moonpay-commerce-nh8cagtat-heliofi[.]vercel[.]app

This domain, moonpay-commerce-nh8cagtat-heliofi.vercel.app, is actively engaged in a brand impersonation phishing scheme targeting cryptocurrency users. Analysis indicates the site mimics MoonPay Commerce, a legitimate cryptocurrency payment gateway, to deceive victims into submitting wallet credentials or authorizing fraudulent transactions. The domain currently maintains an active status with elevated risk classification due to its deceptive infrastructure and recent detection by security systems. Infrastructure analysis reveals the domain is hosted on IP address 64.29.17.3 and registered through Vercel Inc. Security vendors on VirusTotal have flagged the domain, with 2 of 95 engines detecting malicious activity. The site employs a valid SSL certificate issued by Google Trust Services, which may lend an appearance of legitimacy to unsuspecting users. Technologies detected include Vercel hosting and HTTP Strict Transport Security (HSTS), though these are neutral indicators often exploited by threat actors to blend in with legitimate traffic. No historical creation date or additional blocklist data was provided, limiting temporal analysis of the domain's lifecycle. Current risk assessment designates this as an active threat requiring immediate mitigation. Organizations and individuals are advised to block the domain at the network perimeter and update endpoint protection rules to include the IP address 64.29.17.3. Users who may have interacted with the site should revoke any connected wallet authorizations and monitor accounts for unauthorized transactions. Security teams should treat this domain as part of a broader crypto-drainer campaign, particularly given its impersonation of a known payment processor. Additional monitoring of Vercel-hosted domains with similar naming patterns (e.g., moonpay-commerce-*) is recommended to identify potential follow-on threats.