When you come across a subdomain like evault6.sd.inditex.com, it's natural to wonder if it belongs to the Inditex group behind Zara and Pull&Bear. The domain does resolve to a Microsoft-hosted server, but that's where the positive signals end. The website is not reachable — it returns a 404 error, and the SSL certificate is mismatched, issued for Microsoft's proxy services rather than this hostname. For any legitimate internal tool that is exposed to the internet, a valid certificate and a reachable page are baseline requirements. A site that fails both is either misconfigured or not intended for public access. There is no contact information, about page, or terms of service, which would be worrying for a consumer-facing service but is consistent with an internal tool that was never meant to be visited directly. If you are checking whether evault6.sd.inditex.com is a scam or fake, the evidence points not to a scam but to a non-functional or private subdomain. The safest course is to treat it as off-limits until the configuration issues are resolved and the site is clearly presented for public use.
No — evault6.sd.inditex.com doesn't look safe
In plain English
evault6.sd.inditex.com is not a working public website. The domain has an invalid SSL certificate and is unreachable, pointing to a misconfigured or internal-only service. While the parent company Inditex is legitimate, this subdomain shows signs of not being intended for public use. You should not attempt to access or trust it.
What you should do now
Don't panic. These steps limit the damage, and the sooner you take them the better.
Don't enter any details
No passwords, card numbers or personal information — even if the site looks professional.
Close the tab
Especially if you got here from an email, text message or social media ad.
Already paid? Call your bank
Contact your bank or card provider right away. They can often stop or reverse a recent payment.
Warn others
Report the site and share this check with anyone who sent you the link.
Where the score comes from
The site is unreachable because the SSL certificate was issued for Microsoft's proxy services, not this domain. That is a severe configuration failure for any service that is meant to be accessed securely.
This is a subdomain of inditex.com, a well-known retail parent company. But the specific subdomain has no registered WHOIS record of its own, which is normal for subdomains. The connection to a trusted brand provides some baseline assurance, but the subdomain's purpose is unclear.
No blacklists have picked up this domain, and there are no phishing reports. However, there is no web archive history or traffic ranking, meaning this subdomain either is very new or was never a publicly used site.
There is no contact information, about page, or any social media presence. For a public-facing service, this lack of transparency is a serious red flag. Even for an internal tool, some minimal disclosure would be expected if it were reachable from the internet.
No privacy policy or terms of service were found. Since this appears to be an internal infrastructure subdomain rather than a commercial website, missing legal pages is not a compliance concern. A consumer service would require them, but this site doesn't present itself as one.
The domain resolves to a Microsoft IP address, but the website returns a 404 error and cannot be reached over HTTPS. The server configuration is incomplete or misconfigured, and common browser protections like clickjacking prevention are absent.
What we checked
Think this verdict is wrong?
Site owners can request a fresh scan. Scores update automatically as signals change.