WEBSITE ANALYSIS REPORT

https://veranexe.com/?TjCfVIOZ&ref=wolfgang.haase@fill.co.at

02 Apr 2026 · 08:46:03.000 UTCpublic

Report tags: microsoft phishing outlook gcore aitm
Submit tags

Request review

Phishing detected

4 detections · review the detection signals

Review evidence →

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

08:45:33.551 GET 200 document 2.2 KB 440 ms 2 alerts

08:45:34.152 GET 302 script 49.9 KB 38 ms —

08:45:34.177 GET 200 script 49.9 KB 11 ms —

08:45:34.246 GET 200 img 156 B 343 ms 3 alerts

08:45:34.271 GET 200 subdocument 198.1 KB 18 ms —

08:45:34.347 GET 200 img 86 B 4 ms —

08:45:34.665 POST 200 xhr 250.3 KB 74 ms —

08:45:35.117 GET 200 img 332 B 4 ms —

08:45:35.145 GET 401 fetch 1 B 5 ms —

08:45:36.123 POST 200 xhr 30.2 KB 37 ms —

08:45:46.713 POST 200 xhr 4.8 KB 35 ms —

08:45:46.843 POST 200 document 3.5 KB 705 ms 2 alerts

08:45:47.578 GET 200 img 3.1 KB 375 ms —

08:45:47.682 GET No response img 0 B 0 ms 2 alerts

08:45:47.978 GET 302 document 47.1 KB 1012 ms 2 alerts

08:45:48.990 GET 200 document 47.1 KB 2257 ms 2 alerts

Transaction #07

Request / response

URL

GET HTTPS

https://veranexe.com/e/4dl5de?d=Lz9sb2dpbl9oaW50PXdvbGZnYW5nLmhhYXNlQGZpbGwuY28uYXQ=

IP / ASN

188.114.97.1

AS13335 · CLOUDFLARENET

Requested by: Not recorded

Resource information

File type: HTML document, Unicode text, UTF-8 text, with very long lines (29442), with CRLF, LF line terminators
MIME type: text/html; charset=utf-8
First seen (UTC): 02 Apr 2026 · 08:46:17.100 UTC
Last seen (UTC): 02 Apr 2026 · 08:46:17.100 UTC
Times seen: 1

Size: 47.1 KB (48206 bytes)
MD5: 8617f6bf1fe497d0df971c5776ffee86
SHA1: a9b20cf1b9c2a58e615c6d2196a5e23f069db1da
SHA256: eebdfd5fdad302ddd67ffe3a324cecbcf88bb52476530b18d9aa05ca1567f39b

Certificate information

Issuer: Let's Encrypt · E8
Subject: veranexe.com
Protocol / cipher: TLSv1.3 · TLS_AES_128_GCM_SHA256
SHA1 fingerprint: 22:58:A7:CC:F1:9E:42:0A:A2:1C:31:48:EF:54:B0:23:E3:31:9E:E9
Valid from: Tue, 31 Mar 2026 07:52:26 GMT
Valid until: Mon, 29 Jun 2026 07:52:25 GMT

Technology fingerprints

Cloudflare (CDN)

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
urlquery Phishing - Microsoft	medium	Phishing
urlquery Phishing - Microsoft Outlook	medium	Phishing

