pagead2.googlesyndication.com - suspicious URL scan, 22 Aug 2026

MalwareAnalyzer by Cyble scanned pagead2.googlesyndication.com and returned a suspicious verdict (score 45), categorised as phishing. The page resolved to 142.251.42.98 on Google LLC in IN. The domain was registered 8614 days ago through MarkMonitor Inc.. 1 domain and 1 IP were contacted. 393 malware samples communicate with this URL. This is a point-in-time observation from 22 Aug 2026; the page may have changed since.

Scan result

• Verdict: suspicious (score 45) · Confidence 54%
• Scanned URL: http://pagead2.googlesyndication.com/pagead/show_ads.js
• Domain: pagead2.googlesyndication.com · IP: 142.251.42.98 · AS15169 · IN
• Server: cafe
• HTTP status: 200 · text/javascript; charset=ISO-8859-1
• Registrar: MarkMonitor Inc. · domain age 8614 days · created 2003-01-21
• Scan tier: fast · observed 2026-08-22 12:47:11 UTC

Malware communicating with this URL (393)

These samples were observed contacting or being served from pagead2.googlesyndication.com. Each links to its full analysis.

• cc5c1cde8bdb7eb753476ab572b31b3941b0f3f0d8e43c713559ff45ef506daa - referenced · cc5c1cde8bdb7eb753476ab572b31b39 · first seen 2026-08-22
• a6d622955c2bab36867a9fd7ba0928d62a26e436b1c5155f186b64cc7e9459da - referenced · a6d622955c2bab36867a9fd7ba0928d6 · first seen 2026-08-22
• d32170aa3bee128f9c787f52ba15094ee5f3041d37eb30d1fede2a7995ccb98c - referenced · d32170aa3bee128f9c787f52ba15094e · first seen 2026-08-22
• 545fd6a5f1d01ca0f4c27bc45fba7adcbd3d6a0c560fad6aa269caa317955690 - referenced · 545fd6a5f1d01ca0f4c27bc45fba7adc · first seen 2026-08-22
• d32ab44974332375cb7c7ce81e41b86a4e487f2e4d27fb628ac52dddee928ce5 - referenced · d32ab44974332375cb7c7ce81e41b86a · first seen 2026-08-22
• 69f292c9e0ef1a8bf08f2ba9940a00fbe920548dcb2d295afc29beb0489c1093 - referenced · 69f292c9e0ef1a8bf08f2ba9940a00fb · first seen 2026-08-22
• 9b9d633faa688c2503cc949ae15aec7d0a0d7e9f5d3e7f0978ac7c2330e01e2a - referenced · 9b9d633faa688c2503cc949ae15aec7d · first seen 2026-08-22
• 162962d018f5eb7ba373683259fa878814dc6345b0b7b4a79d0b9fc9c7310d63 - referenced · 162962d018f5eb7ba373683259fa8788 · first seen 2026-08-22
• 9c809c0e13ef8b80f1aed5875d7f57461daa83ecbe663bed648528c3e265dbae - referenced · 9c809c0e13ef8b80f1aed5875d7f5746 · first seen 2026-08-22
• f0b563cf38de0a9c62f8a29b8294f8c0a8430aab3ebec48c902c764c44920647 - referenced · f0b563cf38de0a9c62f8a29b8294f8c0 · first seen 2026-08-22
• d323891d1fb8884fe9f02488f96d7267aef35bd2872ae764b438a9bfd32a7329 - referenced · d323891d1fb8884fe9f02488f96d7267 · first seen 2026-08-22
• d32fae7810d4455a1a2008d864aa07f003a9579d45f331dd433571fa36cce331 - referenced · d32fae7810d4455a1a2008d864aa07f0 · first seen 2026-08-22
• d3285421298a58d3884d35927618706720926578f9d481d6834ed57208ecd1fd - referenced · d3285421298a58d3884d359276187067 · first seen 2026-08-22
• d328deec6d47df2726c91a6d667b559e35befa9772d7a6296f9e2b515d0bb629 - referenced · d328deec6d47df2726c91a6d667b559e · first seen 2026-08-22
• 0bc60853b3d8f11d4b45ab77b9264655f665ff4bf1e033850701253e4c2149e0 - referenced · 0bc60853b3d8f11d4b45ab77b9264655 · first seen 2026-08-22

Antivirus & YARA (0 of 48 engines)

No engine flagged this page's content.

Categories

• phishing

Why this verdict

• Domain impersonates google (combosquat)
• File download routed to the malware sandbox (f.txt)
• Served over plaintext HTTP

Contacted infrastructure

• 142.251.42.98 - AS15169 Google LLC (India)

Files served by this page

• f.txt · 8ad8ea68d7bb3e7f9ff9eaf7c5846664

Observed indicators

• pagead2.googlesyndication.com
• 142.251.42.98
• http://pagead2.googlesyndication.com/pagead/show_ads.js

Other scans of pagead2.googlesyndication.com (10)

This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.

• 24 Aug 2026 - unknown · http://jotamaria-basemossoro.blogspot.com/search
• 24 Aug 2026 - unknown · http://jotamaria-basemossoro.blogspot.com/
• 24 Aug 2026 - unknown · http://cucmoi.blogspot.com/search/label/edit%20url
• 24 Aug 2026 - suspicious · https://gsgd.co.uk/sandbox/jquery/easing/
• 24 Aug 2026 - unknown · http://malsup.com/jquery/block/
• 24 Aug 2026 - unknown · http://selintasdunia.blogspot.com/2011/02/10-isi-kepala-perempuan-yang-perlu.html
• 24 Aug 2026 - unknown · http://jotamaria-cearense.blogspot.com/search
• 24 Aug 2026 - unknown · http://jotamaria-ccdejoaocamara.blogspot.com/search
• 24 Aug 2026 - unknown · http://jotajunior-servicosrn.blogspot.com/search
• 24 Aug 2026 - unknown · http://jotajunior-servicosrn.blogspot.com/

Questions about pagead2.googlesyndication.com

Is pagead2.googlesyndication.com safe?

No. MalwareAnalyzer scanned pagead2.googlesyndication.com on 22 Aug 2026 and returned a suspicious verdict with a score of 45 out of 100, categorised as phishing. Treat it as hostile until it is re-checked.

What malware is associated with pagead2.googlesyndication.com?

393 analysed samples communicate with this URL.

How was pagead2.googlesyndication.com checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the fast tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of pagead2.googlesyndication.com

Scanned on MalwareAnalyzer by Cyble · Open interactive scan