Mysterious IP Address

[Timmer]

Within the last week or so I've noticed the yellow "Scripts Partially Allowed" bar appearing on trusted sites where I've already allowed all scripts, even sites I own myself. It's caused by an IP address and always the same one.

I've investigated but I can't figure it out. The IP Address apparently belongs to Comcast, who is also my ISP.

NetRange: 69.240.0.0 - 69.255.255.255

I suspect that Comcast is doing something sneaky, like piggybacking a bit of code on all of my surfing.

I'm running NoScript on fully updated Firefox on Mac OS X 10.9.3.

Any ideas? Thanks!

[barbaz]

Is this the same IP address as your WAN IP @ NoScript Options -> Advanced -> ABE?

[Timmer]

Is this the same IP address as your WAN IP @ NoScript Options -> Advanced -> ABE?

No, it is not.

[barbaz]

Are you behind a proxy or VPN?
Do you have any local proxy/firewall software or something like that which could be the cause?
Is it possible that your router or modem might be injecting that?

Can you look at the script using either JSView (may need modifications in order to work properly) or Firebug?

Also, can you provide an example URL where this IP shows up, in case someone else sees it too?

[Timmer]

Thanks. I appreciate the help. As far as I know I am the typical Comcast customer. My router is the modem/wifi combo they provide that they call a "gateway." The cable goes from the wall to that device. I use wifi to get to my computer. Nothing special. Just what I guess is a typical configuration.

Where does this happen? Apparently everywhere although on an intermittent basis. It's not occurring on every single page load. An example? Right now on this very site.

There is no proxy or VPN that I'm aware of. I have some standard software firewall stuff (OS X and Little Snitch). I run Sophos anti-virus.

As far as I know, there have been no configuration changes to anything by me (within months) that could explain this new behavior. I do know that Comcast recently (a few weeks ago) rolled out "xfinitywifi" hot spots. They have the ability to push changes down to their gateway equipment. But I don't know if this has anything to do with it.

I can't find any evidence of code or a script in the web pages I visit. I even tried viewing the source code. I'm not sure that what triggers the NoScript response is actually in there.

[Timmer]

This is an attempt to show you how it looks:

[barbaz]

Where does this happen? Apparently everywhere although on an intermittent basis. It's not occurring on every single page load. An example? Right now on this very site.

Is the "intermittent" depending at all on whether you're connecting over HTTP (like you are on this site) or HTTPS?

I run Sophos anti-virus.

Have you scanned your system for malware?
(Side note: Sophos actually makes your Mac *more* vulnerable to malware. I suggest getting rid of it and using something else. The only free Mac antivirus program I know of is ClamXav.)

I can't find any evidence of code or a script in the web pages I visit. I even tried viewing the source code. I'm not sure that what triggers the NoScript response is actually in there.

Right, because it won't necessarily be in the page source. Which is why if you want to ferret this out you will need one of the addons I suggested.

If the script doesn't contain any sensitive / identifying information, could you please post it here (wrapped in code tags)?

[Timmer]

Thanks. I'll get on your recommendations, see what I can find out, and report back.