Why is my ip adress showing up as a blocked script?
Why is my ip adress showing up as a blocked script?
Recently when i visit a couple of websites noscript is showing my own ip address as one of the blocked scripts for the website. This has never happened before and it's only happening on a couple of sites. Why is my ip address showing up as a script? I've run virus scans and malwarebytes and they come up with nothing wrong. Thanks in advance for any information.
Mozilla/5.0 (Windows NT 6.0; WOW64; rv:25.0) Gecko/20100101 Firefox/25.0
Re: Why is my ip adress showing up as a blocked script?
Which sites?
======
Thrawn
------------
Religion is not the opium of the masses. Daily life is the opium of the masses.
True religion, which dares to acknowledge death and challenge the way we live, is an attempt to wake up.
Thrawn
------------
Religion is not the opium of the masses. Daily life is the opium of the masses.
True religion, which dares to acknowledge death and challenge the way we live, is an attempt to wake up.
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:26.0) Gecko/20100101 Firefox/26.0
- Giorgio Maone
- Site Admin
- Posts: 9454
- Joined: Wed Mar 18, 2009 11:22 pm
- Location: Palermo - Italy
- Contact:
Re: Why is my ip adress showing up as a blocked script?
Also, does it happen on a clean profile with just NoScript installed?
Are you running any local proxy (e.g. installed by an anti-virus)?
Are you running any local proxy (e.g. installed by an anti-virus)?
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101 Firefox/26.0
Re: Why is my ip adress showing up as a blocked script?
It happens on capitalone.com. and on another page on the same site. When I go to the site and temporarily allow the capitalone script on noscript - my ip address as well as the generic 127.0.0.1 then show on noscript as blocked scripts. WOT (web of trust) users report that the generic 127.0.0.1 is the loopback address or localhost for whatever computer you are using. This is the only site I have visited where noscript is showing these as blocked scripts. And I've had noscript for a long time.
I created a new profile and installed only noscript and visited capitalone and they still showed up on noscript as blocked scripts.
I don't think I'm running a local proxy. I've changed nothing recently and have been using the same antivirus (TrendMicro Titanium) for some time. I don't think TrendMicro has installed anything new (like a local proxy) on my computer. As far as I know they only provide regular definition updates to the antivirus protection.
I asked the same question on another forum and someone suggested it might be a DNS rebinding attack causing this. But I read that noscript has protection againt this with noscript ABE.
I use firefox 25 browser and have TrendMicro antivirus, malwarebytes, superantispyware, noscript, adblock, and WOT (web of trust) all installed and have had them all for a long time. And as I said earlier full scans of antivirus, malwarebytes, and superantispyware have found nothing - other than usual tracking cookies that superantispyware always finds and which have been deleted.
Thanks again for any information.
I created a new profile and installed only noscript and visited capitalone and they still showed up on noscript as blocked scripts.
I don't think I'm running a local proxy. I've changed nothing recently and have been using the same antivirus (TrendMicro Titanium) for some time. I don't think TrendMicro has installed anything new (like a local proxy) on my computer. As far as I know they only provide regular definition updates to the antivirus protection.
I asked the same question on another forum and someone suggested it might be a DNS rebinding attack causing this. But I read that noscript has protection againt this with noscript ABE.
I use firefox 25 browser and have TrendMicro antivirus, malwarebytes, superantispyware, noscript, adblock, and WOT (web of trust) all installed and have had them all for a long time. And as I said earlier full scans of antivirus, malwarebytes, and superantispyware have found nothing - other than usual tracking cookies that superantispyware always finds and which have been deleted.
Thanks again for any information.
Mozilla/5.0 (Windows NT 6.0; WOW64; rv:25.0) Gecko/20100101 Firefox/25.0
- Giorgio Maone
- Site Admin
- Posts: 9454
- Joined: Wed Mar 18, 2009 11:22 pm
- Location: Palermo - Italy
- Contact:
Re: Why is my ip adress showing up as a blocked script?
It's very likely then that a locally installed software (and most likely a proxy) is injecting stuff inside your pages on the fly.peaches77 wrote:It happens on capitalone.com. and on another page on the same site. When I go to the site and temporarily allow the capitalone script on noscript - my ip address as well as the generic 127.0.0.1 then show on noscript as blocked scripts.
Could you please use the "View source" command on that page and PM/email me its content?
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101 Firefox/26.0
Re: Why is my ip adress showing up as a blocked script?
