moonpay-commerce-jql3k2i1g-heliofi[.]vercel[.]app

This domain, moonpay-commerce-jql3k2i1g-heliofi.vercel.app, is flagged as an active crypto-focused phishing site targeting users under the guise of a legitimate payment service. Analysis indicates the domain is hosted on Vercel infrastructure and resolves to 64.29.17.195 (AS16509, Amazon.com, Inc., US). The SSL certificate is issued by Google Trust Services, a common but not inherently trustworthy indicator, and the domain enforces HSTS, which may complicate takedown efforts. The page title, 'MoonPay Commerce | Sell more with crypto ⚡️,' explicitly mimics MoonPay, a known cryptocurrency payment processor, suggesting intent to deceive users into entering credentials or transferring funds. No nameservers are currently detected, which is atypical for legitimate services and may indicate evasion tactics. The domain is blocked by multiple security vendors, including PhishDestroy, MetaMask, and SEAL, and appears on three security blocklists. Gridinsoft assigns a trust score of 0/100, reinforcing its high-risk classification. While 14 of 91 security vendors on VirusTotal flag the domain, this does not constitute definitive proof of malicious activity but aligns with broader detection patterns. Technologies detected include Vercel hosting and Google Analytics, the latter of which is often abused for tracking victim interactions. Defenders should treat this domain as a confirmed phishing threat. Immediate actions include blocking resolution at the DNS level, adding the domain to web filtering rules, and monitoring for related infrastructure (e.g., subdomains, IP reuse). Given the crypto-themed branding, security teams should prioritize alerts for wallet interactions or credential submissions linked to this domain. Further analysis of the site’s content and backend infrastructure is recommended to identify additional indicators of compromise, though the current evidence is sufficient to justify proactive mitigation.