CSIRT Italia warns send-au.eu.cc PagoPA/SEND fine smishing page
CSIRT Italia warns of renewed smishing claiming PagoPA/SEND fines; links lead to send-au.eu.cc to steal logins and card data. PagoPA and SEND are impersonated.
- First reported
- Reports
- 1
Source: acn.gov.it · published
What happened
Italy's national cybersecurity agency, the Agenzia per la Cybersicurezza Nazionale (ACN), published alert AL01/261106/CSIRT-ITA through CSIRT Italia on 6 November 2026. It warns of a renewed smishing campaign themed on SEND, the national digital notification service, and PagoPA. The text messages appear to come from PagoPA services, claim the recipient has received an administrative fine and urge them to check the notice through a malicious link. PagoPA and SEND are impersonated and are not involved in the messages.
How the scam works
According to the alert, clicking the link leads to a fraudulent page that imitates the official SEND / PagoPA interface. Its purpose is to steal personal data, login credentials and payment information from people who believe they are viewing or paying a real fine. Fines and official notices in Italy are increasingly delivered digitally, which makes a text about an unpaid penalty sound plausible, and the threat of extra charges for late payment pushes people to act before checking.
ACN rates the alert's criticality as medium (Medio, 40.0 on its scale) and lists the indicator of compromise hxxps[://]send-au[.]eu[.]cc/it. It describes the activity as a new phase of a campaign it had already reported in an earlier alert dated 15 June 2026. The recommended actions are to be wary of unexpected messages, especially those that use alarming tones or invite you to click a link to check a notice, and to verify any communication only through the official app or website of the service concerned rather than through links received by SMS.
People who entered card details on the fake page should contact their bank or card issuer at once to block the card, and anyone who typed in SPID or other login credentials should change them through the official provider. The address send-au.eu.cc is not a PagoPA or SEND domain.
Source
ACN / CSIRT Italia alert AL01/261106/CSIRT-ITA, 6 November 2026: https://www.acn.gov.it/portale/w/rilevata-campagna-di-smishing/phishing-a-tema-pagopa
Red flags
- A text saying you have an administrative fine and must check it through a link.
- A link to an address such as send-au.eu.cc rather than an official PagoPA or SEND site.
- An alarming tone or threat of extra penalties for not acting immediately.
- A page asking for login credentials and card details to view or pay a notice.
- A message that appears to come from PagoPA services but arrives by ordinary SMS.
If you were targeted
- 1Do not tap links in texts about fines or official notices.
- 2Check any notice by opening the official app IO, the SEND website or the PagoPA site yourself.
- 3If you entered card details, call your bank to block the card and dispute any charges.
- 4If you entered login credentials, change them through the official provider straight away.
- 5Report the message to CSIRT Italia or the Polizia Postale and delete it.