moonpay-commerce-goylyguzs-heliofi[.]vercel[.]app

This domain is flagged as an active crypto payment phishing site designed to deceive users into entering sensitive financial or authentication credentials. Analysis indicates the site impersonates legitimate cryptocurrency payment gateways, likely targeting users attempting to conduct transactions or verify wallet connections. The fraudulent infrastructure is structured to harvest login details, private keys, or payment information under the guise of a trusted service provider. Infrastructure analysis reveals the domain resolves to the IP address 216.198.79.67 and is hosted through a platform known for rapid deployment of temporary or disposable sites. The SSL certificate, issued by Google Trust Services, adds a layer of perceived legitimacy, while detected technologies such as HSTS and Google Analytics suggest an attempt to mimic enterprise-grade security and analytics practices. Notably, 4 out of 95 security vendors on VirusTotal have flagged this domain as malicious, a relatively low but concerning detection rate that may indicate evasion techniques or recent activation. Users who have visited moonpay-commerce-goylyguzs-heliofi.vercel.app should immediately cease all interaction and assume any entered credentials are compromised. Disconnect any connected wallets or financial accounts and monitor them for unauthorized transactions. Reset passwords and enable multi-factor authentication on all related accounts. Report the domain to relevant security teams or abuse contacts, including the hosting provider, to facilitate takedown efforts. If cryptocurrency was transferred, document all transaction hashes and contact the platform or wallet support for potential recovery options. Exercise heightened caution with unsolicited payment requests or links, even if they appear to originate from known services.