InformAction Forums

Recently when i visit a couple of websites noscript is showing my own ip address as one of the blocked scripts for the website. This has never happened before and it's only happening on a couple of sites. Why is my ip address showing up as a script? I've run virus scans and malwarebytes and they come up with nothing wrong. Thanks in advance for any information.

Which sites?

Also, does it happen on a clean profile with just NoScript installed?
Are you running any local proxy (e.g. installed by an anti-virus)?

It happens on capitalone.com. and on another page on the same site. When I go to the site and temporarily allow the capitalone script on noscript - my ip address as well as the generic 127.0.0.1 then show on noscript as blocked scripts. WOT (web of trust) users report that the generic 127.0.0.1 is the loopback address or localhost for whatever computer you are using. This is the only site I have visited where noscript is showing these as blocked scripts. And I've had noscript for a long time.
I created a new profile and installed only noscript and visited capitalone and they still showed up on noscript as blocked scripts.
I don't think I'm running a local proxy. I've changed nothing recently and have been using the same antivirus (TrendMicro Titanium) for some time. I don't think TrendMicro has installed anything new (like a local proxy) on my computer. As far as I know they only provide regular definition updates to the antivirus protection.
I asked the same question on another forum and someone suggested it might be a DNS rebinding attack causing this. But I read that noscript has protection againt this with noscript ABE.
I use firefox 25 browser and have TrendMicro antivirus, malwarebytes, superantispyware, noscript, adblock, and WOT (web of trust) all installed and have had them all for a long time. And as I said earlier full scans of antivirus, malwarebytes, and superantispyware have found nothing - other than usual tracking cookies that superantispyware always finds and which have been deleted.
Thanks again for any information.

peaches77 wrote:It happens on capitalone.com. and on another page on the same site. When I go to the site and temporarily allow the capitalone script on noscript - my ip address as well as the generic 127.0.0.1 then show on noscript as blocked scripts.

It's very likely then that a locally installed software (and most likely a proxy) is injecting stuff inside your pages on the fly.
Could you please use the "View source" command on that page and PM/email me its content?

I am seeing this as well now, on the capital one website

I am seeing this as well now, on the capital one website

It's something (probably nasty) on their end. ABE's built-in rule and my ABP filters blocking loopback addresses were triggered but I can't post the request addresses or ABE message due to spam filter...

I gave them a call, they have no idea why the site is doing this, it only showed up on the loan page for me, I suggest someone who is better able to explain what we are seeing, give them a call and explain to the techs what's going on

for what it is worth, here is a screenshot of what i get when i go to "capitalone.com" :

http://imageshack.us/a/img35/2783/8xmo.jpg

here is the "page source"-data that i got:

https://app.box.com/s/mnq1r00l9ahau3w5zw0t

URL: https://www.capitalone.com/
Allow, capitalone.com.


To note: 127.0.0.1 doesn't show up initially, but does populate after a moment or two.

And not only is it 127.0.0.1, but also your WAN IP shows up?
So I see Red's IP with Time Warner (from his screenshot) & my own with Comcast.

nvm

That Cap1 knows your IP is not an issue.
Every site you visit knows (or can know if they wish) your IP.

The question is why it is being exposed by NoScript (which if I had to guess has something to do with ABE)?

> has something to do with ABE

Still happens with ABE disabled.

OK, I finally decided to enable scripts on that page and found the culprit.
This script of theirs tries to collect as much fingerprinting information about you as possible (maybe as part of an anti-fraud scheme?), including whether you're running a proxy and possibly which local ports you've got open. The latter attempts are what generates the requests intercepted by NoScript/ABE.