pagead2.googlesyndication.com - suspicious URL scan, 20 Aug 2026

MalwareAnalyzer by Cyble scanned pagead2.googlesyndication.com and returned a suspicious verdict (score 45), categorised as phishing. The page resolved to 142.250.183.34 on Google LLC in IN. The domain was registered 8611 days ago through MarkMonitor Inc.. 1 domain and 1 IP were contacted. 210 malware samples communicate with this URL. This is a point-in-time observation from 20 Aug 2026; the page may have changed since.

Scan result

• Verdict: suspicious (score 45) · Confidence 54%
• Scanned URL: http://pagead2.googlesyndication.com/pagead/show_ads.js
• Domain: pagead2.googlesyndication.com · IP: 142.250.183.34 · AS15169 · IN
• Server: cafe
• HTTP status: 200 · text/javascript; charset=ISO-8859-1
• Registrar: MarkMonitor Inc. · domain age 8611 days · created 2003-01-21
• Scan tier: fast · observed 2026-08-20 06:12:11 UTC

Malware communicating with this URL (210)

These samples were observed contacting or being served from pagead2.googlesyndication.com. Each links to its full analysis.

• dade7aac374d6435284a45fb47849454c6e97b3d9c6d35f35bda29eb219d234d - referenced · dade7aac374d6435284a45fb47849454 · first seen 2026-08-20
• af8d0622340c693559afe810a254838c645d857da58a5761369b2caa58236c9e - referenced · af8d0622340c693559afe810a254838c · first seen 2026-08-20
• 9908f629a0d0022dac5cb5736c5ae4ec827d2a44df20dbcf7413e3ebb053b580 - referenced · 9908f629a0d0022dac5cb5736c5ae4ec · first seen 2026-08-20
• b5ffcb99efdb5b215e264b9141d15eb4cfd4a7b59005030f810438ab658d050d - referenced · b5ffcb99efdb5b215e264b9141d15eb4 · first seen 2026-08-20
• 5cf79f8b58b946bd938e5343eb2becbbc12fd8e786f65248baa10fff56c6aa44 - referenced · 5cf79f8b58b946bd938e5343eb2becbb · first seen 2026-08-20
• 990754a4faf3c6794699c75bb61b0a5ab6b4ce2d7d699c7c2c2f9ba5580e8eef - referenced · 990754a4faf3c6794699c75bb61b0a5a · first seen 2026-08-20
• 9907e1f277910a24dbb2e63c7b60d0eefc75ff19a0ea3fb276a13162820d3524 - referenced · 9907e1f277910a24dbb2e63c7b60d0ee · first seen 2026-08-20
• 189ee2dfdc62c7bfa8809d323c8bc4c7151c2e8cd8349969abdcf13dd4b4a4d8 - referenced · 189ee2dfdc62c7bfa8809d323c8bc4c7 · first seen 2026-08-20
• e2f543649fa592048f6c4897314fc1e66145b113d2682abd1b56b36bdf47ea13 - referenced · e2f543649fa592048f6c4897314fc1e6 · first seen 2026-08-20
• 99047e62509742f223b51bc4e87cac3dfd1e21251f74ba48e8133ab4cb2e8add - referenced · 99047e62509742f223b51bc4e87cac3d · first seen 2026-08-20
• 9901b2d5a20e98ed517f02c26d57996557077d9effc93d4706be555e725357e4 - referenced · 9901b2d5a20e98ed517f02c26d579965 · first seen 2026-08-20
• b6e6eb636d807deaefe9b850b2b0dc8944c487d9265d0cb41ea9717705833cfa - referenced · b6e6eb636d807deaefe9b850b2b0dc89 · first seen 2026-08-20
• b15afb7b0656a5516bd35ef322005ff4b6fcbf085dee9743c9bd1cfb3ff2dec3 - referenced · b15afb7b0656a5516bd35ef322005ff4 · first seen 2026-08-20
• fa24b1fbb8d6d91701df3eb04ce3aca0cbda0cfda232d2b4855fe8ab9a1d20f8 - referenced · fa24b1fbb8d6d91701df3eb04ce3aca0 · first seen 2026-08-20
• 0691098f3a822470a776413b51823c7d6156cb5d2dbe5aaab394b1236913ee87 - referenced · 0691098f3a822470a776413b51823c7d · first seen 2026-08-20

Antivirus & YARA (0 of 47 engines)

No engine flagged this page's content.

Categories

• phishing

Why this verdict

• Domain impersonates google (combosquat)
• File download routed to the malware sandbox (f.txt)
• Served over plaintext HTTP

Contacted infrastructure

• 142.250.183.34 - AS15169 Google LLC (India)

Files served by this page

• f.txt · d68dd5e2e237f2092b1f468bfc614a11

Observed indicators

• pagead2.googlesyndication.com
• 142.250.183.34
• http://pagead2.googlesyndication.com/pagead/show_ads.js

Other scans of pagead2.googlesyndication.com (10)

This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.

• 24 Aug 2026 - unknown · http://cucmoi.blogspot.com/search/label/edit%20url
• 24 Aug 2026 - suspicious · https://gsgd.co.uk/sandbox/jquery/easing/
• 24 Aug 2026 - unknown · http://malsup.com/jquery/block/
• 24 Aug 2026 - unknown · http://selintasdunia.blogspot.com/2011/02/10-isi-kepala-perempuan-yang-perlu.html
• 24 Aug 2026 - unknown · http://jotamaria-cearense.blogspot.com/search
• 24 Aug 2026 - unknown · http://jotamaria-ccdejoaocamara.blogspot.com/search
• 24 Aug 2026 - unknown · http://jotajunior-servicosrn.blogspot.com/search
• 24 Aug 2026 - unknown · http://jotajunior-servicosrn.blogspot.com/
• 24 Aug 2026 - unknown · http://legendsnewsbr.blogspot.com/
• 24 Aug 2026 - unknown · https://moda.net.pl/

Questions about pagead2.googlesyndication.com

Is pagead2.googlesyndication.com safe?

No. MalwareAnalyzer scanned pagead2.googlesyndication.com on 20 Aug 2026 and returned a suspicious verdict with a score of 45 out of 100, categorised as phishing. Treat it as hostile until it is re-checked.

What malware is associated with pagead2.googlesyndication.com?

210 analysed samples communicate with this URL.

How was pagead2.googlesyndication.com checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the fast tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of pagead2.googlesyndication.com

Scanned on MalwareAnalyzer by Cyble · Open interactive scan