elevens[.]now

Analysis of the domain elevens.now shows it was registered on February 21, 2026 through NameCheap, Inc. The domain resolves to the Cloudflare edge address 104.21.16.50 and is served by the nameservers emerie.ns.cloudflare.com and denver.ns.cloudflare.com. Traffic is delivered over HTTP/3 and the TLS certificate is issued by Google Trust Services under the WE1 hierarchy. The web server returns HTTP 403 for the default request, while the page title observed is “Clearer messaging — stronger relationships | Elevens”, indicating a legitimate‑looking landing page that may be used to lure victims. The domain is listed on three public blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal records three detections out of ninety‑five scanners, and Gridinsoft assigns a trust score of zero, reinforcing the malicious classification. The campaign targets the brand “across”, employing brand‑impersonation tactics to convince users that the site is affiliated with the legitimate across service. The combination of a recent registration, Cloudflare‑based infrastructure, a legitimate‑sounding title, and the presence on multiple blocklists aligns with high‑risk impersonation activity. The HTTP 403 response suggests the site may be configured to serve content only after specific conditions are met, a pattern commonly observed in credential‑harvesting pages. Defenders should add elevens.now to DNS and URL filtering policies, enforce TLS inspection to capture any payload delivered after the initial 403 response, and monitor for similar Cloudflare‑hosted domains that use the same nameserver pair. Email security gateways should be tuned to flag any messages referencing the observed page title or the across brand. Continuous threat‑intel feeds should be consulted for new indicators related to this infrastructure.