pagead2.googlesyndication.com - suspicious URL scan, 21 Aug 2026

MalwareAnalyzer by Cyble scanned pagead2.googlesyndication.com and returned a suspicious verdict (score 39), categorised as phishing. The page resolved to 142.250.195.226 on Google LLC in IN. The domain was registered 8613 days ago through MarkMonitor Inc.. 1 domain and 1 IP were contacted. 322 malware samples communicate with this URL. This is a point-in-time observation from 21 Aug 2026; the page may have changed since.

Scan result

• Verdict: suspicious (score 39) · Confidence 45%
• Scanned URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
• Domain: pagead2.googlesyndication.com · IP: 142.250.195.226 · AS15169 · IN
• Server: cafe
• HTTP status: 200 · text/javascript; charset=ISO-8859-1
• Registrar: MarkMonitor Inc. · domain age 8613 days · created 2003-01-21
• TLS issuer: C=US, O=Google Trust Services, CN=WR2 · valid to Oct 28 20: · subject CN=*.g.doubleclick.net
• Scan tier: fast · observed 2026-08-21 13:52:26 UTC

Malware communicating with this URL (322)

These samples were observed contacting or being served from pagead2.googlesyndication.com. Each links to its full analysis.

• 5ac80fe558514e139bed0158027eafa4bd9520af2a7397e8cd13332ae3d9a24a - referenced · 5ac80fe558514e139bed0158027eafa4 · first seen 2026-08-21
• 1326237383e89019e8356deb73f730cc587d5128fc31510b02b3f235a40ff226 - referenced · 1326237383e89019e8356deb73f730cc · first seen 2026-08-21
• da448a227112b0b7145525a4aeb774820086c23253780d9b17b6514d4f95527a - referenced · da448a227112b0b7145525a4aeb77482 · first seen 2026-08-21
• b0018f46fd82fc86b94c767204ccfdc0f9f9a1d0ac5e2e9272bcb0dd6a9fe5fb - referenced · b0018f46fd82fc86b94c767204ccfdc0 · first seen 2026-08-21
• 3230906725d08e21cebd34f2722da08c86d6da8d08e6570599a2e4ba7b9aa54f - referenced · 3230906725d08e21cebd34f2722da08c · first seen 2026-08-21
• 4dd437aecf690b41929853479ab375532d05e7a75ee19669efa401eab1625a8c - referenced · 4dd437aecf690b41929853479ab37553 · first seen 2026-08-21
• 5ae103ff5d7ed7c0465a25ca29c1fd2fb3808c1d05b51b11c563eefcb6a037c9 - referenced · 5ae103ff5d7ed7c0465a25ca29c1fd2f · first seen 2026-08-21
• 6935daf521d6010ecb83e3899e7418d3f18065187dd1ad4c179c943e21733406 - referenced · 6935daf521d6010ecb83e3899e7418d3 · first seen 2026-08-21
• 32370621d9af4f1834d34ec348fb284024f6ecaec23995ba53b5bc196ff9eb6f - referenced · 32370621d9af4f1834d34ec348fb2840 · first seen 2026-08-21
• 379bb52ba4ab05f1f48711c5e70a65c3f39d4d9ff87d9415edc8c069b0adb0f9 - referenced · 379bb52ba4ab05f1f48711c5e70a65c3 · first seen 2026-08-21
• 14bdd32262120f5b6a412d45d5d9f7860180e90f23f2292f986b8224ff29a162 - referenced · 14bdd32262120f5b6a412d45d5d9f786 · first seen 2026-08-21
• cd36e6c70a0a9f387892434c090feb3d6e52b91363ae61e99169ef3abb09c04d - referenced · cd36e6c70a0a9f387892434c090feb3d · first seen 2026-08-21
• 93975e9d715b088d09970c96018b854bd16c24bfd6c25687dda21825f04870f5 - referenced · 93975e9d715b088d09970c96018b854b · first seen 2026-08-21
• 462a50436a95cd4fae493b5b52cee8a799bb281f35e1b38ea0ff1d9efa6d92d2 - referenced · 462a50436a95cd4fae493b5b52cee8a7 · first seen 2026-08-21
• 323b09a0dc664b18338036d2546899d907c218fdea8ed75bcf0d3452640d0aa2 - referenced · 323b09a0dc664b18338036d2546899d9 · first seen 2026-08-21

Antivirus & YARA (0 of 47 engines)

No engine flagged this page's content.

Categories

• phishing

Why this verdict

• Domain impersonates google (combosquat)
• File download routed to the malware sandbox (f.txt)

Contacted infrastructure

• 142.250.195.226 - AS15169 Google LLC (India)

Files served by this page

• f.txt · b77a00299797b1bf449b2d52500d75f4

Observed indicators

• pagead2.googlesyndication.com
• 142.250.195.226
• https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Other scans of pagead2.googlesyndication.com (10)

This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.

• 24 Aug 2026 - unknown · http://jotamaria-ccdejoaocamara.blogspot.com/search
• 24 Aug 2026 - unknown · http://jotajunior-servicosrn.blogspot.com/search
• 24 Aug 2026 - unknown · http://jotajunior-servicosrn.blogspot.com/
• 24 Aug 2026 - unknown · http://legendsnewsbr.blogspot.com/
• 24 Aug 2026 - unknown · https://moda.net.pl/
• 24 Aug 2026 - unknown · https://moda.net.pl/moda/polecamy/keep-calm-and-wait-for-friday
• 24 Aug 2026 - unknown · http://jotamaria-atheneurn.blogspot.com/search
• 24 Aug 2026 - unknown · http://jotamaria-atheneurn.blogspot.com/
• 24 Aug 2026 - unknown · http://jotamaria-atheneurn.blogspot.com/2013/
• 24 Aug 2026 - unknown · http://fullpornolariizle.blogspot.com/

Questions about pagead2.googlesyndication.com

Is pagead2.googlesyndication.com safe?

No. MalwareAnalyzer scanned pagead2.googlesyndication.com on 21 Aug 2026 and returned a suspicious verdict with a score of 39 out of 100, categorised as phishing. Treat it as hostile until it is re-checked.

What malware is associated with pagead2.googlesyndication.com?

322 analysed samples communicate with this URL.

How was pagead2.googlesyndication.com checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the fast tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of pagead2.googlesyndication.com

Scanned on MalwareAnalyzer by Cyble · Open interactive scan