Seeing 192.55.233.1 on PayPal login page

Ask for help about NoScript, no registration needed to post
bigkeefer
Posts: 3
Joined: Tue Sep 06, 2022 12:24 pm

Seeing 192.55.233.1 on PayPal login page

Post by bigkeefer »

Hi all,

I am puzzled by this and was wondering if anyone was so kind as to have any ideas as to why I'm seeing what I'm seeing.

Windows 10. Firefox (104.0.1). Version 11.4.10 of NoScript.

When I visit paypal.com I am seeing only the expected domains in NoScript. However, on the login page, I am seeing expected domains but also the private IP of 192.55.233.1. This is NOT even my private network, so I have no idea where it's coming from?

This only happens on my Windows machine, and not on my Ubuntu machine (also running Firefox and NoScript).

I do have WSL2 installed and also have had VirtualBox in the past (now uninstalled) but neither of these use/have used the network mentioned above.

MBAM reports no malware on the PC.

EDIT: I have no other extensions in Firefox (and never have) other than multi-user containers and Snooze Tabs. I do not have the MBAM extension (Browser Guard) installed and MBAM was actually only installed after I noticed this PayPal issue. (Until then only Windows Defender has ever been active/installed on this machine.)

I have no proxy server.

Any thoughts would be much appreciated! Many thanks in advance.
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
User avatar
Giorgio Maone
Site Admin
Posts: 9454
Joined: Wed Mar 18, 2009 11:22 pm
Location: Palermo - Italy
Contact:

Re: Seeing 192.55.233.1 on PayPal login page

Post by Giorgio Maone »

That surely seems the doing of a browser extension, even though you say you've got none.
However 192.55.233.1 seems not to be a LAN IP but a public one belonging to Intel Corporation, if that rings any bell for you.
Mozilla/5.0 (X11; Linux x86_64; rv:105.0) Gecko/20100101 Firefox/105.0
User avatar
therube
Ambassador
Posts: 7924
Joined: Thu Mar 19, 2009 4:17 pm
Location: Maryland USA

Re: Seeing 192.55.233.1 on PayPal login page

Post by therube »

192.55.233.1. This is NOT even my private network
Just to point out the LAN range for 192.x.x.x is, 192.168.0.0 - 192.168.255.255.
(So 192.55.x.x is outside of that, so not local.)
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.19) Gecko/20110420 SeaMonkey/2.0.14 Pinball NoScript FlashGot AdblockPlus
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
barbaz
Senior Member
Posts: 10841
Joined: Sat Aug 03, 2013 5:45 pm

Re: Seeing 192.55.233.1 on PayPal login page

Post by barbaz »

bigkeefer wrote: Tue Sep 06, 2022 12:39 pm multi-user containers and Snooze Tabs.
Are you sure neither of these are the culprit?

Could you please post the AMO links for these two addons? Searching finds no addons named "multi-user containers" and two different addons both named "Snooze Tabs".

EDIT
Does Netmon see the attempted request(s) to this IP? If so can you please post the full URLs (in code tags, so as not to post live links)?
*Always* check the changelogs BEFORE updating that important software!
-
bigkeefer
Posts: 3
Joined: Tue Sep 06, 2022 12:24 pm

Re: Seeing 192.55.233.1 on PayPal login page

Post by bigkeefer »

Thank you both so much for your replies.

I think I saw 192... and my brain, out of habit I guess, instantly jumped to private IP address without thinking about it properly.

So, a public address makes more sense for sure (I really must get more sleep! :D ) , but no, I definitely have no other FF extensions running and I have no idea why Intel is trying to show up to the party (and why an IP addr instead of a domain name come to that).

It only appears to be on PayPal's login site as well (so far anyway). Although, having said that, I normally spend 99.9% of my time in Linux (wishing it could be 100%!) so I'll experiment some more to confirm this.

Many thanks again.
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
bigkeefer
Posts: 3
Joined: Tue Sep 06, 2022 12:24 pm

Re: Seeing 192.55.233.1 on PayPal login page

Post by bigkeefer »

Many thanks barbaz for your reply.

I have just disabled both extensions and see the same problem with nothing but NoScript running in FF.

Containers is by Mozilla and Snooze Tabs is by Mozilla Test Pilots.

I'll look into NetMon and get back to you.

Many thanks!
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Post Reply