img.youtube.com - URL scan, 21 Aug 2026
MalwareAnalyzer by Cyble scanned img.youtube.com and returned a unknown verdict (score 6). The page resolved to 142.250.195.110 on Google LLC in IN. The domain was registered 7857 days ago through MarkMonitor Inc.. 1 domain and 1 IP were contacted. 13 malware samples communicate with this URL (Maldoc). This is a point-in-time observation from 21 Aug 2026; the page may have changed since.
Scan result
- Verdict: unknown (score 6) · Confidence 9%
- Scanned URL:
http://img.youtube.com/vi/ - Domain: img.youtube.com · IP: 142.250.195.110 · AS15169 · IN
- Server: sffe
- HTTP status: 404 · image/jpeg
- Registrar: MarkMonitor Inc. · domain age 7857 days · created 2005-02-15
- Scan tier: fast · observed 2026-08-21 05:53:29 UTC
Malware communicating with this URL (13)
These samples were observed contacting or being served from img.youtube.com. Each links to its full analysis.
- e476e9b003f635fe92e5a6a389bd242e55b6e96a376803d525c9649dabdbbdbc - referenced ·
e476e9b003f635fe92e5a6a389bd242e· first seen 2026-08-21 - de69d264f2959bd42b967726664badfaf0fe151449ce880cf330629ddf6b9010 - referenced ·
de69d264f2959bd42b967726664badfa· first seen 2026-08-20 - 5e9d8d758a6195b29c57ca50480475e708ff3474ad797abd3738128ede0bb2f1 - referenced ·
5e9d8d758a6195b29c57ca50480475e7· first seen 2026-08-20 - 983801b612f719bd839b1085b0d45e4dd333e8757b5192bbdfa4d921b0406d93 - referenced ·
983801b612f719bd839b1085b0d45e4d· first seen 2026-08-19 - Maldoc - referenced ·
2d1ec17083ea606da07bf3a9ec8b23e2· first seen 2026-08-19 - 904ba9cedd81e5b19dec43b57661f80cd50fc8f8581c17b2454dc5d7ce59932d - referenced ·
904ba9cedd81e5b19dec43b57661f80c· first seen 2026-08-19 - fe47c899d05a1f5bafd6f9432e67c58fb6091399d6387b70a0fcb541895896b4 - referenced ·
fe47c899d05a1f5bafd6f9432e67c58f· first seen 2026-08-19 - 6ee6fc892de79953ab678b447151f27578fed64fb77f618c1dc6dcd611c08b11 - referenced ·
6ee6fc892de79953ab678b447151f275· first seen 2026-08-16 - f5518ed561cffa3ceda01b75a4b7e3686cc5d7b31b4ef7b0f21d1dd495c73b85 - referenced ·
f5518ed561cffa3ceda01b75a4b7e368· first seen 2026-08-15 - 521a940c7302b8ce2b5a55bd7beb3e2583c073b5b101453a4d34c39d88197220 - referenced ·
521a940c7302b8ce2b5a55bd7beb3e25· first seen 2026-08-14 - da3c6485fc7c24b48f0f99593fce3b2ca129f683badc82d7b0bcd5977b18e895 - referenced ·
da3c6485fc7c24b48f0f99593fce3b2c· first seen 2026-08-13 - a087174c61632d342b0cbed9fc2ee6b62823fe99aed7df6bdb5afe352cc123c6 - referenced ·
a087174c61632d342b0cbed9fc2ee6b6· first seen 2026-08-12 - 997094d0c5dfd4113566c4e08d9e443af42dd3647add0c045616d66e824641ac - referenced ·
997094d0c5dfd4113566c4e08d9e443a· first seen 2026-08-12
Antivirus & YARA (0 of 47 engines)
No engine flagged this page's content.
Why this verdict
- Served over plaintext HTTP
Contacted infrastructure
- 142.250.195.110 - AS15169 Google LLC (India)
Observed indicators
- img.youtube.com
- 142.250.195.110
- http://img.youtube.com/vi/
Other scans of img.youtube.com (10)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 24 Aug 2026 - unknown ·
http://img.youtube.com/vi/TCnrXsGYgU0/0.jpg - 23 Aug 2026 - benign ·
https://img.youtube.com/vi/ - 23 Aug 2026 - unknown ·
https://argumentua.com/i/file/buripanomugidi.pdf - 23 Aug 2026 - unknown ·
https://argumentua.com/i/file/buripanomugidi.pdf - 22 Aug 2026 - unknown
- 22 Aug 2026 - unknown
- 22 Aug 2026 - malicious ·
https://www.steamsport.eu/ - 22 Aug 2026 - unknown ·
http://tdvvietnam.vn/webroot/img/files/96649687853.pdf - 21 Aug 2026 - benign ·
https://aws.amazon.com/s3/ - 21 Aug 2026 - benign ·
https://img.youtube.com/vi/
Questions about img.youtube.com
- Is img.youtube.com safe?
- The scan of img.youtube.com on 21 Aug 2026 reached no verdict either way (score 6). Too little was captured to judge it, which is an unknown rather than a pass.
- What malware is associated with img.youtube.com?
- 13 analysed samples communicate with this URL, including Maldoc.
- How was img.youtube.com checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of img.youtube.com
Scanned on MalwareAnalyzer by Cyble · Open interactive scan