pagead2.googlesyndication.com - suspicious URL scan, 19 Aug 2026

MalwareAnalyzer by Cyble scanned pagead2.googlesyndication.com and returned a suspicious verdict (score 25), categorised as phishing. The page resolved to 142.250.207.2 on Google LLC in JP. The domain was registered 8611 days ago through MarkMonitor Inc.. 1 domain and 1 IP were contacted. 173 malware samples communicate with this URL. This is a point-in-time observation from 19 Aug 2026; the page may have changed since.

Scan result

• Verdict: suspicious (score 25) · Confidence 28%
• Scanned URL: https://pagead2.googlesyndication.com/pagead/js/logging_library.js
• Domain: pagead2.googlesyndication.com · IP: 142.250.207.2 · AS15169 · JP
• Server: cafe
• HTTP status: 404 · text/html; charset=ISO-8859-1
• Registrar: MarkMonitor Inc. · domain age 8611 days · created 2003-01-21
• TLS issuer: C=US, O=Google Trust Services, CN=WR2 · valid to Oct 28 20: · subject CN=*.g.doubleclick.net
• Scan tier: fast · observed 2026-08-19 12:19:07 UTC

Malware communicating with this URL (173)

These samples were observed contacting or being served from pagead2.googlesyndication.com. Each links to its full analysis.

• f.txt - referenced · 5c4ece1f1a97a6ff05e1622f544e1b58 · first seen 2026-08-19
• 6e986864e3816effc5ab16204054bee217da86c89fafcf77bca4deeeb4642c48 - referenced · 6e986864e3816effc5ab16204054bee2 · first seen 2026-08-19
• 6ad87c8b9d3a75a65292a0c23e628dfdb0b25bd8c22905de37bee5055cd8770d - referenced · 6ad87c8b9d3a75a65292a0c23e628dfd · first seen 2026-08-19
• 8859e50a799112354610f43695eacc8c77a0cf6c28b3f249f62a0304d04241ca - referenced · 8859e50a799112354610f43695eacc8c · first seen 2026-08-19
• 6ad19148ef24d24434520b5a41dff39ae9d076c185f99564f16eda44ce384733 - referenced · 6ad19148ef24d24434520b5a41dff39a · first seen 2026-08-19
• 44f6638002da077eabb8925a44795e6d91f7231bc1ddffad320812a5ef1e6800 - referenced · 44f6638002da077eabb8925a44795e6d · first seen 2026-08-18
• b972f03cbd8addffe3c08ecaa0d1738cb7c352b0012eda00b9974db2d2fb9d73 - referenced · b972f03cbd8addffe3c08ecaa0d1738c · first seen 2026-08-17
• 6ada12ba3f39991e9e6fa2bd1f4195a84e6e3143e84eaf031aaae1eb466f940f - referenced · 6ada12ba3f39991e9e6fa2bd1f4195a8 · first seen 2026-08-17
• 6ad3c90a7486d34b88fc80f912bcadde049ccf7c440072051b50e5214292de59 - referenced · 6ad3c90a7486d34b88fc80f912bcadde · first seen 2026-08-17
• 0d1ad591fd199bc8623c6f87f84f2798370eee1e9217e22dec2b21aec89bc738 - referenced · 0d1ad591fd199bc8623c6f87f84f2798 · first seen 2026-08-17
• cd27f1db1a531f24c2386d0410d8ca601f85a489f8b824522f79f55c897afc13 - referenced · cd27f1db1a531f24c2386d0410d8ca60 · first seen 2026-08-17
• f.txt - referenced (hosted here) · 71f8db09aec8b4eb26c6a884d4bf2f98 · first seen 2026-08-17
• 6adfecbbfe26c19e68d5106b87acbb7e44db3132fed0956fe50f7520c8f97efa - referenced · 6adfecbbfe26c19e68d5106b87acbb7e · first seen 2026-08-17
• 12765aebbdace3fa4083ba5917fa34583421e12d70acd9ca5e5724ab089623c7 - referenced · 12765aebbdace3fa4083ba5917fa3458 · first seen 2026-08-17
• d25296b3cd46ca371263d21b7df23e4dd58f65870c76c78d66f55316d45e6e6a - referenced · d25296b3cd46ca371263d21b7df23e4d · first seen 2026-08-17

Categories

• phishing

Why this verdict

• Domain impersonates google (combosquat)

Contacted infrastructure

• 142.250.207.2 - AS15169 Google LLC (Japan)

Observed indicators

• pagead2.googlesyndication.com
• 142.250.207.2
• https://pagead2.googlesyndication.com/pagead/js/logging_library.js

Other scans of pagead2.googlesyndication.com (10)

This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.

• 24 Aug 2026 - unknown · http://jotamaria-basemossoro.blogspot.com/search
• 24 Aug 2026 - unknown · http://jotamaria-basemossoro.blogspot.com/
• 24 Aug 2026 - unknown · http://cucmoi.blogspot.com/search/label/edit%20url
• 24 Aug 2026 - suspicious · https://gsgd.co.uk/sandbox/jquery/easing/
• 24 Aug 2026 - unknown · http://malsup.com/jquery/block/
• 24 Aug 2026 - unknown · http://selintasdunia.blogspot.com/2011/02/10-isi-kepala-perempuan-yang-perlu.html
• 24 Aug 2026 - unknown · http://jotamaria-cearense.blogspot.com/search
• 24 Aug 2026 - unknown · http://jotamaria-ccdejoaocamara.blogspot.com/search
• 24 Aug 2026 - unknown · http://jotajunior-servicosrn.blogspot.com/search
• 24 Aug 2026 - unknown · http://jotajunior-servicosrn.blogspot.com/

Questions about pagead2.googlesyndication.com

Is pagead2.googlesyndication.com safe?

No. MalwareAnalyzer scanned pagead2.googlesyndication.com on 19 Aug 2026 and returned a suspicious verdict with a score of 25 out of 100, categorised as phishing. Treat it as hostile until it is re-checked.

What malware is associated with pagead2.googlesyndication.com?

173 analysed samples communicate with this URL.

How was pagead2.googlesyndication.com checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the fast tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of pagead2.googlesyndication.com

Scanned on MalwareAnalyzer by Cyble · Open interactive scan