# preference-centers.web.app Email Preference Center | PhishDestroy

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/preference-centers.web.app/
Machine-readable companion: https://phishdestroy.io/domain/preference-centers.web.app/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-11-02 04:23:53 UTC
- Last availability or vendor check: 2026-11-02 04:23:53 UTC
- Stored record updated: 2026-11-02 05:30:21 UTC
- VirusTotal detections in the stored snapshot: 13/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: checked_clean

## Stored infrastructure

- Observed IP address: 199.36.158.100
- Registrar in stored WHOIS data: Google LLC
- Last stored HTTP status: 200
- Registration date (registry RDAP, web.app): 2019-01-08 22:05:04 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a19a7e-a80f-77ec-9284-1e97b91d4272/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/preference-centers.web.app
- Certificate Transparency search: https://crt.sh/?q=%25.preference-centers.web.app
- Web Archive lookup: https://web.archive.org/web/*/https://preference-centers.web.app/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Public report package

PhishDestroy describes the Email Preference Center page captured at preference-centers.web.app, including its welcome notice and abuse-reporting links.

The captured page presents itself as an Email Preference Center and opens with a welcome heading that names preference-centers.md02.com rather than the record's domain. It addresses readers who say they arrived from a client email, asks them to recheck a mistyped URL, and offers two links: an Abuse Team contact for reporting unsolicited email and a separate "let us know" link for other questions. The page contains no preference form, only this explanatory notice.

The stored VirusTotal domain result reports 13 detections out of 92 engines. DNS8 reported "phishing"; VIPRE reported "phishing".
Package revision: 594df4c8d45101c63b2443e91b49142ee02bf37bf2a389491be757e72f2fd5bc
Text generated (not scan time): 2026-11-02 05:26:10
Reviewed evidence snapshot: {"domain":"preference-centers.web.app","screenshot_available":true,"page_title":"Email Preference Center","original_meta_description":"Email Preference Center","metadata_observed_on":"2026-11-02","virustotal":{"detections":13,"engines":92,"malicious":13,"suspicious":0,"retrieved_date":"2026-11-02","analysis_date":"2026-11-01","flagging_vendors":["DNS8","VIPRE","G-Data","Lionic","Sophos","Webroot","Fortinet","SOCRadar","Gridinsoft","ADMINUSLabs","BitDefender","Chong Lua Dao","alphaMountain.ai"],"vendor_labels":{"DNS8":"phishing","VIPRE":"phishing","G-Data":"phishing","Lionic":"phishing","Sophos":"phishing","Webroot":"malicious","Fortinet":"phishing","SOCRadar":"phishing","Gridinsoft":"phishing","ADMINUSLabs":"malicious","BitDefender":"phishing","Chong Lua Dao":"malicious","alphaMountain.ai":"phishing"},"scope":"domain"},"capture_context":{"relationship":"screenshot associated with this domain record","captured_at":"2026-11-02T04:25:19Z","final_host":"preference-centers.web.app","captured_on":"2026-11-02"},"plain_text_contract":1,"page_paragraph_target_words":95,"virustotal_public_summary":"The stored VirusTotal domain result reports 13 detections out of 92 engines. DNS8 reported \"phishing\"; VIPRE reported \"phishing\".","page_paragraph_target_characters":519}
Source facts (timestamps as stored): {"record_id":1738640,"first_recorded_at":"2026-11-02 05:23:53","virustotal":{"source":"VirusTotal","scope":"unknown","result_state":"complete","numerator":13,"denominator":92,"malicious":13,"suspicious":0,"vendors":{"DNS8":"phishing","VIPRE":"phishing","G-Data":"phishing","Lionic":"phishing","Sophos":"phishing","Webroot":"malicious","Fortinet":"phishing","SOCRadar":"phishing","Gridinsoft":"phishing","ADMINUSLabs":"malicious","BitDefender":"phishing","Chong Lua Dao":"malicious","alphaMountain.ai":"phishing"},"observed_at":"2026-11-01T17:36:06Z","checked_at":"2026-11-02 05:25:13","fetched_at":"2026-11-02T04:25:12Z","time_basis":"UTC (provider ISO timestamps)","stored_summary":{"source":"VirusTotal","scope":"unknown","result_state":"observed","numerator":13,"denominator":92,"malicious":null,"suspicious":null,"vendors":["ADMINUSLabs","alphaMountain.ai","BitDefender","Chong Lua Dao","DNS8","Fortinet","G-Data","Gridinsoft","Lionic","SOCRadar","Sophos","VIPRE","Webroot"],"observed_at":"2026-11-01 17:36:06","checked_at":"2026-11-02 05:25:13","fetched_at":"2026-11-02 04:25:13","time_basis":"as stored; legacy timezone not established"}},"google_safe_browsing":{"source":"Google Safe Browsing","state":"checked_clean","verdict":0,"checked_at":"2026-11-02 05:25:15"},"spamhaus":{"source":"Spamhaus","verdict":null,"checked_at":null},"availability":{"source":"stored HTTP observation","state":"alive","observed_at":"2026-11-02 05:23:53"}}

