img.youtube.com - URL scan, 20 Aug 2026
MalwareAnalyzer by Cyble scanned img.youtube.com and returned a benign verdict (score 0). The page resolved to 142.251.42.110 on Google LLC in IN. The domain was registered 7856 days ago through MarkMonitor Inc.. 1 domain and 1 IP were contacted. 12 malware samples communicate with this URL (Maldoc). This is a point-in-time observation from 20 Aug 2026; the page may have changed since.
Scan result
- Verdict: benign (score 0) · Confidence 15%
- Scanned URL:
https://img.youtube.com/vi/ - Domain: img.youtube.com · IP: 142.251.42.110 · AS15169 · IN
- Server: sffe
- HTTP status: 404 · image/jpeg
- Registrar: MarkMonitor Inc. · domain age 7856 days · created 2005-02-15
- TLS issuer: C=US, O=Google Trust Services, CN=WR2 · valid to Oct 28 20: · subject CN=*.google.com
- Scan tier: fast · observed 2026-08-20 22:23:23 UTC
Malware communicating with this URL (12)
These samples were observed contacting or being served from img.youtube.com. Each links to its full analysis.
- de69d264f2959bd42b967726664badfaf0fe151449ce880cf330629ddf6b9010 - referenced ·
de69d264f2959bd42b967726664badfa· first seen 2026-08-20 - 5e9d8d758a6195b29c57ca50480475e708ff3474ad797abd3738128ede0bb2f1 - referenced ·
5e9d8d758a6195b29c57ca50480475e7· first seen 2026-08-20 - 983801b612f719bd839b1085b0d45e4dd333e8757b5192bbdfa4d921b0406d93 - referenced ·
983801b612f719bd839b1085b0d45e4d· first seen 2026-08-19 - Maldoc - referenced ·
2d1ec17083ea606da07bf3a9ec8b23e2· first seen 2026-08-19 - 904ba9cedd81e5b19dec43b57661f80cd50fc8f8581c17b2454dc5d7ce59932d - referenced ·
904ba9cedd81e5b19dec43b57661f80c· first seen 2026-08-19 - fe47c899d05a1f5bafd6f9432e67c58fb6091399d6387b70a0fcb541895896b4 - referenced ·
fe47c899d05a1f5bafd6f9432e67c58f· first seen 2026-08-19 - 6ee6fc892de79953ab678b447151f27578fed64fb77f618c1dc6dcd611c08b11 - referenced ·
6ee6fc892de79953ab678b447151f275· first seen 2026-08-16 - f5518ed561cffa3ceda01b75a4b7e3686cc5d7b31b4ef7b0f21d1dd495c73b85 - referenced ·
f5518ed561cffa3ceda01b75a4b7e368· first seen 2026-08-15 - 521a940c7302b8ce2b5a55bd7beb3e2583c073b5b101453a4d34c39d88197220 - referenced ·
521a940c7302b8ce2b5a55bd7beb3e25· first seen 2026-08-14 - da3c6485fc7c24b48f0f99593fce3b2ca129f683badc82d7b0bcd5977b18e895 - referenced ·
da3c6485fc7c24b48f0f99593fce3b2c· first seen 2026-08-13 - a087174c61632d342b0cbed9fc2ee6b62823fe99aed7df6bdb5afe352cc123c6 - referenced ·
a087174c61632d342b0cbed9fc2ee6b6· first seen 2026-08-12 - 997094d0c5dfd4113566c4e08d9e443af42dd3647add0c045616d66e824641ac - referenced ·
997094d0c5dfd4113566c4e08d9e443a· first seen 2026-08-12
Antivirus & YARA (0 of 47 engines)
No engine flagged this page's content.
Why this verdict
- Valid TLS, no impersonation or off-origin credential post
Contacted infrastructure
- 142.251.42.110 - AS15169 Google LLC (India)
Observed indicators
- img.youtube.com
- 142.251.42.110
- https://img.youtube.com/vi/
Other scans of img.youtube.com (10)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 24 Aug 2026 - unknown ·
http://img.youtube.com/vi/TCnrXsGYgU0/0.jpg - 23 Aug 2026 - benign
- 23 Aug 2026 - unknown ·
https://argumentua.com/i/file/buripanomugidi.pdf - 23 Aug 2026 - unknown ·
https://argumentua.com/i/file/buripanomugidi.pdf - 22 Aug 2026 - unknown ·
http://img.youtube.com/vi/ - 22 Aug 2026 - unknown ·
http://img.youtube.com/vi/ - 22 Aug 2026 - malicious ·
https://www.steamsport.eu/ - 22 Aug 2026 - unknown ·
http://tdvvietnam.vn/webroot/img/files/96649687853.pdf - 21 Aug 2026 - benign ·
https://aws.amazon.com/s3/ - 21 Aug 2026 - benign
Questions about img.youtube.com
- Is img.youtube.com safe?
- The scan of img.youtube.com on 20 Aug 2026 found no evidence of harm. That is the absence of a finding at one point in time, not a guarantee: a page can change, and a scan only sees what it was served.
- What malware is associated with img.youtube.com?
- 12 analysed samples communicate with this URL, including Maldoc.
- How was img.youtube.com checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of img.youtube.com
Scanned on MalwareAnalyzer by Cyble · Open interactive scan