agenziaentrate-gov[.]lestrani[.]de

This domain, agenziaentrate-gov.lestrani.de, is actively flagged as a high-risk phishing site targeting users of the Italian Tax Agency (Agenzia delle Entrate). Analysis indicates the domain is hosted on infrastructure associated with netcup GmbH, resolving to IP address 202.61.233.84. The nameservers—root-dns.netcup.net, second-dns.netcup.net, and third-dns.netcup.net—are consistent with netcup’s hosting environment, a provider frequently used for both legitimate and malicious domains. As of July 21, 2026, the domain remains active and is blocked by at least one security vendor (PhishDestroy), with eight of ninety-five security vendors on VirusTotal detecting it as malicious.

It also appears on one additional security blocklist. The domain’s structure, incorporating 'agenziaentrate-gov' in the subdomain, strongly suggests an intent to deceive users into believing it is an official government portal. No further details about the exact content, phishing kit, or payload are available at this time, as the site has not been fully analyzed for visual or functional mimicry.

Defenders should treat this domain as a confirmed phishing threat targeting Italian taxpayers or government service users. Immediate action is recommended, including blocking the domain at DNS and proxy levels, monitoring for connections to the associated IP (202.61.233.84), and alerting users to avoid interaction with any communications or links referencing this domain. Further investigation into the hosting provider’s abuse contacts may yield additional takedown opportunities.