WEBSITE ANALYSIS REPORT

https://veranexe.com/?TjCfVIOZ&ref=wolfgang.haase@fill.co.at

02 Apr 2026 · 08:46:03.000 UTCpublic

Report tags: microsoft phishing outlook gcore aitm
Submit tags

Request review

Phishing detected

4 detections · review the detection signals

Review evidence →

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

08:45:33.551 GET 200 document 2.2 KB 440 ms 2 alerts

08:45:34.152 GET 302 script 49.9 KB 38 ms —

08:45:34.177 GET 200 script 49.9 KB 11 ms —

08:45:34.246 GET 200 img 156 B 343 ms 3 alerts

08:45:34.271 GET 200 subdocument 198.1 KB 18 ms —

08:45:34.347 GET 200 img 86 B 4 ms —

08:45:34.665 POST 200 xhr 250.3 KB 74 ms —

08:45:35.117 GET 200 img 332 B 4 ms —

08:45:35.145 GET 401 fetch 1 B 5 ms —

08:45:36.123 POST 200 xhr 30.2 KB 37 ms —

08:45:46.713 POST 200 xhr 4.8 KB 35 ms —

08:45:46.843 POST 200 document 3.5 KB 705 ms 2 alerts

08:45:47.578 GET 200 img 3.1 KB 375 ms —

08:45:47.682 GET No response img 0 B 0 ms 2 alerts

08:45:47.978 GET 302 document 47.1 KB 1012 ms 2 alerts

08:45:48.990 GET 200 document 47.1 KB 2257 ms 2 alerts

08:45:51.257 GET 200 stylesheet 111.5 KB 467 ms 2 alerts

Transaction #08

Request / response

URL

GET HTTPS

https://veranexe.com/cdn/msftauth/ests/2.1/content/cdnbundles/converged.v2.login.min_pzfy2abhlubh6bv_dyvwha2.css

IP / ASN

188.114.97.1

AS13335 · CLOUDFLARENET

Requested by: https://veranexe.com/e/4dl5de?d=Lz9sb2dpbl9oaW50PXdvbGZnYW5nLmhhYXNlQGZpbGwuY28uYXQ=

Resource information

File type: ASCII text, with very long lines (61177)
MIME type: text/css
First seen (UTC): 31 Jan 2026 · 07:14:15.069 UTC
Last seen (UTC): 23 Oct 2026 · 17:46:44.261 UTC
Times seen: 27667

Size: 111.5 KB (114193 bytes)
MD5: a737f2d9a0612ee6c7e8157f0f25561c
SHA1: 6a3ebbbe76750cbafb5c75e2386f66fe09775120
SHA256: 2614197647b9e4c6ee27983866ea7e9423de6e9f9b76cb880653324f329fc6a7

Certificate information

Issuer: Let's Encrypt · E8
Subject: veranexe.com
Protocol / cipher: TLSv1.3 · TLS_AES_128_GCM_SHA256
SHA1 fingerprint: 22:58:A7:CC:F1:9E:42:0A:A2:1C:31:48:EF:54:B0:23:E3:31:9E:E9
Valid from: Tue, 31 Mar 2026 07:52:26 GMT
Valid until: Mon, 29 Jun 2026 07:52:25 GMT

Technology fingerprints

Cloudflare (CDN)

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
urlquery Phishing - Microsoft	medium	Phishing
urlquery Phishing - Microsoft Outlook	medium	Phishing

