fiverr-orders-payment[.]help

This domain, fiverr-orders-payment.help, is a high-risk infrastructure known to be actively engaged in credential theft. The domain impersonates a legitimate service, likely Fiverr, to trick users into divulging sensitive information such as usernames, passwords, and financial details. This specific threat type is designed to capture and misuse user credentials, posing a significant risk to individuals and organizations that interact with it.

Analysis indicates that fiverr-orders-payment.help is flagged by 12 out of 95 security vendors on VirusTotal, suggesting a moderate level of consensus among security experts regarding its malicious nature. The domain was registered through NameSilo, LLC on May 10, 2026, and is currently hosted in the United States under the AS13335 Cloudflare, Inc. network. The SSL certificate is issued by Let's Encrypt, which is a common tactic used by threat actors to increase the credibility of their phishing sites. Additionally, the domain appears on one security blocklist and resolves to the IP address 188.114.97.3.

If users have visited fiverr-orders-payment.help, they should immediately change their passwords and any associated credentials, especially for accounts related to Fiverr or other financial services. It is recommended to monitor account activity for any unauthorized transactions and to enable multi-factor authentication (MFA) on all critical accounts. Users should also report the incident to their respective security teams or IT departments to ensure appropriate measures are taken to mitigate potential risks.