pagead2.googlesyndication.com - suspicious URL scan, 20 Aug 2026

MalwareAnalyzer by Cyble scanned pagead2.googlesyndication.com and returned a suspicious verdict (score 45), categorised as phishing. The page resolved to 142.250.183.34 on Google LLC in IN. The domain was registered 8612 days ago through MarkMonitor Inc.. 1 domain and 1 IP were contacted. 267 malware samples communicate with this URL (Autolike, Fileinfector). This is a point-in-time observation from 20 Aug 2026; the page may have changed since.

Scan result

• Verdict: suspicious (score 45) · Confidence 54%
• Scanned URL: http://pagead2.googlesyndication.com/pagead/show_ads.js
• Domain: pagead2.googlesyndication.com · IP: 142.250.183.34 · AS15169 · IN
• Server: cafe
• HTTP status: 200 · text/javascript; charset=ISO-8859-1
• Registrar: MarkMonitor Inc. · domain age 8612 days · created 2003-01-21
• Scan tier: fast · observed 2026-08-20 23:07:21 UTC

Malware communicating with this URL (267)

These samples were observed contacting or being served from pagead2.googlesyndication.com. Each links to its full analysis.

• 072972e046ffeb29f88ea9384958251ffa5de790d8e0d4bd8716420c7525ac88 - referenced · 072972e046ffeb29f88ea9384958251f · first seen 2026-08-20
• 05393eaacd5d4076e20ea96b2396631282174f10cd5235ee2a9cbe6fd40137e4 - referenced · 05393eaacd5d4076e20ea96b23966312 · first seen 2026-08-20
• ebdf980ac30b78bdff8a732b8718acb2dc7c857e0963468260047b111d909a84 - referenced · ebdf980ac30b78bdff8a732b8718acb2 · first seen 2026-08-20
• 13456afad58b913d949ba3f9f1b5b6093c20828783cfa04e1ec2160829858b00 - referenced · 13456afad58b913d949ba3f9f1b5b609 · first seen 2026-08-20
• dac76dd3a9d243ec67019f9c468b09a616978d44621062e0b4d502d7c2fd9589 - referenced · dac76dd3a9d243ec67019f9c468b09a6 · first seen 2026-08-20
• 7a794f9e1a302640384a049bddc9d1f1e97828ea54f91213ed64083dfc118625 - referenced · 7a794f9e1a302640384a049bddc9d1f1 · first seen 2026-08-20
• Autolike - referenced · dcc66cd907af196603cff7b3fe1bb61e · first seen 2026-08-20
• a4f2e2fb75809375d720d75312d753c5efa9b244e1a372145c16b795b380de02 - referenced · a4f2e2fb75809375d720d75312d753c5 · first seen 2026-08-20
• Fileinfector - contacted · 8be1f1d3f59476f6988d0a84cbf727ea · first seen 2026-08-20
• dccfbe0a93534b1813fb2afa34b08b526f790862b7740de39430f9df6567453a - referenced · dccfbe0a93534b1813fb2afa34b08b52 · first seen 2026-08-20
• dcc7b6a2ee62f706af1e064172f347e193f662ba67dcf651135eed63e6c8ae7e - referenced · dcc7b6a2ee62f706af1e064172f347e1 · first seen 2026-08-20
• 7f4c9279e62a5de10979a4f660f1dc7148cd47139a15b104bd911e8227d1d2bf - referenced · 7f4c9279e62a5de10979a4f660f1dc71 · first seen 2026-08-20
• 27c3c4e40b0472c7633c3c261bc01176a57fc3a5ca28cc417d1e955e6b5e39c6 - referenced · 27c3c4e40b0472c7633c3c261bc01176 · first seen 2026-08-20
• 175ae65031f576967a2d6dabbd85ba8402de7c4b16039cbcc1d5a32cb9db5aab - referenced · 175ae65031f576967a2d6dabbd85ba84 · first seen 2026-08-20
• 4fc0eb1c794e8b3f77dff8c125aef397dcc4aae44b69949754ebd0f10f0d00a8 - referenced · 4fc0eb1c794e8b3f77dff8c125aef397 · first seen 2026-08-20

Antivirus & YARA (0 of 47 engines)

No engine flagged this page's content.

Categories

• phishing

Why this verdict

• Domain impersonates google (combosquat)
• File download routed to the malware sandbox (f.txt)
• Served over plaintext HTTP

Contacted infrastructure

• 142.250.183.34 - AS15169 Google LLC (India)

Files served by this page

• f.txt · 8ad8ea68d7bb3e7f9ff9eaf7c5846664

Observed indicators

• pagead2.googlesyndication.com
• 142.250.183.34
• http://pagead2.googlesyndication.com/pagead/show_ads.js

Other scans of pagead2.googlesyndication.com (10)

This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.

• 24 Aug 2026 - unknown · http://phimhddd.blogspot.com/search/label/M%C3%83%C2%83%C3%82%C2%83%C3%83%C2%82%C3%82%C2%83%C3%83%C2
• 24 Aug 2026 - unknown · http://istana-sepeda.blogspot.com/2012/04/fork-rst-first-platinum-travel-100.html
• 24 Aug 2026 - unknown · http://jotamaria-centraloeste.blogspot.com/search
• 24 Aug 2026 - unknown · http://jotamaria-centraloeste.blogspot.com/
• 24 Aug 2026 - unknown · http://jotamaria-centraloeste.blogspot.com/2010/08/capitao-aderlan-bezeraa-de-araujo.html
• 24 Aug 2026 - unknown · http://jotamaria-cdldetouros.blogspot.com/search
• 24 Aug 2026 - unknown · http://jotamaria-cdldetouros.blogspot.com/
• 24 Aug 2026 - unknown · http://jotamaria-cdldetouros.blogspot.com/search/label/STPM%20JOTA%20MARIA
• 24 Aug 2026 - unknown · http://jotamaria-barragemoiticica.blogspot.com/search
• 24 Aug 2026 - unknown · http://jotamaria-barragemoiticica.blogspot.com/

Questions about pagead2.googlesyndication.com

Is pagead2.googlesyndication.com safe?

No. MalwareAnalyzer scanned pagead2.googlesyndication.com on 20 Aug 2026 and returned a suspicious verdict with a score of 45 out of 100, categorised as phishing. Treat it as hostile until it is re-checked.

What malware is associated with pagead2.googlesyndication.com?

267 analysed samples communicate with this URL, including Autolike, Fileinfector.

How was pagead2.googlesyndication.com checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the fast tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of pagead2.googlesyndication.com

Scanned on MalwareAnalyzer by Cyble · Open interactive scan