pagead2.googlesyndication.com - suspicious URL scan, 21 Aug 2026

MalwareAnalyzer by Cyble scanned pagead2.googlesyndication.com and returned a suspicious verdict (score 25), categorised as phishing. The page resolved to 142.251.42.98 on Google LLC in IN. The domain was registered 8612 days ago through MarkMonitor Inc.. 1 domain and 1 IP were contacted. 276 malware samples communicate with this URL (HUILoader). This is a point-in-time observation from 21 Aug 2026; the page may have changed since.

Scan result

• Verdict: suspicious (score 25) · Confidence 28%
• Scanned URL: https://pagead2.googlesyndication.com/
• Domain: pagead2.googlesyndication.com · IP: 142.251.42.98 · AS15169 · IN
• Server: sffe
• Page title: Error 404 (Not Found)!!1
• HTTP status: 404 · text/html; charset=UTF-8
• Registrar: MarkMonitor Inc. · domain age 8612 days · created 2003-01-21
• TLS issuer: C=US, O=Google Trust Services, CN=WR2 · valid to Oct 28 20: · subject CN=*.g.doubleclick.net
• Scan tier: fast · observed 2026-08-21 01:42:26 UTC

Malware communicating with this URL (276)

These samples were observed contacting or being served from pagead2.googlesyndication.com. Each links to its full analysis.

• HUILoader - contacted · 1dad207c4d8680b8b165e299757ebf58 · first seen 2026-08-21
• c4b91b69877cd0110c84ca49680d2f48b30939383847b65889fa4fef6c992580 - referenced · c4b91b69877cd0110c84ca49680d2f48 · first seen 2026-08-21
• e0d87523a79ccdb314ba66d3965d42c7dd2b0ca6e90ac52d7d867e91ad4de674 - referenced · e0d87523a79ccdb314ba66d3965d42c7 · first seen 2026-08-21
• 10d68302eb6ceac285a43f092144f9f957399da7e977c571beb0c5c20e1e6878 - referenced · 10d68302eb6ceac285a43f092144f9f9 · first seen 2026-08-21
• 479e0282519cf2dddaecab95e0d8297d0a807cba2256c74a3ad8c3e84f084fbc - referenced · 479e0282519cf2dddaecab95e0d8297d · first seen 2026-08-21
• e0d41d773525c4e520dc913470d36e8627c6c2e5f9e3587d24483f39d89e462d - referenced · e0d41d773525c4e520dc913470d36e86 · first seen 2026-08-21
• 4631b06e95385fa9087001553392a5f6ca4251c36dc871e3401a011fc688bd02 - referenced · 4631b06e95385fa9087001553392a5f6 · first seen 2026-08-21
• dcc0268741419a6e702c61395e659b578321db39475b92fc9c7699fc53db0dae - referenced · dcc0268741419a6e702c61395e659b57 · first seen 2026-08-20
• cd68698836a7344ab60b15e7fa45142c270d243ea1b75b4075b1a9e8c793a1d2 - referenced · cd68698836a7344ab60b15e7fa45142c · first seen 2026-08-20
• 072972e046ffeb29f88ea9384958251ffa5de790d8e0d4bd8716420c7525ac88 - referenced · 072972e046ffeb29f88ea9384958251f · first seen 2026-08-20
• 05393eaacd5d4076e20ea96b2396631282174f10cd5235ee2a9cbe6fd40137e4 - referenced · 05393eaacd5d4076e20ea96b23966312 · first seen 2026-08-20
• ebdf980ac30b78bdff8a732b8718acb2dc7c857e0963468260047b111d909a84 - referenced · ebdf980ac30b78bdff8a732b8718acb2 · first seen 2026-08-20
• 13456afad58b913d949ba3f9f1b5b6093c20828783cfa04e1ec2160829858b00 - referenced · 13456afad58b913d949ba3f9f1b5b609 · first seen 2026-08-20
• dac76dd3a9d243ec67019f9c468b09a616978d44621062e0b4d502d7c2fd9589 - referenced · dac76dd3a9d243ec67019f9c468b09a6 · first seen 2026-08-20
• 7a794f9e1a302640384a049bddc9d1f1e97828ea54f91213ed64083dfc118625 - referenced · 7a794f9e1a302640384a049bddc9d1f1 · first seen 2026-08-20

Antivirus & YARA (0 of 47 engines)

No engine flagged this page's content.

Categories

• phishing

Why this verdict

• Domain impersonates google (combosquat)

Contacted infrastructure

• 142.251.42.98 - AS15169 Google LLC (India)

Observed indicators

• pagead2.googlesyndication.com
• 142.251.42.98
• https://pagead2.googlesyndication.com/

Other scans of pagead2.googlesyndication.com (10)

This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.

• 24 Aug 2026 - unknown · http://jotamaria-bandamusica.blogspot.com/search
• 24 Aug 2026 - unknown · http://jotamaria-bandamusica.blogspot.com/
• 24 Aug 2026 - unknown · http://jotamaria-caerndeseveriano.blogspot.com/search
• 24 Aug 2026 - unknown · http://jotamaria-caerndeseveriano.blogspot.com/
• 24 Aug 2026 - unknown · http://jotaemeshon-saaguarn.blogspot.com/search
• 24 Aug 2026 - unknown · http://jotaemeshon-saaguarn.blogspot.com/2010/
• 24 Aug 2026 - unknown · https://www.izarc.org/
• 24 Aug 2026 - unknown · https://www.izarc.org/
• 24 Aug 2026 - unknown · http://jotamaria-bbsaomiguel.blogspot.com/
• 24 Aug 2026 - unknown · http://jotamaria-angicos.blogspot.com/search

Questions about pagead2.googlesyndication.com

Is pagead2.googlesyndication.com safe?

No. MalwareAnalyzer scanned pagead2.googlesyndication.com on 21 Aug 2026 and returned a suspicious verdict with a score of 25 out of 100, categorised as phishing. Treat it as hostile until it is re-checked.

What malware is associated with pagead2.googlesyndication.com?

276 analysed samples communicate with this URL, including HUILoader.

How was pagead2.googlesyndication.com checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the fast tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of pagead2.googlesyndication.com

Scanned on MalwareAnalyzer by Cyble · Open interactive scan