17

This question already has an answer here:

I'm asking this question on behalf of my second account: KennyBOT

KennyBOT uses a Stack Exchange account and therefore logs in with the Stack Exchange Open ID provider which enables users to see their login and authentication history on this page.

The page contains the following entries in the history table:

Authenticated To    Authenticated to stackexchange.com          80.*.*.*    1 min ago
Login               Logged In                                   80.*.*.*    1 min ago
Authenticated To    Authenticated to data.stackexchange.com     80.*.*.*    2 days ago
Login               Logged In                                   80.*.*.*    2 days ago
Login               Logged In                                   10.7.2.15   Mar 19 at 11:27
Authenticated To    Authenticated to data.stackexchange.com     80.*.*.*    Mar 15 at 22:25
Login               Logged In                                   80.*.*.*    Mar 15 at 22:25
Authenticated To    Authenticated to stackoverflow.com          80.*.*.*    Mar 15 at 22:25
Login               Logged In                                   80.*.*.*    Mar 15 at 22:25
Authenticated To    Authenticated to data.stackexchange.com     80.*.*.*    Mar 15 at 21:58
Login               Logged In                                   80.*.*.*    Mar 15 at 21:58
Authenticated To    Authenticated to stackoverflow.com          80.*.*.*    Mar 15 at 21:57
Login               Logged In                                   80.*.*.*    Mar 15 at 21:57

The 80.* IP addresses are clear to me because that is my own IP address. But why and how did it manage to login from 10.7.2.15 which is an internal-ip address within the SE-network server farm?

I contacted the team over the weekend to rule out that the account was somehow compromised and in the response (ticket:Other - 201503211033317703) I learned that the account was not used on the sites from the 10.* address, only from my own 80.* address. They also directed me to check How does SO's new auto-login feature work? and if questions remained to ask them here, so here we are:

Who or what logged in with the account KennyBot from 10.7.2.15 and why did it do so?

I use that account from a separate browser to prevent any mishaps with my normal account or from a .Net WebClient programmatically. On that particular day I didn't have any test-session going and I don't recall having used the other browser to login.

marked as duplicate by rene support Jan 18 at 18:49

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 2
    This kind of mistake with the logged IPs has happened in the past, I remember one instance where it was caused by SE trying out Cloudflare. My guess is that this is a bug somewhere in SE code that accidentally inserted an internal IP instead of your real one. – Mad Scientist Mar 23 '15 at 21:12
  • That sounds plausible. One other option I considered was an auto-logon from a still existing session but that would require the browser session to be still alive which I doubt was true. – rene Mar 23 '15 at 21:15
  • Wow, what a story :) Has this happened since? – nicael Jun 19 '15 at 20:28
  • @nicael yes, but I didn't spend enough time on it to get a decent repro. – rene Jun 19 '15 at 20:32
  • Same IP was logged when I logged in from stackoverflow.com/users/login. So I agree with Mad. – unarist Sep 5 '16 at 7:41
  • 1
    Wow, what a story :) Has this happened since? – Shadow The Dragon Wizard Jan 16 '17 at 11:10
  • Yes, I agree with the comment above. It sounds like a VM issue. – user6035379 Jan 16 '17 at 13:22