elevens[.]us

Analysis of elevens.us indicates active brand‑impersonation infrastructure targeting PayPal users. The domain was registered on 15 December 2025 through NameCheap, Inc. and is hosted behind Cloudflare, as evidenced by the authoritative nameservers koa.ns.cloudflare.com and naomi.ns.cloudflare.com and the presence of HTTP/3 support. DNS resolution returns the IP address 172.67.154.202, which belongs to AS13335 Cloudflare, Inc. and is geolocated to the United States. An HTTPS certificate issued by Google Trust Services (common name WE1) secures the site, and an HTTP 301 response is observed, suggesting a redirect to a secondary landing page. The page title returned by the server is “Elevens PayPal”, matching the declared brand target of PayPal and the listed scam type of a payment scam. Threat intelligence records show the domain appears in one AlienVault OTX pulse and has been flagged by two of ninety‑three VirusTotal scanners. It is listed on a single security blocklist and is actively blocked by PhishDestroy. No additional malicious payloads or hosting details have been disclosed beyond the observed infrastructure. Defenders should add 172.67.154.202 and the domain elevens.us to network‑level blocklists, monitor DNS queries for the associated Cloudflare nameservers, and enforce URL filtering for any HTTP 301 redirects originating from this domain. Continuous monitoring of threat‑intel feeds for new detections is recommended, as the current evidence suggests a high‑risk, ongoing payment‑scam campaign.