4

Sometimes I look at the login history of my blog account (a Tumblr blog) to make sure no one else is logging in (because I have private posts that I want to keep private).

Even though today I accessed my blog from the same computer as always, today my history showed that I was logging in from a different IP address than normal.

I live in Michigan, and normally when I look up login history, my IP address is listed as my same old IP address in Michigan.

However, today when I logged in at 8 am, my login history showed an IP located in California. Even though I'm in Michigan, it showed that my 8 am login was occurring from a city in CA.

I thought this was weird, so I logged out and logged in again. The second and third time I logged in, my IP was the same old Michigan IP that it normally is.

I searched for the California IP address and it turns out that the "IP usage type" is listed as belonging to yahoo and is a "search engine spider." (Here's the site I used to look up the IP: www.iplocationtools.com.)

What's going on here? Do I need to worry my computer has been hacked or something? Or is this more likely a Tumblr glitch?

  • or your ISP swapped your IP – schroeder Aug 28 '15 at 23:03
  • I would do some due diligence on the ownership of the IP addresses before assuming that your IP changed. – David Houde Aug 29 '15 at 2:58
  • can you obtain further information about the access? like the user agent? – Nicola Miotto Aug 30 '15 at 7:35
  • How do I obtain the user agent? – michigan-question Sep 2 '15 at 3:02
2

Change your password. Regardless if this is a genuine compromise or not password hygiene is vital, especially when anything that is suspicious is flagged up.

You should also set up two factor authentication.

There are number of innocent reasons why this could happen though, I've listed a few below, which are in no way meant to be an authoritative final answer, just possibilities.

I agree with David, this is probably due to the ISP, it may be a BGP issue or it may be down your source address appearing as one of intermediary device on the path to tumblr.

Additionally, tumblr may parse the login session into its own logging system, if this triggers any kind of rule it may generate a new log for investigation and log the IP as that of its own logging system, this is something that I see in my own work all the time.

As for the yahoo spider, that really is a tricky one. This may be down to the way tumblr caches userids and botids it is possible that the crawler address has been appended to your session cache in tumblr's system erroneously, the cache has cleared and everything has went back to how it should, bar the suspicious log.

There is also a possibility that that rogue application has either been given or taken access to your account and is at play here and is allowing the yahoo crawler access to your account (or is spoofing its IP as not to look overly suspicious).

Have a look at the tumblr Account Security page

1

As schroeder states it's much more likely that something between you and your ISP caused your public facing IP address to change. The vast majority of consumer internet dynamically allocates you an IP address, so simply restarting your modem will probably result in it changing.

  • 1
    I don't mean offense, but this isn't a real answer. IP addresses, be it static or dynamic, do not generally change and then quickly change back. It is a possibility that his ISP erroneously assigned him an IP that doesn't belong to them while at the same time erroneously announced a yahoo BGP route. While possible, I think the safer assumption would be that either A: His account is compromised, or B: Tumbler logging mechanism erroneously entered a crawler into his login history. – David Houde Aug 29 '15 at 2:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.