flverr-support[.]click

The domain flverr-support.click has been identified as a credential harvesting phishing site designed to impersonate a service portal login interface. Analysis indicates this infrastructure was actively used to deceive users into submitting authentication credentials under false pretenses. The domain is currently offline, though its prior operational status poses a residual risk to individuals who may have interacted with it during its active period. Infrastructure analysis reveals the domain was registered through NameSilo, LLC on May 10, 2026, and resolved to the IP address 104.21.11.182. Detection metrics show 19 of 95 security vendors on VirusTotal flagged the domain as malicious, while it appeared in three threat intelligence pulses on a collaborative threat platform. The domain was also listed on one security blocklist and assigned a trust score of 0/100 by an independent assessment service. Technical indicators include the use of Node.js with Express, Cloudflare as a content delivery network, and HTTP/3 for transport, suggesting a modern, low-latency phishing infrastructure. Current status confirms the domain has been taken offline, though historical exposure remains a concern. Organizations and individuals are advised to review access logs for connections to 104.21.11.182 or flverr-support.click, particularly those involving service portal authentication flows. Network-level blocking of the domain and associated IP is recommended as a preventive measure. End users who may have entered credentials on the site should initiate password resets on legitimate platforms and enable multi-factor authentication where available. Monitoring for unauthorized access attempts is strongly advised.