cancel
Showing results for 
Search instead for 
Did you mean: 

My Own IP and Loopback Listed as Connected Domains when accessing a Website

mag
Grafter
Posts: 52
Thanks: 9
Registered: ‎04-04-2015

My Own IP and Loopback Listed as Connected Domains when accessing a Website

When I go to this online bank login page
https://www.rbsdigital.com/Login.aspx
uBlock origin indicates the following domains connected

rbsdigital.com
www.rbsdigital.com
127.0.0.1
xx.xx.xx.xx ----my own IP
adobedtm.com
assets.adobedtm.com
rbs.co.uk
www.rbs.co.uk

I'm not sure what it means, but I have never seen the 127.0.0.1 loopback IP and my own IP listed in the connected domains for any other site I visit - including other bank login pages.

It happens with firefox and chromium.

Can anyone shed any light on what it might mean - what is the page doing  that no other page I've come across does?

Thanks
Dave

5 REPLIES 5
VileReynard
Hero
Posts: 12,616
Thanks: 582
Fixes: 20
Registered: ‎01-09-2007

Re: My Own IP and Loopback Listed as Connected Domains when accessing a Website

Is your "own IP" a WAN address or a LAN address?

127.0.0.1 and LAN addresses are non-routable anyway.

"In The Beginning Was The Word, And The Word Was Aardvark."

mag
Grafter
Posts: 52
Thanks: 9
Registered: ‎04-04-2015

Re: My Own IP and Loopback Listed as Connected Domains when accessing a Website

It's my internet facing IP - the one I see at eg https://www.whatsmyip.org/

It's a plusnet allocated static IP.

I've tried accessing the page on widows, linux, and android machines, and from a neighbours machine at his house (ie different machine and different router and IP). The result is the same - except this time his internet IP is listed along with 127.0.0.1.

It is clearly the intended behaviour of this site, and not specific to me, my machine or my router. But why? I've seen no other site doing it.

mag
Grafter
Posts: 52
Thanks: 9
Registered: ‎04-04-2015

Re: My Own IP and Loopback Listed as Connected Domains when accessing a Website

I think it's probably conducting some sort of security scan  - looking for eg VNC remote access connections or open ports typically used by trojans. I'm not clever enough to read the js to find out though. There is a discussion of similar activity by Halifax (and other banks) here https://www.theregister.co.uk/2018/08/07/halifax_bank_ports_scans/

Suppose they found something. This being a bank, do you think they would either:

(a) warn me, and help me to improve my security setup, or

(b) keep it on file so that if my account is ever defrauded they can deny responsibility, blame me, and say they have evidence that my online login security practices were poor.

VileReynard
Hero
Posts: 12,616
Thanks: 582
Fixes: 20
Registered: ‎01-09-2007

Re: My Own IP and Loopback Listed as Connected Domains when accessing a Website

Would you trust anyone who thinks 127.0.0.1 is a security risk?

However...

https://www.lookip.net/ip/127.0.0.1

Gives some very weird results:-


Location details

We can't pinpoint the location of this IP address because it is a loopback IP address which isn't accessible from the internet.

"In The Beginning Was The Word, And The Word Was Aardvark."

mag
Grafter
Posts: 52
Thanks: 9
Registered: ‎04-04-2015

Re: My Own IP and Loopback Listed as Connected Domains when accessing a Website

Turns out lots of folks do report 127.0.0.1 as malicious

https://www.abuseipdb.com/check/127.0.0.1

'With this in mind, we present the reports on this page for entertainment and testing purposes only. If you mistakenly blacklist an internal IP, you won't have a good day!'