fiverr-projectspad[.]pro

This domain, fiverr-projectspad.pro, is flagged as an elevated-risk credential harvesting phishing site designed to mimic legitimate freelance service platforms. Analysis indicates the infrastructure was specifically engineered to deceive users into submitting login credentials, payment details, or personal information under false pretenses. The threat type aligns with targeted phishing campaigns aimed at freelancers and clients using popular gig economy services. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 188.114.97.3 and was registered through Global Domain Group LLC on April 28, 2026. Security vendors on VirusTotal detected malicious activity, with 10 out of 95 engines flagging the domain. The site was observed using Node.js and Express for backend operations, with Cloudflare providing hosting and HTTP/3 protocol support. The page title displayed an "Error" message, a common tactic to obscure phishing activity or simulate technical difficulties. The domain appears on one security blocklist and was proactively blocked by network security measures. Mitigation steps for this specific threat type include immediate domain blacklisting at the network perimeter, particularly for organizations in the freelance or gig economy sectors. Endpoint protection systems should be updated to recognize the domain and its associated IP as malicious. Users who may have interacted with the site should be instructed to reset credentials for any accounts accessed during the exposure window, with priority given to financial and email accounts. Network logs should be reviewed for connections to 188.114.97.3 or requests to fiverr-projectspad.pro to identify potential compromised systems. Given the domain's recent creation date and targeted nature, organizations should monitor for similar domains registered through the same registrar or resolving to the same IP range.