11januari[.]xyz

PhishDestroy identifies 11januari.xyz as an active crypto-drainer domain that attempts to trick visitors into connecting wallets or revealing private keys. Security vendors already caught the site: VirusTotal’s latest scan shows 2 out of 95 engines detecting the threat, and its SSL certificate is issued by Google Trust Services—so the padlock alone cannot be trusted. The domain itself was created on January 16, 2025 and is registered through Namecheap Inc, which explains rapid turnaround from idea to live page.

This domain is still young and therefore changes quickly, so it can slip past simple blocklists. Its IP address is 188.114.97.3, a known bulletproof-hosting range often reused for short-lived phishing kits. Attackers commonly recycle January-themed domains like “11januari” during the start of the year to exploit resolution noise and end-of-year fatigue. Because the site is only days old, it has not yet been widely blacklisted, making it riskier than older phishing pages.

If you visited 11januari.xyz or connected any wallet or app, immediately revoke any approvals you granted, transfer assets to a new wallet, and scan your device with updated antivirus software. Do not re-enter your seed phrase or private key anywhere else on the site. Report the domain to your wallet provider and consider freezing or monitoring the affected addresses for draining transactions. Enable hardware wallet signing for added protection on future transactions.