fiverr-orders-payment[.]pro

This domain, fiverr-orders-payment.pro, carries an elevated risk level as a confirmed generic phishing site, specifically designed for brand impersonation targeting Fiverr users. The domain mimics official Fiverr payment pages to trick victims into entering login credentials and financial details, constituting a credential theft operation. PhishDestroy identified this threat through multiple intelligence sources, and it has since been taken offline, but users should remain vigilant as similar domains may appear.

Technical indicators paint a clear picture of malicious intent. VirusTotal analysis shows 16 out of 95 security vendors flagging this domain as malicious, a strong consensus among the security community. The domain was registered through NameSilo, LLC, a common registrar for phishing operations, and was created on May 07, 2026, indicating a relatively new but active threat. It resolves to IP address 188.114.96.3, which is associated with Cloudflare, often used to obfuscate hosting. The SSL certificate is issued by Let's Encrypt (E7), a free certificate authority frequently abused by phishers. Additionally, the domain appears on one security blocklist and was found in one AlienVault OTX threat intelligence pulse. The page title displayed only "Error," suggesting the site was either under construction or taken down shortly after detection.

To protect against such brand impersonation phishing, users should always verify the URL before entering any credentials, especially when redirected from emails or messages. Fiverr official domains end with ".fiverr.com" and never use subdomains like "fiverr-orders-payment.pro." Enable multi-factor authentication on all accounts to add an extra layer of security. If you have already entered information on this site, change your Fiverr password immediately and monitor accounts for suspicious activity. Report any similar domains to cybersecurity authorities or use phishing reporting tools. PhishDestroy recommends using browser extensions that block known phishing domains and regularly checking threat intelligence feeds for new indicators.