Firefox and "transferring data from 127.0.0.1"?

[isthismishugas]

A poster on alt.comp.freeware mentioned this site:

http://redcheek.net/erm/


When I got there I noticed that a message in the bottom left hand screen of
Firefox stated: "transferring data from 127.0.0.1".

The page was slow to load and full of question marks on it, along with a
couple of download links.

Site Advisor gives it a green rating and shows that several media tools on
it appear to be clean.

I closed the window as soon as I saw the message.

Perhaps I haven't noticed it on more popular sites before, but how
dangerous is that message (transferring data from 127.0.0.1) which I know
is the local host (in other words - one's one computer).

 

[David H. Lipman]

From: <[email protected]>

| A poster on alt.comp.freeware mentioned this site:
|
| http://redcheek.net/erm/
|
| When I got there I noticed that a message in the bottom left hand screen of
| Firefox stated: "transferring data from 127.0.0.1".
|
| The page was slow to load and full of question marks on it, along with a
| couple of download links.
|
| Site Advisor gives it a green rating and shows that several media tools on
| it appear to be clean.
|
| I closed the window as soon as I saw the message.
|
| Perhaps I haven't noticed it on more popular sites before, but how
| dangerous is that message (transferring data from 127.0.0.1) which I know
| is the local host (in other words - one's one computer).

The site is in Chinese. The question marks are replacing Chinese chars. as your display is
not showing them so the "?? is being used as a substitute character.

 

[MoiMoi]

From: <[email protected]>

| A poster on alt.comp.freeware mentioned this site:
|
| http://redcheek.net/erm/
|
| When I got there I noticed that a message in the bottom left hand screen of
| Firefox stated: "transferring data from 127.0.0.1".
|
| The page was slow to load and full of question marks on it, along with a
| couple of download links.
|
| Site Advisor gives it a green rating and shows that several media tools on
| it appear to be clean.
|
| I closed the window as soon as I saw the message.
|
| Perhaps I haven't noticed it on more popular sites before, but how
| dangerous is that message (transferring data from 127.0.0.1) which I know
| is the local host (in other words - one's one computer).

The site is in Chinese. The question marks are replacing Chinese chars. as your display is
not showing them so the "?? is being used as a substitute character.

That's not his point.
In status bar, there is quick notation, "transferring data from
127.0.0.1", rather than "transferring from (whatever site)".
I saw it too.
Odd that once page loaded though, a reload doesn't show that.
Maybe if I cleared cache.
I didn't see any kind of script in page source that would do that, so
it's kind of a mystery, I agree.

MM

 

[David H. Lipman]

From: "MoiMoi" <[email protected]>


|
| That's not his point.
| In status bar, there is quick notation, "transferring data from
| 127.0.0.1", rather than "transferring from (whatever site)".
| I saw it too.
| Odd that once page loaded though, a reload doesn't show that.
| Maybe if I cleared cache.
| I didn't see any kind of script in page source that would do that, so
| it's kind of a mystery, I agree.
|
| MM

I didn't see; "transferring data from 127.0.0.1"
in; IE6 SP1, FF 2.0 or Opera 9.10.

 

[Stan Weiss]

From: "MoiMoi" <[email protected]>

|
| That's not his point.
| In status bar, there is quick notation, "transferring data from
| 127.0.0.1", rather than "transferring from (whatever site)".
| I saw it too.
| Odd that once page loaded though, a reload doesn't show that.
| Maybe if I cleared cache.
| I didn't see any kind of script in page source that would do that, so
| it's kind of a mystery, I agree.
|
| MM

I didn't see; "transferring data from 127.0.0.1"
in; IE6 SP1, FF 2.0 or Opera 9.10.

Are you running any kind of Proxy on your machine?

 

[MoiMoi]

From: "MoiMoi" <[email protected]>


|
| That's not his point.
| In status bar, there is quick notation, "transferring data from
| 127.0.0.1", rather than "transferring from (whatever site)".
| I saw it too.
| Odd that once page loaded though, a reload doesn't show that.
| Maybe if I cleared cache.
| I didn't see any kind of script in page source that would do that, so
| it's kind of a mystery, I agree.
|
| MM

I didn't see; "transferring data from 127.0.0.1"
in; IE6 SP1, FF 2.0 or Opera 9.10.

It was brief (Firefox 2 here).
If I hadn't been looking for it wouldn't have seen it.

MM

 

[MoiMoi]

Are you running any kind of Proxy on your machine?

I just cleared cache, but didn't see it again.
No proxy here.
Weird.

MM

 

[Plan9]

Where I live it was 1/12/2007 10:13 PM, when

A poster on alt.comp.freeware mentioned this site:

http://redcheek.net/erm/


When I got there I noticed that a message in the bottom left hand screen of
Firefox stated: "transferring data from 127.0.0.1".

The html source contains:
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
Could the data transfer merely be Foxfire getting gb2312 from localhost?

 

[David H. Lipman]

From: "Stan Weiss" <[email protected]>


| Are you running any kind of Proxy on your machine?

No.

 

[Virus Guy]

A poster on alt.comp.freeware mentioned this site:

http://redcheek.net/erm/

When I got there I noticed that a message in the bottom left hand
screen of Firefox stated: "transferring data from 127.0.0.1".

That page contains the following link:

http://211.100.17.98/cgi-sys/Counter?df=redcheek.net.dat&ft=4

The IP address 211.100.17.98 seems to have a questionable past.
Perhaps you are running some software (like Spybot SD?) that has
blocked that particular IP and replaced it with the local host. Are
you running a customized HOSTS file?