17

I'm asking this question on behalf of my second account: KennyBOT

KennyBOT uses a Stack Exchange account and therefore logs in with the Stack Exchange Open ID provider which enables users to see their login and authentication history on this page.

The page contains the following entries in the history table:

Authenticated To    Authenticated to stackexchange.com          80.*.*.*    1 min ago
Login               Logged In                                   80.*.*.*    1 min ago
Authenticated To    Authenticated to data.stackexchange.com     80.*.*.*    2 days ago
Login               Logged In                                   80.*.*.*    2 days ago
Login               Logged In                                   10.7.2.15   Mar 19 at 11:27
Authenticated To    Authenticated to data.stackexchange.com     80.*.*.*    Mar 15 at 22:25
Login               Logged In                                   80.*.*.*    Mar 15 at 22:25
Authenticated To    Authenticated to stackoverflow.com          80.*.*.*    Mar 15 at 22:25
Login               Logged In                                   80.*.*.*    Mar 15 at 22:25
Authenticated To    Authenticated to data.stackexchange.com     80.*.*.*    Mar 15 at 21:58
Login               Logged In                                   80.*.*.*    Mar 15 at 21:58
Authenticated To    Authenticated to stackoverflow.com          80.*.*.*    Mar 15 at 21:57
Login               Logged In                                   80.*.*.*    Mar 15 at 21:57

The 80.* IP addresses are clear to me because that is my own IP address. But why and how did it manage to login from 10.7.2.15 which is an internal-ip address within the SE-network server farm?

I contacted the team over the weekend to rule out that the account was somehow compromised and in the response (ticket:Other - 201503211033317703) I learned that the account was not used on the sites from the 10.* address, only from my own 80.* address. They also directed me to check How does SO's new auto-login feature work? and if questions remained to ask them here, so here we are:

Who or what logged in with the account KennyBot from 10.7.2.15 and why did it do so?

I use that account from a separate browser to prevent any mishaps with my normal account or from a .Net WebClient programmatically. On that particular day I didn't have any test-session going and I don't recall having used the other browser to login.

Improve this question
7
  • 2
    This kind of mistake with the logged IPs has happened in the past, I remember one instance where it was caused by SE trying out Cloudflare. My guess is that this is a bug somewhere in SE code that accidentally inserted an internal IP instead of your real one.
    – Mad Scientist
    Commented Mar 23, 2015 at 21:12
  • That sounds plausible. One other option I considered was an auto-logon from a still existing session but that would require the browser session to be still alive which I doubt was true.
    – rene Mod
    Commented Mar 23, 2015 at 21:15
  • Wow, what a story :) Has this happened since?
    – nicael
    Commented Jun 19, 2015 at 20:28
  • @nicael yes, but I didn't spend enough time on it to get a decent repro.
    – rene Mod
    Commented Jun 19, 2015 at 20:32
  • Same IP was logged when I logged in from stackoverflow.com/users/login. So I agree with Mad.
    – unarist
    Commented Sep 5, 2016 at 7:41
  • 1
    Wow, what a story :) Has this happened since?
    – Shadow Wizard
    Commented Jan 16, 2017 at 11:10
  • Yes, I agree with the comment above. It sounds like a VM issue.
    – user6035379
    Commented Jan 16, 2017 at 13:22

0

Reset to default

Browse other questions tagged .