moonpay-commerce-r1qbys462-heliofi[.]vercel[.]app

Analysis indicates that the domain moonpay-commerce-r1qbys462-heliofi.vercel.app is currently active and hosts a page titled "MoonPay Commerce | Sell more with crypto ⚡️". DNS resolution points to the IP address 64.29.17.131, which is owned by Vercel, Inc. and geolocated in the United States. The site serves HTTP 200 responses and presents an SSL certificate issued by Google Trust Services under the WR1 designation, confirming a valid TLS handshake. Threat intelligence feeds have flagged the domain as high‑risk; it is listed on three public blocklists and has been blocked by security products such as PhishDestroy, MetaMask, and SEAL. VirusTotal analysis shows that 16 of 91 scanned security vendors have flagged the host, further corroborating malicious intent. Registration appears to have been performed through Vercel’s automated provisioning service, and no additional registration details are publicly disclosed. While the page title suggests a crypto‑related offering, no further content has been examined, leaving the exact phishing vector and credential‑capture mechanisms uncertain. Defenders should prioritize immediate domain blocking at network and endpoint layers, add the IP address 64.29.17.131 to deny‑list rules, and monitor for any related subdomains or newly provisioned Vercel instances that reference "MoonPay" or similar branding. Ongoing telemetry collection is advised to detect potential payload delivery or credential harvesting attempts associated with this infrastructure.