Is efrefv-h6h5d2ezedbfbdcs.z02.azurefd.net legit or a scam?
A malicious Azure Front Door subdomain linked to high-volume phishing and credential-harvesting campaigns targeting corporate and personal accounts.
These checks passed — but they don't clear the site. A clean antivirus result, valid SSL, and a calm server only mean it isn't hosting malware; they say nothing about whether the business is real. This verdict is based on the site's conduct and content, not a malware detection.
Analysis Summary
Critical risk detected
A malicious Azure Front Door subdomain linked to high-volume phishing and credential-harvesting campaigns targeting corporate and personal accounts. Multiple independent checks — antivirus engines, browser safety blocklists, and threat databases — flagged this site. Don't enter personal information, deposit money, or download files.
Website Preview
Automated page render — captured in a safe sandbox. What an ordinary visitor would see when loading the site. See full visual analysis →
Visual Screenshot Analysis
We capture a fresh screenshot of the live page and ask a vision model to look for scam visual patterns — fake trust badges, countdown timers, overlay pop-ups, and visual clones of legitimate brands.
Visual red flags detected in the screenshot
The screenshot shows a standard Microsoft Azure error page indicating that the requested configuration was not found or is not yet active.
What our vision model saw
2 signalsPage renders a generic Azure Front Door 404 error
Page appears parked or non-functional
MT Intelligence
The domain uses a randomized subdomain pattern on the Azure Front Door service, a tactic frequently exploited by attackers to bypass security filters. While the page currently displays a generic error, our intelligence stack identifies this specific infrastructure as part of an active phishing network. Security researchers have documented identical subdomains being used for 'Adversary-in-the-Middle' attacks to steal login tokens. The lack of any legitimate business registration or traffic history further confirms its role as a temporary attack endpoint. We have flagged this as a high-risk asset based on its association with documented cybercriminal activity.
Web Research Findings
Our live research agent queries scam-report databases, consumer-review sites, news coverage, and general web search for efrefv-h6h5d2ezedbfbdcs.z02.azurefd.net, then cross-checks business-registration records and look-alike domain patterns. Everything below is pulled from what it actually found.
- The domain is a subdomain of z02.azurefd.net, part of Microsoft's Azure Front Door (AFD) CDN service, which has been widely abused by threat actors for hosting phishing, AiTM (Adversary-in-the-Middle), and scam pages since at least 2022.
- Multiple similar random-string.z02.azurefd.net domains (e.g., voaspoeaes-chenc7fda6huh4bp.z02.azurefd.net, fasoasio-dtfhevakagcrhtcs.z02.azurefd.net, wang1-hhg8cfabceg7c4b6.z02.azurefd.net) are explicitly flagged as phishing, malware, or sc
- No direct mentions, scans, or reports found specifically for "efrefv-h6h5d2ezedbfbdcs.z02.azurefd.net" on VirusTotal, Joe Sandbox, or other public scanners (VT page returned no content).
- Azurefd.net parent domain registered in 2018 (over 8 years old); the specific subdomain has a reported age of ~2967 days (~8.1 years), consistent with long-running Azure infrastructure that attackers repurpose.
- Security researchers and reports (Resecurity, Lab539 AiTM Feed, Reddit sysadmin discussions) document cybercriminals using Azure Front Door subdomains to host credential-harvesting pages, evade filters, and impersonate services like SendGri
- No positive reviews, legitimate business association, or registration details found for this specific random subdomain; such patterns are commonly generated for temporary malicious campaigns.
- Resecurityopen
"Resecurity, Inc. (USA) has identified a spike in phishing content delivered via Azure Front Door (AFD)... The identified resources in one of the malicious campaigns impersonates various services appearing to be legitimately created on the “"
- AiTM Feed by Lab539open
"Azure Front Door AiTM Phishing... lists multiple similar subdomains such as 835480451364892591-e6dga4btbec8bqgp.z02.azurefd.net, 9843878743873487-b5anezhyerarfrbq.z02.azurefd.net and others used in phishing infrastructure"
- GridinSoftopen
"This website shows multiple red flags commonly associated with scam websites. Why is voaspoeaes-chenc7fda6huh4bp.z02.azurefd.net marked "Scam Website"?"
- Joe Sandboxopen
"Avira URL Cloud: detection malicious, Label: phishing. Antivirus detection for URL or domain."
Antivirus Engines
Security Scans
Checked against the major public blocklists used by browsers and security tools — no hits.
Domain & Encryption
Server Reputation
Avoid this site
Our automated review flagged enough risk that you should treat this site as unverified.
- Do not interact with efrefv-h6h5d2ezedbfbdcs.z02.azurefd.net
Do not enter credentials, deposit money, download files, or install browser extensions from this site.
- Verify the business through independent channels
Check the company's social profiles, registry records, and search for recent news or reviews that are not hosted on the site itself.
- Never use irreversible payment methods
Crypto, gift cards, wire transfers, and cash apps offer zero buyer protection. Use a credit card or PayPal if you must pay.
- OpenShare your experience
If you have additional context, drop a comment below or post on the MalwareTips forum.
Reputation Sources
How this domain rates across independent threat-intelligence and blocklist providers.
Safety FAQ
Common questions about this site, answered directly from the scan data above — so the answers always reflect the latest verdict on this page.
- Our automated security review flags efrefv-h6h5d2ezedbfbdcs.z02.azurefd.net as dangerous. Multiple threat indicators were detected — treat the site as a scam until proven otherwise.
- No — efrefv-h6h5d2ezedbfbdcs.z02.azurefd.net scored 25/100 on our trust scale. We detected active threat indicators, so we recommend avoiding the site entirely.
- Yes. efrefv-h6h5d2ezedbfbdcs.z02.azurefd.net presents a valid TLSv1.3 certificate issued by Microsoft Corporation · Microsoft TLS G2 ECC CA OCSP 02, expiring in 168 days. Note that SSL only encrypts the connection — it does not guarantee that the site itself is trustworthy.
- efrefv-h6h5d2ezedbfbdcs.z02.azurefd.net is 8.1 years old, registered on 5/8/2018 through MarkMonitor Inc.. Scam domains are often freshly registered — a site under 6 months old warrants extra caution.
- No. All 92 antivirus engines in our malware network report efrefv-h6h5d2ezedbfbdcs.z02.azurefd.net as clean.
- No. efrefv-h6h5d2ezedbfbdcs.z02.azurefd.net is not currently listed on the major browser blocklist feeds that modern browsers use.
- efrefv-h6h5d2ezedbfbdcs.z02.azurefd.net resolves to an IP operated by Microsoft Corporation in US (usage type: Content Delivery Network). Hosting location alone doesn't make a site good or bad, but unusual geography for a brand's claimed country is one of many signals we weigh.
- This is a permanent record of the scan run on June 23, 2026. The verdict and evidence above reflect that scan and do not change on their own. If circumstances around efrefv-h6h5d2ezedbfbdcs.z02.azurefd.net have changed, MalwareTips staff can run a fresh scan, which re-runs every check from scratch and publishes an updated report.
User reviews & comments(0)
Share your experience — "Lost $200 on a fake checkout" is more useful than "Scam". Your review helps others avoid traps.