moonpay-commerce-165l291rp-heliofi[.]vercel[.]app

This domain is flagged as a high-risk crypto drainer operation targeting cryptocurrency users through brand impersonation. Analysis indicates the infrastructure is designed to deceive victims into authorizing malicious transactions that systematically drain wallet balances, a tactic commonly associated with cryptocurrency theft campaigns. Infrastructure analysis reveals the domain moonpay-commerce-165l291rp-heliofi.vercel.app is registered through Vercel Inc. and currently resolves to IP address 64.29.17.67. The SSL certificate is issued by Google Trust Services, providing a false sense of legitimacy. Detection metrics show 2 out of 95 security vendors on VirusTotal have flagged this domain as malicious, with the page title explicitly impersonating MoonPay Commerce under the slogan 'Sell more with crypto ⚡️'. The domain remains active at the time of analysis, with no evidence of takedown requests or blocklist inclusion beyond the limited VirusTotal detections. Mitigation against this crypto drainer threat requires immediate action from both potential victims and security teams. Users should revoke any suspicious token approvals through wallet interfaces and verify transaction requests through official MoonPay channels only. Security teams should implement DNS-based blocking for the domain and IP address 64.29.17.67, while monitoring for similar patterns in Vercel-hosted subdomains containing brand names and random alphanumeric strings. Wallet providers should consider adding this domain to transaction simulation blocklists to prevent users from unknowingly authorizing malicious smart contract interactions.