DNS responses do not appear to have DNSSEC validation protection. The main technical concern is not the certificate or hosting stack, but the combination of a branded financial login-style page on a third-party hosting subdomain and the strong multi-engine phishing detections observed at the time of this scan.
Share your experience with this website. Was it safe? Did you encounter any issues?