pagead2.googlesyndication.com - suspicious URL scan, 21 Aug 2026

MalwareAnalyzer by Cyble scanned pagead2.googlesyndication.com and returned a suspicious verdict (score 45), categorised as phishing. The page resolved to 142.251.222.226 on Google LLC in MY. The domain was registered 8613 days ago through MarkMonitor Inc.. 1 domain and 1 IP were contacted. 319 malware samples communicate with this URL. This is a point-in-time observation from 21 Aug 2026; the page may have changed since.

Scan result

• Verdict: suspicious (score 45) · Confidence 54%
• Scanned URL: http://pagead2.googlesyndication.com/pagead/show_ads.js
• Domain: pagead2.googlesyndication.com · IP: 142.251.222.226 · AS15169 · MY
• Server: cafe
• HTTP status: 200 · text/javascript; charset=ISO-8859-1
• Registrar: MarkMonitor Inc. · domain age 8613 days · created 2003-01-21
• Scan tier: fast · observed 2026-08-21 13:12:21 UTC

Malware communicating with this URL (319)

These samples were observed contacting or being served from pagead2.googlesyndication.com. Each links to its full analysis.

• b0018f46fd82fc86b94c767204ccfdc0f9f9a1d0ac5e2e9272bcb0dd6a9fe5fb - referenced · b0018f46fd82fc86b94c767204ccfdc0 · first seen 2026-08-21
• 3230906725d08e21cebd34f2722da08c86d6da8d08e6570599a2e4ba7b9aa54f - referenced · 3230906725d08e21cebd34f2722da08c · first seen 2026-08-21
• 4dd437aecf690b41929853479ab375532d05e7a75ee19669efa401eab1625a8c - referenced · 4dd437aecf690b41929853479ab37553 · first seen 2026-08-21
• 5ae103ff5d7ed7c0465a25ca29c1fd2fb3808c1d05b51b11c563eefcb6a037c9 - referenced · 5ae103ff5d7ed7c0465a25ca29c1fd2f · first seen 2026-08-21
• 6935daf521d6010ecb83e3899e7418d3f18065187dd1ad4c179c943e21733406 - referenced · 6935daf521d6010ecb83e3899e7418d3 · first seen 2026-08-21
• 32370621d9af4f1834d34ec348fb284024f6ecaec23995ba53b5bc196ff9eb6f - referenced · 32370621d9af4f1834d34ec348fb2840 · first seen 2026-08-21
• 379bb52ba4ab05f1f48711c5e70a65c3f39d4d9ff87d9415edc8c069b0adb0f9 - referenced · 379bb52ba4ab05f1f48711c5e70a65c3 · first seen 2026-08-21
• 14bdd32262120f5b6a412d45d5d9f7860180e90f23f2292f986b8224ff29a162 - referenced · 14bdd32262120f5b6a412d45d5d9f786 · first seen 2026-08-21
• cd36e6c70a0a9f387892434c090feb3d6e52b91363ae61e99169ef3abb09c04d - referenced · cd36e6c70a0a9f387892434c090feb3d · first seen 2026-08-21
• 93975e9d715b088d09970c96018b854bd16c24bfd6c25687dda21825f04870f5 - referenced · 93975e9d715b088d09970c96018b854b · first seen 2026-08-21
• 462a50436a95cd4fae493b5b52cee8a799bb281f35e1b38ea0ff1d9efa6d92d2 - referenced · 462a50436a95cd4fae493b5b52cee8a7 · first seen 2026-08-21
• 323b09a0dc664b18338036d2546899d907c218fdea8ed75bcf0d3452640d0aa2 - referenced · 323b09a0dc664b18338036d2546899d9 · first seen 2026-08-21
• 63c9ccc6bc951ac033945bc48bd56ba5f074b78030b31ac71e5d772f33c10823 - referenced · 63c9ccc6bc951ac033945bc48bd56ba5 · first seen 2026-08-21
• c1a35285e980d2120d76ce8649ab016453fe431223d0cf216b870d81eef7d799 - referenced · c1a35285e980d2120d76ce8649ab0164 · first seen 2026-08-21
• dfc1ab931304a8732a9ea798d98cc76bf14a8b9a245a7171524aeb0fa4ce0758 - referenced · dfc1ab931304a8732a9ea798d98cc76b · first seen 2026-08-21

Antivirus & YARA (0 of 47 engines)

No engine flagged this page's content.

Categories

• phishing

Why this verdict

• Domain impersonates google (combosquat)
• File download routed to the malware sandbox (f.txt)
• Served over plaintext HTTP

Contacted infrastructure

• 142.251.222.226 - AS15169 Google LLC (Malaysia)

Files served by this page

• f.txt · 9ae0d8acbe267db2ad680a2796d60a1f

Observed indicators

• pagead2.googlesyndication.com
• 142.251.222.226
• http://pagead2.googlesyndication.com/pagead/show_ads.js

Other scans of pagead2.googlesyndication.com (10)

This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.

• 24 Aug 2026 - unknown · http://jotamaria-ccdejoaocamara.blogspot.com/search
• 24 Aug 2026 - unknown · http://jotajunior-servicosrn.blogspot.com/search
• 24 Aug 2026 - unknown · http://jotajunior-servicosrn.blogspot.com/
• 24 Aug 2026 - unknown · http://legendsnewsbr.blogspot.com/
• 24 Aug 2026 - unknown · https://moda.net.pl/
• 24 Aug 2026 - unknown · https://moda.net.pl/moda/polecamy/keep-calm-and-wait-for-friday
• 24 Aug 2026 - unknown · http://jotamaria-atheneurn.blogspot.com/search
• 24 Aug 2026 - unknown · http://jotamaria-atheneurn.blogspot.com/
• 24 Aug 2026 - unknown · http://jotamaria-atheneurn.blogspot.com/2013/
• 24 Aug 2026 - unknown · http://fullpornolariizle.blogspot.com/

Questions about pagead2.googlesyndication.com

Is pagead2.googlesyndication.com safe?

No. MalwareAnalyzer scanned pagead2.googlesyndication.com on 21 Aug 2026 and returned a suspicious verdict with a score of 45 out of 100, categorised as phishing. Treat it as hostile until it is re-checked.

What malware is associated with pagead2.googlesyndication.com?

319 analysed samples communicate with this URL.

How was pagead2.googlesyndication.com checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the fast tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of pagead2.googlesyndication.com

Scanned on MalwareAnalyzer by Cyble · Open interactive scan