Hi all,
I am puzzled by this and was wondering if anyone was so kind as to have any ideas as to why I'm seeing what I'm seeing.
Windows 10. Firefox (104.0.1). Version 11.4.10 of NoScript.
When I visit paypal.com I am seeing only the expected domains in NoScript. However, on the login page, I am seeing expected domains but also the private IP of 192.55.233.1. This is NOT even my private network, so I have no idea where it's coming from?
This only happens on my Windows machine, and not on my Ubuntu machine (also running Firefox and NoScript).
I do have WSL2 installed and also have had VirtualBox in the past (now uninstalled) but neither of these use/have used the network mentioned above.
MBAM reports no malware on the PC.
EDIT: I have no other extensions in Firefox (and never have) other than multi-user containers and Snooze Tabs. I do not have the MBAM extension (Browser Guard) installed and MBAM was actually only installed after I noticed this PayPal issue. (Until then only Windows Defender has ever been active/installed on this machine.)
I have no proxy server.
Any thoughts would be much appreciated! Many thanks in advance.
Seeing 192.55.233.1 on PayPal login page
Seeing 192.55.233.1 on PayPal login page
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
- Giorgio Maone
- Site Admin
- Posts: 9455
- Joined: Wed Mar 18, 2009 11:22 pm
- Location: Palermo - Italy
- Contact:
Re: Seeing 192.55.233.1 on PayPal login page
That surely seems the doing of a browser extension, even though you say you've got none.
However 192.55.233.1 seems not to be a LAN IP but a public one belonging to Intel Corporation, if that rings any bell for you.
However 192.55.233.1 seems not to be a LAN IP but a public one belonging to Intel Corporation, if that rings any bell for you.
Mozilla/5.0 (X11; Linux x86_64; rv:105.0) Gecko/20100101 Firefox/105.0
Re: Seeing 192.55.233.1 on PayPal login page
Just to point out the LAN range for 192.x.x.x is, 192.168.0.0 - 192.168.255.255.192.55.233.1. This is NOT even my private network
(So 192.55.x.x is outside of that, so not local.)
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.19) Gecko/20110420 SeaMonkey/2.0.14 Pinball NoScript FlashGot AdblockPlus
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Re: Seeing 192.55.233.1 on PayPal login page
Are you sure neither of these are the culprit?
Could you please post the AMO links for these two addons? Searching finds no addons named "multi-user containers" and two different addons both named "Snooze Tabs".
EDIT
Does Netmon see the attempted request(s) to this IP? If so can you please post the full URLs (in code tags, so as not to post live links)?
*Always* check the changelogs BEFORE updating that important software!
-
Re: Seeing 192.55.233.1 on PayPal login page
Thank you both so much for your replies.
I think I saw 192... and my brain, out of habit I guess, instantly jumped to private IP address without thinking about it properly.
So, a public address makes more sense for sure (I really must get more sleep! ) , but no, I definitely have no other FF extensions running and I have no idea why Intel is trying to show up to the party (and why an IP addr instead of a domain name come to that).
It only appears to be on PayPal's login site as well (so far anyway). Although, having said that, I normally spend 99.9% of my time in Linux (wishing it could be 100%!) so I'll experiment some more to confirm this.
Many thanks again.
I think I saw 192... and my brain, out of habit I guess, instantly jumped to private IP address without thinking about it properly.
So, a public address makes more sense for sure (I really must get more sleep! ) , but no, I definitely have no other FF extensions running and I have no idea why Intel is trying to show up to the party (and why an IP addr instead of a domain name come to that).
It only appears to be on PayPal's login site as well (so far anyway). Although, having said that, I normally spend 99.9% of my time in Linux (wishing it could be 100%!) so I'll experiment some more to confirm this.
Many thanks again.
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Re: Seeing 192.55.233.1 on PayPal login page
Many thanks barbaz for your reply.
I have just disabled both extensions and see the same problem with nothing but NoScript running in FF.
Containers is by Mozilla and Snooze Tabs is by Mozilla Test Pilots.
I'll look into NetMon and get back to you.
Many thanks!
I have just disabled both extensions and see the same problem with nothing but NoScript running in FF.
Containers is by Mozilla and Snooze Tabs is by Mozilla Test Pilots.
I'll look into NetMon and get back to you.
Many thanks!
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0