## Stored page captures

- Stored capture: https://i.ibb.co/hRsbn4XN/a0395075a13f.png
- URLScan · 2026-11-02: https://screenshots.phishdestroy.io/us/01a19a7e-a80f-77ec-9284-1e97b91d4272.png
  Captured: 2026-11-02 04:22:41 UTC
  Source report: https://urlscan.io/result/01a19a7e-a80f-77ec-9284-1e97b91d4272/
  SHA-256: 7717671bee56c290b2348b1995c14e856da9f94960d8a42a24976a0b618ef8e8
- URLScan · 2025-12-08: https://screenshots.phishdestroy.io/us/019afdcd-3ea1-7710-97bd-fd5fd0636cef.png
  Captured: 2025-12-08 11:51:23 UTC
  Source report: https://urlscan.io/result/019afdcd-3ea1-7710-97bd-fd5fd0636cef/
  SHA-256: 274c9afa50774c74d3996c62e6a0d2efa0d03ff86656c27a73ed9412dc9fe015
- URLScan · 2026-03-20: https://screenshots.phishdestroy.io/us/019d0cc3-803f-767a-9bcd-80fcca2d08a9.png
  Captured: 2026-03-20 19:40:39 UTC
  Source report: https://urlscan.io/result/019d0cc3-803f-767a-9bcd-80fcca2d08a9/
  SHA-256: 274c9afa50774c74d3996c62e6a0d2efa0d03ff86656c27a73ed9412dc9fe015
- URLScan · 2026-11-02: https://screenshots.phishdestroy.io/us/01a19a69-bc9d-7723-9ea0-9bb03c61d5ab.png
  Captured: 2026-11-02 03:59:48 UTC
  Source report: https://urlscan.io/result/01a19a69-bc9d-7723-9ea0-9bb03c61d5ab/
  SHA-256: 7717671bee56c290b2348b1995c14e856da9f94960d8a42a24976a0b618ef8e8
- URLScan · 2026-11-02: https://screenshots.phishdestroy.io/us/01a19a78-c3d2-7528-b207-f9d198b4c86f.png
  Captured: 2026-11-02 04:16:13 UTC
  Source report: https://urlscan.io/result/01a19a78-c3d2-7528-b207-f9d198b4c86f/
  SHA-256: 7717671bee56c290b2348b1995c14e856da9f94960d8a42a24976a0b618ef8e8
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/cb6e933f-b9b3-4c2a-b085-46b618f66518.png
  Captured: 2026-11-02 04:25:19 UTC
  Source report: https://radar.cloudflare.com/scan/cb6e933f-b9b3-4c2a-b085-46b618f66518
  SHA-256: c401afd230609edabd75881b06b41518c2d0616753f9eaf45864cb1366af991d

