{"report_id":"eb8fdd53-01e1-4c3e-95ad-a248c84c187f","version":0,"status":"done","tags":[],"date":"2026-07-21T20:28:13Z","url":{"schema":"https","addr":"agenziaentrate-gov.lestrani.de/contatta/it/","fqdn":"agenziaentrate-gov.lestrani.de","domain":"lestrani.de","tld":"de"},"ip":{"addr":"202.61.233.84","port":0,"asn":197540,"as":"netcup GmbH","country":"Germany","country_code":"DE"},"final":{"url":{"schema":"https","addr":"agenziaentrate-gov.lestrani.de/contatta/it/","fqdn":"agenziaentrate-gov.lestrani.de","domain":"lestrani.de","tld":"de"},"title":"Agenzia delle Entrate — Richiesta di Rimborso","dom":{"size":19837,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (310)","md5":"e6d386be85b81ef1b4c9d4920135a877","sha1":"6befd2668def965b4938ecbd258a086f9637b709","sha256":"6a5bbdf2c71e2aea5fa966d635c2345ba16c0c2e2519548d843ac8f3d70f720e","sha512":"b41ebb640187b83ec389198e36702ee57e78fd3f81f76119546645a0fd8e2e88e0ba06c10947ecc5e1da2fc5c6c5ff890b9e529af51e7882d32e340f0ed08a93","ssdeep":"384:uUMdW5Q9FGPyt7SHLkXfBhNA7WWUKFTX7h:vID9FGY7SHLkXfcWWUsTrh","tlshash":"d992e76776f704297863d0adafa6e6572725d003c80ec528bbcc5698cfc5dd086a39ec","dom_hash":"domhashb076025d6525b99b7b6b09b6e13c2e98","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"agenziaentrate-gov.lestrani.de/contatta/it/","fqdn":"agenziaentrate-gov.lestrani.de","domain":"lestrani.de","tld":"de"},"ip":{"addr":"202.61.233.84","port":0,"asn":197540,"as":"netcup GmbH","country":"Germany","country_code":"DE"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-25T20:28:13Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-21","alert":"Sinkholed","trigger":"agenziaentrate-gov.lestrani.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-21","alert":"Phishing Block","trigger":"agenziaentrate-gov.lestrani.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-21","alert":"Sinkholed","trigger":"agenziaentrate-gov.lestrani.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-21","alert":"Sinkholed","trigger":"agenziaentrate-gov.lestrani.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"agenziaentrate-gov.lestrani.de","ip":{"addr":"202.61.233.84","port":443,"asn":197540,"as":"netcup GmbH","country":"Germany","country_code":"DE"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-07-20T12:28:31.990761Z","last_seen":"2026-07-20T12:28:31.990761Z","alert_count":8,"request_count":2,"received_data":21052,"sent_data":1059,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"agenziaentrate-gov.lestrani.de/contatta/it/","fqdn":"agenziaentrate-gov.lestrani.de","domain":"lestrani.de","tld":"de"},"ip":{"addr":"202.61.233.84","port":443,"asn":197540,"as":"netcup GmbH","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":true,"md5":"243722aa8d8850ceb3efe6fc99c7920a","sha1":"2be5c8f475835bbd4ba1b9f07ae31aa6d9d44b34","sha256":"f48281e680b097d0aaabf55e731600d0e9e4d7158d270f29fec44973260e8cfe","sha512":"346272db91724ae8c71bffef9d1cc2a0c60ea2d9f95813bfcb3960fe092b9ab290f66fcc5e4cf8c0f34bcb84b31ada34a68739757bf0cf905a57402df2b4b04c","ssdeep":"96:hLTIh9dNdKcCWB1GN7VvMWXpeKmAjb6KF7Pu6NRFr8/iMqQ5EKc5SGDov:ChNdu7WWXw2jb6KFTu6NMvqQydPcv","tlshash":"90c150ab79ea14705db7b0ee6b9bc251762950062845e608be8ca8440fe2e9453b7cf4","size":5730,"data":"","first_seen":"2026-06-12T16:12:25.697591Z","last_seen":"2026-07-21T20:28:13.22359Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"agenziaentrate-gov.lestrani.de/contatta/it/","fqdn":"agenziaentrate-gov.lestrani.de","domain":"lestrani.de","tld":"de"},"ip":{"addr":"202.61.233.84","port":443,"asn":197540,"as":"netcup GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-21T20:27:46.658Z","timestamp":1784665666658,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"agenziaentrate-gov.lestrani.de","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 18 Jul 2026 13:44:32 GMT","end":"Fri, 16 Oct 2026 13:44:31 GMT"},"fingerprint":{"sha1":"ED:8A:C0:84:C3:48:90:E3:8D:C1:18:8A:B2:36:E2:23:C8:BA:F1:C4","sha256":"B1:8F:2F:68:96:E0:48:D5:0E:0E:17:64:15:CB:89:1B:91:65:F1:9C:F0:98:0C:50:D3:31:3F:7C:70:B8:EB:D8"}}},"request":{"raw":"GET /contatta/it/ HTTP/1.1\r\nHost: agenziaentrate-gov.lestrani.