fiverr-orders-pay[.]help

Analysis of fiverr-orders-pay.help, observed on July 24, 2026, indicates a brand‑impersonation campaign targeting Cloudflare. The domain was registered on May 12, 2026 through Global Domain Group LLC and is currently offline. DNS resolution points to 104.21.32.66, an address owned by AS13335 Cloudflare, Inc., located in the United States. The authoritative nameservers are celeste.ns.cloudflare.com and moura.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure.

An active TLS certificate issued by Let’s Encrypt (identifier E8) secures the site, and the HTTP response returns the page title “Attention Required! | Cloudflare”, which aligns with the declared brand target. Reputation signals are uniformly negative: Gridinsoft assigns a trust score of 0 / 100, and the domain is listed on a single security blocklist. PhishDestroy has taken the site offline, and VirusTotal records seven positive detections out of ninety‑one scanned vendors, reinforcing the malicious classification.

The domain appears in a known phishing intelligence feed, and the combination of a recent creation date, low trust score, and Cloudflare‑related page title suggests a deliberate attempt to lure victims into credential harvesting or other fraudulent activity under the guise of a Cloudflare warning. Defenders should continue to block the domain at network perimeter, update URL filtering and DNS sink‑hole lists, and monitor for any resurgence of the same host header or similar domains registered by the same registrar. Because the infrastructure leverages Cloudflare’s CDN, additional scrutiny of traffic patterns to the IP address may be required to distinguish legitimate Cloudflare services from malicious use. Ongoing observation of threat‑intel feeds for new domains employing the same naming convention is recommended.