alvbd2nj5bmkau-e3cwh9amaqfygaar[.]z02[.]azurefd[.]net

Analysis of the domain alvbd2nj5bmkau-e3cwh9amaqfygaar.z02.azurefd.net indicates it was operating as a generic phishing endpoint within Microsoft Azure infrastructure. The domain, registered through MarkMonitor, Inc. on May 8, 2018, resolves to the IP address 13.107.213.40, which is part of AS8075 (Microsoft Corporation) and geolocated in the United States. Infrastructure analysis reveals the use of Azure Front Door and Azure hosting services, with nameservers ns1-37.azure-dns.com, ns2-37.azure-dns.net, ns3-37.azure-dns.org, and ns4-37.azure-dns.info, confirming its integration with Microsoft’s cloud ecosystem. The SSL certificate is issued by Microsoft Corporation under the Microsoft Azure ECC TLS Issuing CA 04, further tying the domain to Azure’s managed services.

At the time of assessment, the domain returned an HTTP 404 status with a page title 'Index of /', suggesting either a misconfigured or decommissioned phishing landing page. No specific brand or scam category was identified in the available metadata, and the exact content of the phishing page remains unconfirmed. Detection data from July 25, 2026, shows that six out of ninety-five security vendors on VirusTotal flagged the domain as malicious. The domain appears on at least one security blocklist and is blocked by PhishDestroy.

Scamadviser assigned a trust score of 15 out of 100, indicating a high level of suspicion. While the domain is now offline, defenders should treat any residual references to this endpoint as indicators of compromise. Network-level blocking of the IP 13.107.213.40 and monitoring for connections to Azure Front Door subdomains with similar naming patterns are recommended. Given the use of legitimate cloud infrastructure, additional scrutiny of Azure-hosted domains with low trust scores or recent creation dates may help identify related phishing activity.