HTTP headers

Request headers

GET /cdn/msftauth/ests/2.1/content/cdnbundles/converged.v2.login.min_pzfy2abhlubh6bv_dyvwha2.css HTTP/1.1
Host: veranexe.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://veranexe.com/e/4dl5de?d=Lz9sb2dpbl9oaW50PXdvbGZnYW5nLmhhYXNlQGZpbGwuY28uYXQ=
DNT: 1
Connection: keep-alive
Cookie: qPdM=ogtoFGuigKyQ; fd7b-9f70=9b207a384131e6541b144c83f8ca99ba0c2d79498a369336f9a1b772c6cfee31; buid=1.AWAAqzBRR7ViQUKp00fjfJvCFakreHKQRANPjYJWI3DqNWYAAABgAA.AQABGgEAAACvnsHKEvvRQb3Bz3Qc7wnaRXZvU3RzQXJ0aWZhY3RzAwAAAAAAGgd58alxpsD1KPZnW-45M7Mh2LhmxX_LExiaUJWEte95paqGPtQbj5NNKtXvFtVgesY5LELMkBVw2V8gDDE8gg7d6ZlnaOCz004xD1tsPsUgAA; esctx=PAQABBwEAAACvnsHKEvvRQb3Bz3Qc7wnaRXZvU3RzQXJ0aWZhY3RzDQAAAAAAcdvJ4T1-isyT8812zkoc-F_JFTtnEQ0O72WCRCy2X5ZzZGDO9PhWT_l5HQbHr1BJU34F9_NFY0cDFmeh7oECSZswWSzB-cU902t2pLgcmKxCJrXZ5MnvR_85YoUHWC4dkX-SXe5B2CHtiuTL6qEJO4pcgjHLvdTRQH4lJDfQ9F0gAA; esctx-fkqmtZvIvg=AQABCQEAAACvnsHKEvvRQb3Bz3Qc7wnaRXZvU3RzQXJ0aWZhY3RzDQAAAAAAzxvQRNmfXuvKcTujRMenxqqnJ3CClGshoeeWnDH1VHmDQtCH6_29j9R3_2T07QIluFvTUS4neEf3iRIOFfERzqh7X-FvvXiJlcRPKfMvGkN56Epx1rpuNbkvzWQZy1ZC3nQyDExEFUpWNhAQeTi1MCAA; fpc=AkgQC87pN3tNvcpO-ro0Cgu4vjNwAQAAALwjYOEOAAAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
Sec-Fetch-Dest: style
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/3 200 OK
date: Thu, 02 Apr 2026 08:45:51 GMT
content-type: text/css
accept-ranges: bytes
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges,Cache-Control,Content-Encoding,Content-Length,Content-MD5,Content-Type,Date,ETag,Last-Modified,Server,x-ms-request-id,x-ms-version
akamai-grn: 0.11ff4817.1775119551.f9b8a8
cache-control: public, max-age=25662642
priority: u=2,i=?0
content-encoding: gzip
content-md5: NfbpJ7dD5cUe3GnmkXK2jA==
etag: "0x8DE5AE8AF679C70"
last-modified: Sat, 24 Jan 2026 01:34:15 GMT
vary: Accept-Encoding
x-ms-request-id: c9ad9c73-e01e-0074-2512-8db597000000
x-ms-version: 2018-03-28
cf-cache-status: MISS
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=2e%2BH%2FqUHnF1Mcg7tAf2vDGnPViEUfmKr%2FIK4VTNAnxANc9NCpn5428MT%2BNr6OZR1zWGFFJpTG9aCHRn%2FuiWs38g8sBllyFNgzDtJUNktCZYB%2BFfxQ%2FuxplzHzm4V8I0%3D"}]}
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
server: cloudflare
cf-ray: 9e5e8f4b5d7156c9-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri

08:45:51.259 GET 200 script 456.7 KB 579 ms 2 alerts

08:45:51.260 GET 200 script 60.3 KB 471 ms 2 alerts

08:45:51.261 GET 200 script 2 B 382 ms 2 alerts

08:45:51.887 GET 200 script 185.7 KB 516 ms 2 alerts

08:45:52.016 GET 200 img 16.8 KB 390 ms 2 alerts

08:45:52.461 GET 200 script 397.9 KB 579 ms 2 alerts

08:45:52.524 GET 404 subdocument 1.2 KB 961 ms —

https://veranexe.com/?TjCfVIOZ&ref=wolfgang.haase@fill.co.at

Domain graph

Hostnames

Connections

Network requests

Transaction #08

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

Display preferences

Go to…

Notifications

Full request body

Full screenshot

>https://veranexe.com/?TjCfVIOZ&ref=wolfgang.haase@fill.co.at

[Domain graph]

Hostnames

Connections

[Network requests]

Transaction #08

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

https://veranexe.com/?TjCfVIOZ&ref=wolfgang.haase@fill.co.at

Domain graph

Network requests