Suspicious Traffic of gvt1.com

[Gaurav_Pandya]

Hi All,

I have taken monthly report of top 10 application from Smart Event and I found traffic for gvt1.com among them. Risk for this URL is 0-unknown for Checkpoint.

I have researched a bit so some are saying that it is for Chrome browser update and some are saying that it is malware. Anyone has idea about this. If it is virus/malware then how we can remove it, IPS Blade has any signature for this?

[PhoneBoy]

We'd have to look at the actual traffic in question to see if it's malicious or not.

[XavierBens]

Hi, do you still see such traffic ? Do you have the same categorization ?

[Gaurav_Pandya]

Hi,

Let me check with end users. I will update.

[Gaurav_Pandya]

Hi,

We have Scan the machine with Antivirus from which this URL is accessed but didn't find anything. Also checked in the smart event logs and this traffic comes immediate after google services so seems to be legitimate traffic.

However I will keep an eye.

[Pablo_Barriga]

Hello so far those sites are used to update chrome. 

https://productforums.google.com/forum/#!topic/chrome-admins/I5WLpuxclI4;context-place=topicsearchin...

[Alexander_Eck]

Hi,

gvt1.com owner is google.com  see   https://www.whois.com/whois/gvt1.com . GVT  is an acronym for Google Video Transcoding and is used i.e. as local cache server for youtube videos and google product updates (chrome, google earth). 

I don't think google is deploying malware. Therefore it's safe to say that traffic should be fine. 

Don't trust those website saying this is a virus and offering some suspicious software to "remove" this "virus" off your systems. 

Cheers,

Alex

[Gaurav_Pandya]

Hi Alex/Pablo,

Thanks for the information.