elevenslauncher[.]com

On July 24, 2026, analysis of the domain elevenslauncher.com shows that it has been taken offline but retains a set of indicators consistent with a crypto‑draining impersonation campaign targeting the brand “across”. The domain was registered on 17 December 2025 through NameCheap, Inc. and resolves to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geo‑located in the United States. The hosting infrastructure is protected by Cloudflare, with the site served over HTTP/3 and a TLS certificate issued by Google Trust Services under the WE1 label. Nameserver entries point to koa.ns.cloudflare.com and naomi.ns.cloudflare.com, confirming Cloudflare as the DNS provider. Reputation checks indicate a severe lack of trust: Gridinsoft assigned a 0 / 100 score, and the domain appears on a single security blocklist.

PhishDestroy has also listed the domain as blocked. VirusTotal analysis reports that two out of ninety‑three scanners flagged the site, though the specific detection signatures are not disclosed. No additional public blocklist or Safe Browsing entries were observed beyond the mentioned listings. The page title returned from the live host before takedown reads “Clearer messaging — stronger relationships | Elevens”, suggesting the attacker may have reused content from a legitimate Elevens site to increase credibility. The declared scam type is “Crypto Scam”, indicating that any luring pages are likely to request cryptocurrency payments or wallet information.

No further details on the landing page structure, phishing kits, or command‑and‑control endpoints are available, leaving the exact malicious payload unknown. Defenders should continue to monitor the IP address 188.114.97.3 for any re‑use by related domains, enforce outbound network controls that block connections to known Cloudflare‑served malicious domains, and add elevenslauncher.com to internal blocklists.