pagead2.googlesyndication.com - suspicious URL scan, 23 Aug 2026

MalwareAnalyzer by Cyble scanned pagead2.googlesyndication.com and returned a suspicious verdict (score 39), categorised as phishing. The page resolved to 142.250.195.162 on Google LLC in IN. The domain was registered 8615 days ago through MarkMonitor Inc.. 1 domain and 1 IP were contacted. 497 malware samples communicate with this URL (CobaltStrike). This is a point-in-time observation from 23 Aug 2026; the page may have changed since.

Scan result

• Verdict: suspicious (score 39) · Confidence 45%
• Scanned URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
• Domain: pagead2.googlesyndication.com · IP: 142.250.195.162 · AS15169 · IN
• Server: cafe
• HTTP status: 200 · text/javascript; charset=ISO-8859-1
• Registrar: MarkMonitor Inc. · domain age 8615 days · created 2003-01-21
• TLS issuer: C=US, O=Google Trust Services, CN=WR2 · valid to Oct 28 20: · subject CN=*.g.doubleclick.net
• Scan tier: fast · observed 2026-08-23 23:32:23 UTC

Malware communicating with this URL (497)

These samples were observed contacting or being served from pagead2.googlesyndication.com. Each links to its full analysis.

• 4e22aaa664629d7022b54109a521d65f39a3fa1af46ad1a26839b0b3575892af - referenced · 4e22aaa664629d7022b54109a521d65f · first seen 2026-08-23
• 189092feb04d59b02edcc2443c54ebf597c3226c8ec74b4532805d49bacdddee - referenced · 189092feb04d59b02edcc2443c54ebf5 · first seen 2026-08-23
• 2e08d12a894532a8541d3daf16657da40c4715c5a8fc15d754056edca6663dbc - referenced · 2e08d12a894532a8541d3daf16657da4 · first seen 2026-08-23
• 5a49ab3c553a9f956c9db44d0685c340b87f5501050c0d665a0b770f5527eabd - referenced · 5a49ab3c553a9f956c9db44d0685c340 · first seen 2026-08-23
• 4e21ce044e526e9a247a917a5df600d5869908d4e1e99d9ff5d9da521b97fbdb - referenced · 4e21ce044e526e9a247a917a5df600d5 · first seen 2026-08-23
• CobaltStrike - referenced · cee4721630424c4f9908978c031e7e6e · first seen 2026-08-23
• fe9ec242c8e1d01a9b0e63da9b01c8c9044a88e50b5727c1aa556e3aa7f97242 - referenced · fe9ec242c8e1d01a9b0e63da9b01c8c9 · first seen 2026-08-23
• 601e3259b5a9dfd758de37acc84923689505917ba85c65e292f2a5875fd87c48 - referenced · 601e3259b5a9dfd758de37acc8492368 · first seen 2026-08-23
• fe94594d23dd8bd28a93ffc9c014cd9b64a1e2f4e2eb697ebfe0c72223a5d1c8 - referenced · fe94594d23dd8bd28a93ffc9c014cd9b · first seen 2026-08-23
• fe98f92d23ef756eca079765de5bc2b66625b020d9e0cdcf993d62c063efa917 - referenced · fe98f92d23ef756eca079765de5bc2b6 · first seen 2026-08-23
• fe9797cb40538c075b0059c1f5a690b9c678cd6466d5beb8e4f6a665c4271f3d - referenced · fe9797cb40538c075b0059c1f5a690b9 · first seen 2026-08-23
• ecda843853b37ec8feafc9f1d226d3401383ce9bf0960b3ccf9a7e52c106c238 - referenced · ecda843853b37ec8feafc9f1d226d340 · first seen 2026-08-23
• d071f8385ea48be86c63d061fd7ecdb3da146f95b77f3ab3e50e28e3ea912b1d - referenced · d071f8385ea48be86c63d061fd7ecdb3 · first seen 2026-08-23
• 4bf8253dcefbb1684389ea961a0f9c7ef280f9c916f16137b1002489a7e40ddf - referenced · 4bf8253dcefbb1684389ea961a0f9c7e · first seen 2026-08-23
• e4b91a51c79f466640d93cbce4613df07ca7a44c5c64a627caa7a1951b9a1c28 - referenced · e4b91a51c79f466640d93cbce4613df0 · first seen 2026-08-23

Antivirus & YARA (0 of 48 engines)

No engine flagged this page's content.

Categories

• phishing

Why this verdict

• Domain impersonates google (combosquat)
• File download routed to the malware sandbox (f.txt)

Contacted infrastructure

• 142.250.195.162 - AS15169 Google LLC (India)

Files served by this page

• f.txt · a4ba620f25b9501862591d1ac515409a

Observed indicators

• pagead2.googlesyndication.com
• 142.250.195.162
• https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Other scans of pagead2.googlesyndication.com (10)

This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.

• 24 Aug 2026 - unknown · http://phimhddd.blogspot.com/search/label/M%C3%83%C2%83%C3%82%C2%83%C3%83%C2%82%C3%82%C2%83%C3%83%C2
• 24 Aug 2026 - unknown · http://istana-sepeda.blogspot.com/2012/04/fork-rst-first-platinum-travel-100.html
• 24 Aug 2026 - unknown · http://jotamaria-centraloeste.blogspot.com/search
• 24 Aug 2026 - unknown · http://jotamaria-centraloeste.blogspot.com/
• 24 Aug 2026 - unknown · http://jotamaria-centraloeste.blogspot.com/2010/08/capitao-aderlan-bezeraa-de-araujo.html
• 24 Aug 2026 - unknown · http://jotamaria-cdldetouros.blogspot.com/search
• 24 Aug 2026 - unknown · http://jotamaria-cdldetouros.blogspot.com/
• 24 Aug 2026 - unknown · http://jotamaria-cdldetouros.blogspot.com/search/label/STPM%20JOTA%20MARIA
• 24 Aug 2026 - unknown · http://jotamaria-barragemoiticica.blogspot.com/search
• 24 Aug 2026 - unknown · http://jotamaria-barragemoiticica.blogspot.com/

Questions about pagead2.googlesyndication.com

Is pagead2.googlesyndication.com safe?

No. MalwareAnalyzer scanned pagead2.googlesyndication.com on 23 Aug 2026 and returned a suspicious verdict with a score of 39 out of 100, categorised as phishing. Treat it as hostile until it is re-checked.

What malware is associated with pagead2.googlesyndication.com?

497 analysed samples communicate with this URL, including CobaltStrike.

How was pagead2.googlesyndication.com checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the fast tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of pagead2.googlesyndication.com

Scanned on MalwareAnalyzer by Cyble · Open interactive scan