pagead2.googlesyndication.com - suspicious URL scan, 21 Aug 2026

MalwareAnalyzer by Cyble scanned pagead2.googlesyndication.com and returned a suspicious verdict (score 45), categorised as phishing. The page resolved to 142.250.207.2 on Google LLC in JP. The domain was registered 8613 days ago through MarkMonitor Inc.. 1 domain and 1 IP were contacted. 352 malware samples communicate with this URL (Fileinfector). This is a point-in-time observation from 21 Aug 2026; the page may have changed since.

Scan result

• Verdict: suspicious (score 45) · Confidence 54%
• Scanned URL: http://pagead2.googlesyndication.com/pagead/show_ads.js
• Domain: pagead2.googlesyndication.com · IP: 142.250.207.2 · AS15169 · JP
• Server: cafe
• HTTP status: 200 · text/javascript; charset=ISO-8859-1
• Registrar: MarkMonitor Inc. · domain age 8613 days · created 2003-01-21
• Scan tier: fast · observed 2026-08-21 22:52:23 UTC

Malware communicating with this URL (352)

These samples were observed contacting or being served from pagead2.googlesyndication.com. Each links to its full analysis.

• fc9cea7c34db0d3090d174a96525b6b0c628af18c1418f18281740aa1c8c06be - referenced · fc9cea7c34db0d3090d174a96525b6b0 · first seen 2026-08-21
• d863759f68a4af3c249e1ecd4b1ab7d0b2d8320adf9077a582b06d32948b9d05 - referenced · d863759f68a4af3c249e1ecd4b1ab7d0 · first seen 2026-08-21
• 961470b17d477918718421e21846958b4ecc480bb9e2ca71850b74ec1254470c - referenced · 961470b17d477918718421e21846958b · first seen 2026-08-21
• e7f588037861e52d4c1fc30ea4891a58b08d8a45a2ba8d302cbd3ca45266c68c - referenced · e7f588037861e52d4c1fc30ea4891a58 · first seen 2026-08-21
• 98dadf3eb4f11503a8b0001798555ff4d4251745580bb33990293e1a69f0fa89 - referenced · 98dadf3eb4f11503a8b0001798555ff4 · first seen 2026-08-21
• 3f7899ba69ccc7a23a418c62625e579ea9d406b1d02e28768d5cf8b18bc1d7d6 - referenced · 3f7899ba69ccc7a23a418c62625e579e · first seen 2026-08-21
• 23a67b472759ee6876080c558115ea29a9c35660b9aef413eb3f19d491be72e7 - referenced · 23a67b472759ee6876080c558115ea29 · first seen 2026-08-21
• 3f7e3cb3150c2cc1eecea5605d8f21a8f0f948a5ad1728d286efbe9b1ef8257b - referenced · 3f7e3cb3150c2cc1eecea5605d8f21a8 · first seen 2026-08-21
• 06cf684b0e9c52fe9c3ad6503b4e906c3984ea6d7dbb983db367d3654fea500e - referenced · 06cf684b0e9c52fe9c3ad6503b4e906c · first seen 2026-08-21
• 1e78522b87fae6eb939c5d9aab5e631b43806872977e86faa11e9b7682912acd - referenced · 1e78522b87fae6eb939c5d9aab5e631b · first seen 2026-08-21
• 3f76b6dcb28c2d15abc29de9cff0bdf0629bbfae3e61608216406ed3b657d17a - referenced · 3f76b6dcb28c2d15abc29de9cff0bdf0 · first seen 2026-08-21
• cf349fa89b1e8500756ed5ddaa82a4343794f2c739b79efb15f4a3ecf76547a0 - referenced · cf349fa89b1e8500756ed5ddaa82a434 · first seen 2026-08-21
• f0736f2e67b69b8412c9c5d9151f5184d770290f8ccfb6b45eef5aee9db10e75 - referenced · f0736f2e67b69b8412c9c5d9151f5184 · first seen 2026-08-21
• ea208e3fcc39e350c2f42b64164eba51c9228b37703b208dff90adf77c5e3e77 - referenced · ea208e3fcc39e350c2f42b64164eba51 · first seen 2026-08-21
• Fileinfector - contacted · c0c42934680fa49a0b2903402c702330 · first seen 2026-08-21

Antivirus & YARA (0 of 48 engines)

No engine flagged this page's content.

Categories

• phishing

Why this verdict

• Domain impersonates google (combosquat)
• File download routed to the malware sandbox (f.txt)
• Served over plaintext HTTP

Contacted infrastructure

• 142.250.207.2 - AS15169 Google LLC (Japan)

Files served by this page

• f.txt · 9ae0d8acbe267db2ad680a2796d60a1f

Observed indicators

• pagead2.googlesyndication.com
• 142.250.207.2
• http://pagead2.googlesyndication.com/pagead/show_ads.js

Other scans of pagead2.googlesyndication.com (10)

This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.

• 24 Aug 2026 - unknown · http://jotamaria-ccdejoaocamara.blogspot.com/search
• 24 Aug 2026 - unknown · http://jotajunior-servicosrn.blogspot.com/search
• 24 Aug 2026 - unknown · http://jotajunior-servicosrn.blogspot.com/
• 24 Aug 2026 - unknown · http://legendsnewsbr.blogspot.com/
• 24 Aug 2026 - unknown · https://moda.net.pl/
• 24 Aug 2026 - unknown · https://moda.net.pl/moda/polecamy/keep-calm-and-wait-for-friday
• 24 Aug 2026 - unknown · http://jotamaria-atheneurn.blogspot.com/search
• 24 Aug 2026 - unknown · http://jotamaria-atheneurn.blogspot.com/
• 24 Aug 2026 - unknown · http://jotamaria-atheneurn.blogspot.com/2013/
• 24 Aug 2026 - unknown · http://fullpornolariizle.blogspot.com/

Questions about pagead2.googlesyndication.com

Is pagead2.googlesyndication.com safe?

No. MalwareAnalyzer scanned pagead2.googlesyndication.com on 21 Aug 2026 and returned a suspicious verdict with a score of 45 out of 100, categorised as phishing. Treat it as hostile until it is re-checked.

What malware is associated with pagead2.googlesyndication.com?

352 analysed samples communicate with this URL, including Fileinfector.

How was pagead2.googlesyndication.com checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the fast tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of pagead2.googlesyndication.com

Scanned on MalwareAnalyzer by Cyble · Open interactive scan