HTTP headers

Request headers

GET /e/4dl5de?d=Lz9sb2dpbl9oaW50PXdvbGZnYW5nLmhhYXNlQGZpbGwuY28uYXQ= HTTP/1.1
Host: veranexe.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://veranexe.com/oauth/authorize?client_id=e6640ad7f80fefc05582cf5c&redirect_uri=https%3A%2F%2Fveranexe.com%2Fcallback&scope=channels%3Aread%2Cchat%3Awrite&state=2jCQygM_2DtaLlJN3CcEJlKo5ok&response_type=code
DNT: 1
Connection: keep-alive
Cookie: qPdM=ogtoFGuigKyQ; fd7b-9f70=9b207a384131e6541b144c83f8ca99ba0c2d79498a369336f9a1b772c6cfee31
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/3 200 OK
date: Thu, 02 Apr 2026 08:45:51 GMT
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store
priority: u=1,i=?0
cross-origin-opener-policy-report-only: same-origin; report-to="coop-endpoint"
expires: -1
link: <https://aadcdn.msftauth.net>; rel=preconnect; crossorigin, <https://aadcdn.msftauth.net>; rel=preconnect; crossorigin,<https://aadcdn.msftauth.net>; rel=dns-prefetch, <https://aadcdn.msftauth.net>; rel=preconnect; crossorigin,<https://aadcdn.msftauth.net>; rel=dns-prefetch,<https://aadcdn.msauth.net>; rel=dns-prefetch
p3p: CP="DSP CUR OTPi IND OTRi ONL FIN"
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
reporting-endpoints: coop-endpoint="https://idux.azurewebsites.net:443/api/coopReport?client_type=none-none&client_id=https%3a%2f%2fportal.microsoftonline.com.orgid.com&correlation_id=f94594d9-1afb-4003-a7c6-499de080b257&tenant=475130ab-62b5-4241-a9d3-47e37c9bc215"
set-cookie: buid=1.AWAAqzBRR7ViQUKp00fjfJvCFakreHKQRANPjYJWI3DqNWYAAABgAA.AQABGgEAAACvnsHKEvvRQb3Bz3Qc7wnaRXZvU3RzQXJ0aWZhY3RzAwAAAAAAGgd58alxpsD1KPZnW-45M7Mh2LhmxX_LExiaUJWEte95paqGPtQbj5NNKtXvFtVgesY5LELMkBVw2V8gDDE8gg7d6ZlnaOCz004xD1tsPsUgAA; Path=/; Expires=Sat, 02 May 2026 08:45:49 GMT; HttpOnly; Secure; SameSite=None
esctx=PAQABBwEAAACvnsHKEvvRQb3Bz3Qc7wnaRXZvU3RzQXJ0aWZhY3RzDQAAAAAAcdvJ4T1-isyT8812zkoc-F_JFTtnEQ0O72WCRCy2X5ZzZGDO9PhWT_l5HQbHr1BJU34F9_NFY0cDFmeh7oECSZswWSzB-cU902t2pLgcmKxCJrXZ5MnvR_85YoUHWC4dkX-SXe5B2CHtiuTL6qEJO4pcgjHLvdTRQH4lJDfQ9F0gAA; Path=/; Domain=veranexe.com; HttpOnly; Secure; SameSite=None
esctx-fkqmtZvIvg=AQABCQEAAACvnsHKEvvRQb3Bz3Qc7wnaRXZvU3RzQXJ0aWZhY3RzDQAAAAAAzxvQRNmfXuvKcTujRMenxqqnJ3CClGshoeeWnDH1VHmDQtCH6_29j9R3_2T07QIluFvTUS4neEf3iRIOFfERzqh7X-FvvXiJlcRPKfMvGkN56Epx1rpuNbkvzWQZy1ZC3nQyDExEFUpWNhAQeTi1MCAA; Path=/; Domain=veranexe.com; HttpOnly; Secure; SameSite=None
fpc=AkgQC87pN3tNvcpO-ro0Cgu4vjNwAQAAALwjYOEOAAAA; Path=/; Expires=Sat, 02 May 2026 08:45:50 GMT; HttpOnly; Secure; SameSite=None
x-ms-gateway-slice=estsfd; Path=/; HttpOnly; Secure; SameSite=None
stsservicecookie=estsfd; Path=/; HttpOnly; Secure; SameSite=None
vary: Accept-Encoding
x-dns-prefetch-control: on
x-ms-ests-server: 2.1.23834.3 - SEC ProdSlices
x-ms-request-id: 9e103277-0f9d-4f2d-9d21-731ab8ae5300
x-ms-srs: 1.P
cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=y71SAObYmHcHa3cyWFu2gZcsUCx1syljPLCjDw80aJN8u06r%2Fno5w5mMVXBjFouZT71aqgCIkxkLi7r2Vp6uuy0K3XQYLDaQzbnIRGcRcXdRRlte5KCxXWQoXVwyr%2Fc%3D"}]}
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-encoding: br
server: cloudflare
cf-ray: 9e5e8f3d288c56c9-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri

08:45:51.257 GET 200 stylesheet 111.5 KB 467 ms 2 alerts

08:45:51.259 GET 200 script 456.7 KB 579 ms 2 alerts

08:45:51.260 GET 200 script 60.3 KB 471 ms 2 alerts

08:45:51.261 GET 200 script 2 B 382 ms 2 alerts

08:45:51.887 GET 200 script 185.7 KB 516 ms 2 alerts

08:45:52.016 GET 200 img 16.8 KB 390 ms 2 alerts

08:45:52.461 GET 200 script 397.9 KB 579 ms 2 alerts

08:45:52.524 GET 404 subdocument 1.2 KB 961 ms —

https://veranexe.com/?TjCfVIOZ&ref=wolfgang.haase@fill.co.at

Domain graph

Hostnames

Connections

Network requests

Transaction #07

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

Display preferences

Go to…

Notifications

Full request body

Full screenshot

>https://veranexe.com/?TjCfVIOZ&ref=wolfgang.haase@fill.co.at

[Domain graph]

Hostnames

Connections

[Network requests]

Transaction #07

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

https://veranexe.com/?TjCfVIOZ&ref=wolfgang.haase@fill.co.at

Domain graph

Network requests