topic Re: Suspicious Traffic of gvt1.com in General Topics https://community.checkpoint.com/t5/General-Topics/Suspicious-Traffic-of-gvt1-com/m-p/30244#M6161 <HTML><HEAD></HEAD><BODY><P>Hello so far those sites are used to update chrome.&nbsp;</P><P><A class="jivelink10" href="https://productforums.google.com/forum/#!topic/chrome-admins/I5WLpuxclI4;context-place=topicsearchin/chrome-admins/gvt1.com" title="https://productforums.google.com/forum/#!topic/chrome-admins/I5WLpuxclI4;context-place=topicsearchin/chrome-admins/gvt1.com">https://productforums.google.com/forum/#!topic/chrome-admins/I5WLpuxclI4;context-place=topicsearchin/chrome-admins/gvt1.com</A></P></BODY></HTML> Tue, 23 Oct 2018 05:54:35 GMT Pablo_Barriga 2018-10-23T05:54:35Z Suspicious Traffic of gvt1.com https://community.checkpoint.com/t5/General-Topics/Suspicious-Traffic-of-gvt1-com/m-p/30238#M6155 <HTML><HEAD></HEAD><BODY><P>Hi All,</P><P></P><P>I have taken monthly report of top 10 application from Smart Event and I found traffic for <STRONG>gvt1.com </STRONG>among them.&nbsp;Risk for this URL is 0-unknown for Checkpoint.</P><P>I have researched a bit so some are saying that it is for Chrome browser update and some are saying that it is malware. Anyone has idea about this. If it is virus/malware then how we can remove it, IPS Blade has any signature for this?</P></BODY></HTML> Fri, 16 Feb 2018 18:10:34 GMT https://community.checkpoint.com/t5/General-Topics/Suspicious-Traffic-of-gvt1-com/m-p/30238#M6155 Gaurav_Pandya 2018-02-16T18:10:34Z Re: Suspicious Traffic of gvt1.com https://community.checkpoint.com/t5/General-Topics/Suspicious-Traffic-of-gvt1-com/m-p/30239#M6156 <HTML><HEAD></HEAD><BODY><P>We'd have to look at the actual traffic in question to see if it's malicious or not.</P></BODY></HTML> Fri, 16 Feb 2018 21:02:58 GMT https://community.checkpoint.com/t5/General-Topics/Suspicious-Traffic-of-gvt1-com/m-p/30239#M6156 PhoneBoy 2018-02-16T21:02:58Z Re: Suspicious Traffic of gvt1.com https://community.checkpoint.com/t5/General-Topics/Suspicious-Traffic-of-gvt1-com/m-p/30240#M6157 <HTML><HEAD></HEAD><BODY><P>Hi, do you still see such traffic ? Do you have the same categorization ?</P></BODY></HTML> Mon, 19 Feb 2018 01:07:27 GMT https://community.checkpoint.com/t5/General-Topics/Suspicious-Traffic-of-gvt1-com/m-p/30240#M6157 XavierBens 2018-02-19T01:07:27Z Re: Suspicious Traffic of gvt1.com https://community.checkpoint.com/t5/General-Topics/Suspicious-Traffic-of-gvt1-com/m-p/30241#M6158 <HTML><HEAD></HEAD><BODY><P>Hi,</P><P>Let me check with end users. I will update.</P></BODY></HTML> Mon, 19 Feb 2018 12:35:56 GMT https://community.checkpoint.com/t5/General-Topics/Suspicious-Traffic-of-gvt1-com/m-p/30241#M6158 Gaurav_Pandya 2018-02-19T12:35:56Z Re: Suspicious Traffic of gvt1.com https://community.checkpoint.com/t5/General-Topics/Suspicious-Traffic-of-gvt1-com/m-p/30242#M6159 <HTML><HEAD></HEAD><BODY><P>Hi,</P><P>We have Scan the machine with Antivirus from which this URL is accessed but didn't find anything. Also checked in the smart event logs and this traffic comes immediate after google services so seems to be legitimate traffic.</P><P></P><P><IMG alt="" class="image-1 jive-image j-img-original" src="https://community.checkpoint.com/legacyfs/online/checkpoint/63218_Capture1.JPG" style="height: auto;" /></P><P>However I will keep an eye.</P></BODY></HTML> Tue, 20 Feb 2018 11:12:18 GMT https://community.checkpoint.com/t5/General-Topics/Suspicious-Traffic-of-gvt1-com/m-p/30242#M6159 Gaurav_Pandya 2018-02-20T11:12:18Z Re: Suspicious Traffic of gvt1.com https://community.checkpoint.com/t5/General-Topics/Suspicious-Traffic-of-gvt1-com/m-p/30243#M6160 <HTML><HEAD></HEAD><BODY><P>Hi,</P><P></P><P>gvt1.com owner is google.com&nbsp; see&nbsp;&nbsp;&nbsp;<A href="https://www.whois.com/whois/gvt1.com">https://www.whois.com/whois/gvt1.com</A>&nbsp;. GVT&nbsp; is an acronym for Google Video Transcoding and is used i.e. as local cache server for youtube videos and google product updates (chrome, google earth).&nbsp;</P><P>I don't think google is deploying malware. Therefore it's safe to say that traffic should be fine.&nbsp;</P><P></P><P>Don't trust those website saying this is a virus and offering some suspicious software to "remove" this "virus" off your systems.&nbsp;</P><P></P><P>Cheers,</P><P>Alex</P></BODY></HTML> Tue, 23 Oct 2018 05:10:19 GMT https://community.checkpoint.com/t5/General-Topics/Suspicious-Traffic-of-gvt1-com/m-p/30243#M6160 Alexander_Eck 2018-10-23T05:10:19Z Re: Suspicious Traffic of gvt1.com https://community.checkpoint.com/t5/General-Topics/Suspicious-Traffic-of-gvt1-com/m-p/30244#M6161 <HTML><HEAD></HEAD><BODY><P>Hello so far those sites are used to update chrome.&nbsp;</P><P><A class="jivelink10" href="https://productforums.google.com/forum/#!topic/chrome-admins/I5WLpuxclI4;context-place=topicsearchin/chrome-admins/gvt1.com" title="https://productforums.google.com/forum/#!topic/chrome-admins/I5WLpuxclI4;context-place=topicsearchin/chrome-admins/gvt1.com">https://productforums.google.com/forum/#!topic/chrome-admins/I5WLpuxclI4;context-place=topicsearchin/chrome-admins/gvt1.com</A></P></BODY></HTML> Tue, 23 Oct 2018 05:54:35 GMT https://community.checkpoint.com/t5/General-Topics/Suspicious-Traffic-of-gvt1-com/m-p/30244#M6161 Pablo_Barriga 2018-10-23T05:54:35Z Re: Suspicious Traffic of gvt1.com https://community.checkpoint.com/t5/General-Topics/Suspicious-Traffic-of-gvt1-com/m-p/30245#M6162 <HTML><HEAD></HEAD><BODY><P>Hi Alex/Pablo,</P><P></P><P>Thanks for the information.</P></BODY></HTML> Tue, 23 Oct 2018 12:48:22 GMT https://community.checkpoint.com/t5/General-Topics/Suspicious-Traffic-of-gvt1-com/m-p/30245#M6162 Gaurav_Pandya 2018-10-23T12:48:22Z