fiverr-verlficatlon[.]com

This domain is flagged as an active brand impersonation phishing site designed to deceive users of the legitimate Fiverr platform. Analysis indicates the site mimics Fiverr’s authentication portal, likely harvesting credentials or deploying malicious payloads under the guise of account verification. The elevated risk level stems from its recent deployment and targeted nature, posing immediate threats to users unfamiliar with official Fiverr domains or security indicators. Infrastructure analysis reveals the domain fiverr-verlficatlon.com resolves to IP address 104.21.51.111, a Cloudflare-associated endpoint commonly exploited to obfuscate malicious infrastructure. The domain was registered on April 28, 2026, through Global Domain Group LLC, a registrar frequently linked to abusive registrations. Detection metrics from VirusTotal show 10 out of 95 security vendors flagging the domain as malicious, with no benign classifications. The SSL certificate, issued by Let’s Encrypt, provides minimal assurance, as automated certificate issuance is routinely abused by threat actors to lend superficial legitimacy. No reputable blocklists or trust scores currently endorse this domain, reinforcing its malicious classification. Mitigation requires immediate action from network administrators and end users. Organizations should block resolution to 104.21.51.111 at the DNS or firewall level and monitor for internal access attempts to fiverr-verlficatlon.com. End users must verify domain authenticity before entering credentials, ensuring the URL matches Fiverr’s official domain (fiverr.com) and displays a valid EV SSL certificate. Multi-factor authentication (MFA) should be enforced on all accounts to mitigate credential theft risks. Security teams are advised to conduct retrospective analysis for prior exposure and educate users on recognizing brand impersonation tactics, particularly those involving misspelled domains or unsolicited verification requests.