moonpay-commerce-8nbxkcgb9-heliofi[.]vercel[.]app

This domain, moonpay-commerce-8nbxkcgb9-heliofi.vercel.app, is flagged as an active crypto drainer designed to deplete cryptocurrency wallets by impersonating MoonPay Commerce. The site mimics legitimate payment infrastructure, tricking users into authorizing transactions that transfer funds to attacker-controlled addresses. Victims may unknowingly sign malicious smart contracts or approve token allowances, leading to irreversible asset loss. The threat primarily targets users seeking to sell or purchase crypto through seemingly official channels, exploiting trust in the MoonPay brand. Analysis indicates the domain is hosted on Vercel Inc. infrastructure and resolves to the IP address 216.198.79.67. Detection data from VirusTotal shows only 1 of 95 security vendors currently flags this domain, suggesting it may evade many automated defenses. The SSL certificate is issued by Google Trust Services, providing a false sense of legitimacy. The page title, 'MoonPay Commerce | Sell more with crypto ⚡️,' reinforces the brand impersonation, while the lack of widespread detection highlights the campaign's sophistication. If you visited this domain or interacted with its content, immediately revoke any wallet permissions granted to the site using a blockchain explorer or wallet management tool. Disconnect all connected wallets and transfer remaining assets to a new, secure wallet. Monitor transaction history for unauthorized activity and report the incident to relevant platforms, including the legitimate service being impersonated. Avoid reusing passwords or recovery phrases associated with compromised accounts, and enable multi-factor authentication where possible to mitigate further risks.