moonpay-commerce-git-fix-com2-1957-sync-flow-tra-c89b07-heliofi[.]vercel[.]app

Analysis of the domain moonpay-commerce-git-fix-com2-1957-sync-flow-tra-c89b07-heliofi.vercel.app, registered via Vercel, indicates a high-risk generic phishing threat targeting cryptocurrency users. The domain resolves to IP 216.198.79.3, hosted under Lefkoff Industries in the US, and remains active as of July 19, 2026. The page title, 'MoonPay Commerce | Sell more with crypto ⚡️,' suggests an attempt to impersonate MoonPay, a legitimate cryptocurrency payment service, though no further confirmation of the exact content or functionality of the site is available at this time. Security vendors have flagged the domain, with 16 of 91 detections on VirusTotal, and it appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. The SSL certificate is issued by Google Trust Services (WR1), and the site returns an HTTP 200 status, confirming its operational status. While the domain structure and hosting provider align with common phishing infrastructure, the absence of additional technical indicators—such as a known phishing kit or confirmed victim reports—limits definitive classification beyond a generic phishing threat. Defenders should treat this domain as high-risk and prioritize blocking it at the DNS or network level. Organizations using MoonPay or similar crypto payment services should alert users to verify URLs before interacting with any crypto-related payment pages. Further investigation into the domain’s backend infrastructure and associated wallet addresses may provide additional context, but no such data is currently available.