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-11-02T04:25:36Z",
        "uuid": "01a19a7e-a80f-77ec-9284-1e97b91d4272",
        "scanned_at": "2026-11-02T04:22:41Z",
        "final_url": "https://preference-centers.web.app/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://preference-centers.web.app/",
                "from": "http://preference-centers.web.app/",
                "status": 307
            }
        ],
        "ip": "199.36.158.100",
        "ips": [
            "199.36.158.100"
        ],
        "asns": [
            "54113"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "8270882e148a6963a8566f1ed60cf6d683be107fb4f1f50aa1cb965070ec66fe",
        "script_hashes": [
            "81bf04791dd8ae685f8f9da0114f228006c713a624fa861327b2410fe14fbdb0",
            "93cb6a07899471a4eebdc548aec674a54a616ffb406240e30a84632f215a73bd"
        ],
        "globals": [
            "webpackChunkpreferencecenters",
            "__SENTRY__"
        ],
        "storage_keys": [
            "i18next.translate.boo",
            "locale"
        ],
        "tls": {
            "san": [
                "web.app",
                "*.web.app"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WR3",
            "subject": "web.app",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-25T22:53:04Z",
            "valid_from": "2026-10-27T22:53:05Z"
        },
        "domain_age_days": 1318,
        "apex_age_days": 1318,
        "tls_age_days": 5,
        "tls_valid_days": 89,
        "requests": 6,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 63,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "content-type": "text/html; charset=utf-8",
            "strict-transport-security": "max-age=31556926; includeSubDomains; preload"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-11-02T04:25:39Z",
        "uuid": "cb6e933f-b9b3-4c2a-b085-46b618f66518",
        "scanned_at": "2026-11-02T04:25:19Z",
        "final_url": "https://preference-centers.web.app/",
        "status": 200,
        "history": [
            {
                "url": "https://preference-centers.web.app/",
                "status": 200
            }
        ],
        "dom_hash": "1d9f0bc40e8805fa725fd8839c69081729771cf179ed30dcb576866387232274",
        "doc_hash": "8270882e148a6963a8566f1ed60cf6d683be107fb4f1f50aa1cb965070ec66fe",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Phishing",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "preference-centers.web.app",
                "type": "A",
                "value": "199.36.158.100"
            },
            {
                "name": "preference-centers.web.app",
                "type": "AAAA",
                "value": "2620:0:890::100"
            }
        ],
        "dnssec_valid": false,
        "ip": "127.0.1.7",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "MarkMonitor Inc.",
            "created": "2019-01-08T22:05:04Z",
            "updated": "2025-12-12T10:38:29Z",
            "expires": "2027-01-08T22:05:04Z",
            "nameservers": [
                "ns1.googledomains.com",
                "ns2.googledomains.com",
                "ns3.googledomains.com",
                "ns4.googledomains.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-11-02T04:25:12Z",
        "analysis_at": "2026-11-01T17:36:06Z",
        "stats": {
            "timeout": 0,
            "harmless": 48,
            "malicious": 13,
            "suspicious": 0,
            "undetected": 31
        },
        "detections": {
            "DNS8": "phishing",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "Webroot": "malicious",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Gridinsoft": "phishing",
            "ADMINUSLabs": "malicious",
            "BitDefender": "phishing",
            "Chong Lua Dao": "malicious",
            "alphaMountain.ai": "phishing"
        },
        "reputation": 0,
        "categories": {
            "Google": "technology",
            "Sophos": "phishing and fraud",
            "Webroot": "Phishing and Other Frauds",
            "Forcepoint ThreatSeeker": "web hosting"
        },
        "registrar": "MarkMonitor Inc.",
        "created": "2019-01-08T22:05:04Z",
        "expires": "2026-01-08T22:05:04Z",
        "updated": "2024-12-12T10:14:49Z",
        "first_seen": "2023-09-28T19:45:33Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "A",
                "value": "199.36.158.100"
            },
            {
                "ttl": 21600,
                "type": "AAAA",
                "value": "2620:0:890::100"
            }
        ],