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 21 Jul 2026 20:27:46 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 5988\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19816,"size_decoded":6184,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (304)","md5":"5277a11505c198e97a15243fac8a842c","sha1":"855b5dd4d92746fe55ff3245e14fa8bc269c896d","sha256":"9b5fef4a6fa9fa188a6c99d7c9a35e1c8377662435d5d3ad1a31dda1562f0fe0","sha512":"7c4f8378d9052cf77a8c2e2ed30ccc32207a68d3cbacadcba3da560e2656ffe38050d3b5782d81b58a65c5e37093a54bd7ebc2d39deae376fa9f160bc55f46c4","ssdeep":"384:MUMdX5Q9FGPJmGNSHysYfEFhNA7WWUKFTX7F:xIy9FGgASHysYfVWWUsTrF","tlshash":"6892f76776f704297863d0adbfa6e6572725d003c40ac628bbcc5648cfc6dd086a39ec","first_seen":"2026-06-12T16:12:25.695868Z","last_seen":"2026-07-21T20:28:13.220003Z","times_seen":5,"resource_available":true,"data":null}},"time_used":152,"timings":{"blocked":-1,"dns":31,"connect":29,"send":0,"wait":51,"receive":0,"ssl":40},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-21","alert":"Sinkholed","trigger":"agenziaentrate-gov.lestrani.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-21","alert":"Phishing Block","trigger":"agenziaentrate-gov.lestrani.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-21","alert":"Sinkholed","trigger":"agenziaentrate-gov.lestrani.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-21","alert":"Sinkholed","trigger":"agenziaentrate-gov.lestrani.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"agenziaentrate-gov.lestrani.de/favicon.ico","fqdn":"agenziaentrate-gov.lestrani.de","domain":"lestrani.de","tld":"de"},"ip":{"addr":"202.61.233.84","port":443,"asn":197540,"as":"netcup GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://agenziaentrate-gov.lestrani.de/contatta/it/","date":"2026-07-21T20:27:47.029Z","timestamp":1784665667029,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"agenziaentrate-gov.lestrani.de","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 18 Jul 2026 13:44:32 GMT","end":"Fri, 16 Oct 2026 13:44:31 GMT"},"fingerprint":{"sha1":"ED:8A:C0:84:C3:48:90:E3:8D:C1:18:8A:B2:36:E2:23:C8:BA:F1:C4","sha256":"B1:8F:2F:68:96:E0:48:D5:0E:0E:17:64:15:CB:89:1B:91:65:F1:9C:F0:98:0C:50:D3:31:3F:7C:70:B8:EB:D8"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: agenziaentrate-gov.lestrani.de\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://agenziaentrate-gov.lestrani.de/contatta/it/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\nserver: nginx\r\ndate: Tue, 21 Jul 2026 20:27:47 GMT\r\ncontent-type: text/html\r\nvary: Accept-Encoding\r\nlast-modified: Tue, 24 Sep 2024 14:51:02 GMT\r\netag: W/\"328-622dea25f510a\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":602,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-07-21T23:18:33.996531Z","times_seen":38406,"resource_available":true,"data":null}},"time_used":44,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":44,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-21","alert":"Sinkholed","trigger":"agenziaentrate-gov.lestrani.de","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-21","alert":"Phishing Block","trigger":"agenziaentrate-gov.lestrani.de","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-21","alert":"Sinkholed","trigger":"agenziaentrate-gov.lestrani.de","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-21","alert":"Sinkholed","trigger":"agenziaentrate-gov.lestrani.de","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}