121deo[.]senes[.]at

This domain, 121deo.senes.at, is flagged as a high-risk generic phishing infrastructure targeting cryptocurrency users. Analysis indicates the domain is designed to impersonate legitimate crypto wallet interfaces, likely deploying a drainer kit to siphon digital assets from victims. The threat type aligns with known patterns of credential harvesting and automated transaction redirection, common in crypto-focused phishing campaigns. Infrastructure analysis reveals the following technical indicators: the domain was registered on June 12, 2026, and resolves to the IP address 172.86.95.123. It holds a VirusTotal detection score of 19/95, with security vendors flagging it for malicious activity. The domain appears on three security blocklists, including high-confidence sources, and uses a Let's Encrypt SSL certificate (R13). The creation date suggests a recently deployed attack vector, while the IP address has no prior association with legitimate services. Currently, 121deo.senes.at is offline, reducing immediate exposure risk. However, the domain remains a latent threat due to its recent registration and unresolved infrastructure. Users who interacted with the domain should revoke active sessions, rotate credentials, and monitor wallet addresses for unauthorized transactions. Organizations are advised to block the domain, IP, and associated SSL certificate hashes in perimeter defenses to prevent future access attempts. The high-risk classification persists until the domain is permanently sinkholed or seized by authorities.