I've pretty much have had the same thing to me happen on Fiverr about 10 months ago.

I even did a write up. It was one of the first reverse engineerings I've did. https://gist.github.com/Throvn/97fcb4981c1ff66725d4b2e408ba0...