pagead2.googlesyndication.com - suspicious URL scan, 20 Aug 2026

MalwareAnalyzer by Cyble scanned pagead2.googlesyndication.com and returned a suspicious verdict (score 39), categorised as phishing. The page resolved to 142.251.42.98 on Google LLC in IN. The domain was registered 8611 days ago through MarkMonitor Inc.. 1 domain and 1 IP were contacted. 206 malware samples communicate with this URL (Autolike). This is a point-in-time observation from 20 Aug 2026; the page may have changed since.

Scan result

• Verdict: suspicious (score 39) · Confidence 45%
• Scanned URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
• Domain: pagead2.googlesyndication.com · IP: 142.251.42.98 · AS15169 · IN
• Server: cafe
• HTTP status: 200 · text/javascript; charset=ISO-8859-1
• Registrar: MarkMonitor Inc. · domain age 8611 days · created 2003-01-21
• TLS issuer: C=US, O=Google Trust Services, CN=WR2 · valid to Oct 28 20: · subject CN=*.g.doubleclick.net
• Scan tier: fast · observed 2026-08-20 04:52:04 UTC

Malware communicating with this URL (206)

These samples were observed contacting or being served from pagead2.googlesyndication.com. Each links to its full analysis.

• 5cf79f8b58b946bd938e5343eb2becbbc12fd8e786f65248baa10fff56c6aa44 - referenced · 5cf79f8b58b946bd938e5343eb2becbb · first seen 2026-08-20
• 990754a4faf3c6794699c75bb61b0a5ab6b4ce2d7d699c7c2c2f9ba5580e8eef - referenced · 990754a4faf3c6794699c75bb61b0a5a · first seen 2026-08-20
• 9907e1f277910a24dbb2e63c7b60d0eefc75ff19a0ea3fb276a13162820d3524 - referenced · 9907e1f277910a24dbb2e63c7b60d0ee · first seen 2026-08-20
• 189ee2dfdc62c7bfa8809d323c8bc4c7151c2e8cd8349969abdcf13dd4b4a4d8 - referenced · 189ee2dfdc62c7bfa8809d323c8bc4c7 · first seen 2026-08-20
• e2f543649fa592048f6c4897314fc1e66145b113d2682abd1b56b36bdf47ea13 - referenced · e2f543649fa592048f6c4897314fc1e6 · first seen 2026-08-20
• 99047e62509742f223b51bc4e87cac3dfd1e21251f74ba48e8133ab4cb2e8add - referenced · 99047e62509742f223b51bc4e87cac3d · first seen 2026-08-20
• 9901b2d5a20e98ed517f02c26d57996557077d9effc93d4706be555e725357e4 - referenced · 9901b2d5a20e98ed517f02c26d579965 · first seen 2026-08-20
• b6e6eb636d807deaefe9b850b2b0dc8944c487d9265d0cb41ea9717705833cfa - referenced · b6e6eb636d807deaefe9b850b2b0dc89 · first seen 2026-08-20
• b15afb7b0656a5516bd35ef322005ff4b6fcbf085dee9743c9bd1cfb3ff2dec3 - referenced · b15afb7b0656a5516bd35ef322005ff4 · first seen 2026-08-20
• fa24b1fbb8d6d91701df3eb04ce3aca0cbda0cfda232d2b4855fe8ab9a1d20f8 - referenced · fa24b1fbb8d6d91701df3eb04ce3aca0 · first seen 2026-08-20
• 0691098f3a822470a776413b51823c7d6156cb5d2dbe5aaab394b1236913ee87 - referenced · 0691098f3a822470a776413b51823c7d · first seen 2026-08-20
• Autolike - referenced · 9904e2e7337cc0ab5c1bb6474a1a90d4 · first seen 2026-08-20
• f6eb7cfb24350b79437c934eeaaf71e5e9bfd9e35c92a35ba594a0f74a74a4fd - referenced · f6eb7cfb24350b79437c934eeaaf71e5 · first seen 2026-08-20
• a1a0506d94ddbd5cf388de504fb0cd6f452e0c8ec48214c7d55c2fbc4e628d06 - referenced · a1a0506d94ddbd5cf388de504fb0cd6f · first seen 2026-08-20
• 34256a011fb695e1c82e53c8caeef83dbb9158cec74c960b64e039243478d59b - referenced · 34256a011fb695e1c82e53c8caeef83d · first seen 2026-08-20

Antivirus & YARA (0 of 47 engines)

No engine flagged this page's content.

Categories

• phishing

Why this verdict

• Domain impersonates google (combosquat)
• File download routed to the malware sandbox (f.txt)

Contacted infrastructure

• 142.251.42.98 - AS15169 Google LLC (India)

Files served by this page

• f.txt · a7ea3afd8c319249d23d20c579709690

Observed indicators

• pagead2.googlesyndication.com
• 142.251.42.98
• https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Other scans of pagead2.googlesyndication.com (10)

This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.

• 24 Aug 2026 - unknown · http://jotamaria-basemossoro.blogspot.com/search
• 24 Aug 2026 - unknown · http://jotamaria-basemossoro.blogspot.com/
• 24 Aug 2026 - unknown · http://cucmoi.blogspot.com/search/label/edit%20url
• 24 Aug 2026 - suspicious · https://gsgd.co.uk/sandbox/jquery/easing/
• 24 Aug 2026 - unknown · http://malsup.com/jquery/block/
• 24 Aug 2026 - unknown · http://selintasdunia.blogspot.com/2011/02/10-isi-kepala-perempuan-yang-perlu.html
• 24 Aug 2026 - unknown · http://jotamaria-cearense.blogspot.com/search
• 24 Aug 2026 - unknown · http://jotamaria-ccdejoaocamara.blogspot.com/search
• 24 Aug 2026 - unknown · http://jotajunior-servicosrn.blogspot.com/search
• 24 Aug 2026 - unknown · http://jotajunior-servicosrn.blogspot.com/

Questions about pagead2.googlesyndication.com

Is pagead2.googlesyndication.com safe?

No. MalwareAnalyzer scanned pagead2.googlesyndication.com on 20 Aug 2026 and returned a suspicious verdict with a score of 39 out of 100, categorised as phishing. Treat it as hostile until it is re-checked.

What malware is associated with pagead2.googlesyndication.com?

206 analysed samples communicate with this URL, including Autolike.

How was pagead2.googlesyndication.com checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the fast tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of pagead2.googlesyndication.com

Scanned on MalwareAnalyzer by Cyble · Open interactive scan