        "dns_at": "2026-11-01T17:38:27Z",
        "jarm": "27d40d40d00040d00041d41d00041d5c54a1f00e65091ffab50f9203d10672",
        "cert": {
            "san": [
                "web.app",
                "*.web.app"
            ],
            "issuer": "Google Trust Services / WR3",
            "serial": "255412c930214a5e129e8ef364548af2",
            "sha256": "91474d4bc2bf2c0503591ed727166f85f30d56294f777e23c1768fa851024ba9",
            "subject": "web.app",
            "valid_to": "2027-01-25T22:53:04Z",
            "valid_from": "2026-10-27T22:53:05Z"
        },
        "whois": {
            "registrar": "MarkMonitor Inc.",
            "registrar_iana_id": "292",
            "registrar_url": "http://www.markmonitor.com",
            "created": "2019-01-08T22:05:04Z",
            "updated": "2024-12-12T10:14:49Z",
            "expires": "2026-01-08T22:05:04Z",
            "status": [
                "clientDeleteProhibited",
                "clientTransferProhibited",
                "clientUpdateProhibited"
            ],
            "nameservers": [
                "ns1.googledomains.com",
                "ns2.googledomains.com",
                "ns3.googledomains.com",
                "ns4.googledomains.com"
            ],
            "dnssec": "unsigned"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-11-02T04:25:51Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "count": 1,
            "domain": "web.app",
            "issuers": [
                "pki.goog"
            ]
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "robots_txt": {
            "agents": [
                "Twitterbot",
                "*"
            ],
            "present": true
        },
        "social_tags": {
            "title": "Email Preference Center",
            "themeColor": "#000000",
            "description": "Email Preference Center"
        },
        "trackers": {
            "requests": 7
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 85,
                "tls": 29,
                "wait": 107,
                "connect": 17,
                "download": 0
            },
            "response_ms": 238
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_128_GCM_SHA256",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 554,
            "co2_grams": 0,
            "cleaner_than": 95
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "216.239.34.99",
                    "host": "ns2.googledomains.com"
                },
                {
                    "ip": "216.239.38.99",
                    "host": "ns4.googledomains.com"
                },
                {
                    "ip": "216.239.36.99",
                    "host": "ns3.googledomains.com"
                },
                {
                    "ip": "216.239.32.99",
                    "host": "ns1.googledomains.com"
                }
            ],
            "zone": "web.app"
        },
        "location": {
            "ip": "2620:0:890::100",
            "asn": "54113",
            "org": "Fastly, Inc.",
            "city": "Mountain View",
            "country": "US"
        },
        "ssl": {
            "issuer": "Google Trust Services / WR3",
            "subject": "web.app"
        },
        "dns": {
            "A": [
                "199.36.158.100"
            ],
            "AAAA": [
                "2620:0:890::100"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "header": "max-age=31556926; includeSubDomains; preload",
            "message": "Site is compatible with the HSTS preload list!",
            "compatible": true
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": "max-age=31556926; includeSubDomains; preload",
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "2620:0:890::100",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://preference-centers.web.app"
            ]
        },
        "headers": {
            "headers": {
                "content-type": "text/html; charset=utf-8",
                "strict-transport-security": "max-age=31556926; includeSubDomains; preload"
            }
        }
    }
}
```
Capture recorded with this analysis (source URL, capture time and stored hash): {"url":"https://screenshots.phishdestroy.io/cf/cb6e933f-b9b3-4c2a-b085-46b618f66518.png","source":"Cloudflare Radar","report_url":"https://radar.cloudflare.com/scan/cb6e933f-b9b3-4c2a-b085-46b618f66518","captured_at":"2026-11-02T04:25:19Z","sha256":"c401afd230609edabd75881b06b41518c2d0616753f9eaf45864cb1366af991d","model_image_sha256":"656fe938ba8f589a8f2a262f6eebea6586780a5f3522d460a144f1561c262849","available":true}