I am seeing this as well now, on the capital one website
Mozilla/5.0 (Android; Mobile; rv:26.0) Gecko/26.0 Firefox/26.0
Re: Why is my ip adress showing up as a blocked script?
I am seeing this as well now, on the capital one website
Mozilla/5.0 (Android; Mobile; rv:26.0) Gecko/26.0 Firefox/26.0
Re: Why is my ip adress showing up as a blocked script?
It's something (probably nasty) on their end. ABE's built-in rule and my ABP filters blocking loopback addresses were triggered but I can't post the request addresses or ABE message due to spam filter...
*Always* check the changelogs BEFORE updating that important software!
Mozilla/5.0 (X11; Linux i686; rv:26.0) Gecko/20100101 Firefox/26.0 SeaMonkey/2.23
Re: Why is my ip adress showing up as a blocked script?
I gave them a call, they have no idea why the site is doing this, it only showed up on the loan page for me, I suggest someone who is better able to explain what we are seeing, give them a call and explain to the techs what's going on
Mozilla/5.0 (Android; Mobile; rv:26.0) Gecko/26.0 Firefox/26.0
-
- Senior Member
- Posts: 71
- Joined: Wed Apr 22, 2009 6:27 am
- Location: South Carolina, USA
Re: Why is my ip adress showing up as a blocked script?
for what it is worth, here is a screenshot of what i get when i go to "capitalone.com" :
http://imageshack.us/a/img35/2783/8xmo.jpg
here is the "page source"-data that i got:
https://app.box.com/s/mnq1r00l9ahau3w5zw0t
http://imageshack.us/a/img35/2783/8xmo.jpg
here is the "page source"-data that i got:
https://app.box.com/s/mnq1r00l9ahau3w5zw0t
Mozilla/5.0 (Windows NT 5.1; rv:26.0) Gecko/20100101 Firefox/26.0
Re: Why is my ip adress showing up as a blocked script?
URL: https://www.capitalone.com/
Allow, capitalone.com.
To note: 127.0.0.1 doesn't show up initially, but does populate after a moment or two.
And not only is it 127.0.0.1, but also your WAN IP shows up?
So I see Red's IP with Time Warner (from his screenshot) & my own with Comcast.
Allow, capitalone.com.
To note: 127.0.0.1 doesn't show up initially, but does populate after a moment or two.
And not only is it 127.0.0.1, but also your WAN IP shows up?
So I see Red's IP with Time Warner (from his screenshot) & my own with Comcast.
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.19) Gecko/20110420 SeaMonkey/2.0.14 Pinball NoScript FlashGot AdblockPlus
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0 SeaMonkey/2.25a2
-
- Senior Member
- Posts: 93
- Joined: Mon Oct 01, 2012 6:34 am
Re: Why is my ip adress showing up as a blocked script?
nvm
Last edited by Hecuba's daughter on Sun Jun 22, 2014 8:29 pm, edited 1 time in total.
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Firefox/24.0
Re: Why is my ip adress showing up as a blocked script?
That Cap1 knows your IP is not an issue.
Every site you visit knows (or can know if they wish) your IP.
The question is why it is being exposed by NoScript (which if I had to guess has something to do with ABE)?
> has something to do with ABE
Still happens with ABE disabled.
Every site you visit knows (or can know if they wish) your IP.
The question is why it is being exposed by NoScript (which if I had to guess has something to do with ABE)?
> has something to do with ABE
Still happens with ABE disabled.
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.19) Gecko/20110420 SeaMonkey/2.0.14 Pinball NoScript FlashGot AdblockPlus
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0 SeaMonkey/2.25a2
- Giorgio Maone
- Site Admin
- Posts: 9454
- Joined: Wed Mar 18, 2009 11:22 pm
- Location: Palermo - Italy
- Contact:
Re: Why is my ip adress showing up as a blocked script?
OK, I finally decided to enable scripts on that page and found the culprit.
This script of theirs tries to collect as much fingerprinting information about you as possible (maybe as part of an anti-fraud scheme?), including whether you're running a proxy and possibly which local ports you've got open. The latter attempts are what generates the requests intercepted by NoScript/ABE.
This script of theirs tries to collect as much fingerprinting information about you as possible (maybe as part of an anti-fraud scheme?), including whether you're running a proxy and possibly which local ports you've got open. The latter attempts are what generates the requests intercepted by NoScript/ABE.
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101 Firefox/26.0