Ngrok.io link of my site is injected with pop under ads to scammy sites

[nigel]

I just found something sketchy with ngrok.io link for my wordpress site.

When i visit my wordpress site via ngrok.io, I notice that a sketchy JS file is getting injected from 61.0.245.90 when the site loads.

On Desktop browsers, the JS files get injected but no ads seems to appear, probably because the response is “No Ads available”. ( see the screenshot )

However, on mobile browsers like Android Chrome or iOS Safari, pop under ads are getting injected and when I tap somewhere on my wordpress site, it is loading them on a new tab.

The ads are like typical scammy ads targeted to mobile users, like the typical “Congratulations, you won iPhone” etc.

From Google Search I find that the 61.0.245.90 is the IP Address of my ISP.

The HTTPS version of ngrok does not load the stylesheets and other important files due to mixed content error.

There should be a solution to this.

Please see the screenshots:

[philby]

That’s not very reassuring, to be sure.
Are you certain this stuff is only present when you open the site through ngrok?

I just started ngrok for the first time in months (find it too slow and unreliable to really use, TBH), and so far haven’t seen anything of the sort.

It could also be your ISP, see https://www.quora.com/Is-it-legal-for-an-ISP-to-inject-advertisements-into-webpages (googled “nadipdata”).

[nigel]

I found out this issue is not specific to ngrok. It is the ISP. Basically any non-HTTPS webpages is getting injected with those ads from the ISP.

I guess, because of this issue, live site feature in LbF is not useful for me.

Will LbF support HTTPS live site in the future?