"Google Single Sign On: Sign into corp": A strange page for Google corporate login or something, it's unclear what hides behind it.
"Google Single Sign On: Sign into corp": A strange page for Google corporate login or something, it's unclear what hides behind it.
The favicon is this strange dinosaur bird:
Every time the page is reloaded, a new decorative image is displayed (randomly picked?) from the following (with baseurl https://static.corp.google.com/corpsso/images/
), list not exhaustive:
It appears accessible via the locations:
*
login.corp.google.com
, which does nothing particular*
admin.youtube.com
, [dispatch
|listnr
|data
|qatool
|roboslicer
].corp.google.com
, which put an unique token and some generic data in the URL and redirect to: https://login.corp.google.com/request?s=
[subdomain].corp.google.com:443/uberproxy/&d=https://
[subdomain].corp.google.com/%3Fupxsrf%3DAFIFSXPGfYMQfQhXcDxDLF6znWzko9HZcKnp1_C_fxflS0Ar6g:1721039092116&maxAge=1200&authLevel=2000000&keyIds=DU5,2O9&c=1
Just
corp.google.com
opens a standard Google login page to "Login to CorpSSO", OAuth app with following info:* Email: sso-team@google.com
* Signing in will redirect you to: https://login.corp.google.com
Instead,
admin.google.com
gives a normal login page to who knows where (I would guess the Google Admin Console for normal paying users?).Other sources:
* https://news.ycombinator.com/item?id=9543517
* Scary site visits from corp.google.com: https://www.buildersociety.com/threads/scary-site-visits-from-corp-google-com.5994/
* Google login images, scraping code and URL list: https://gist.github.com/mdamien/2b1a06c3a112e5ab5c05