Mystery record creation

[WylieE]

We have a mystery on our hands. It is an alarming mystery. <I accidentally posted this in the wrong forum. The other message has been deleted. >

Several orders were created under one customer on Tuesday. All have the same date/time, customer and origin IP. The first order contains details, all subsequent orders are blank.

- All orders are on our development server, which is inside our network and not shared to the outside. The orders came from one of our workstations in the office. The time of all orders was at 1:53AM though and no one was here at the time and the machine was, in fact, turned off.

- The first order also includes 5 payment authorizations. All are for $0.00 though the order total is $328.48.

We're at a loss how these orders could suddenly appear simultaneously. We're at a loss as to how we might debug this one. Any ideas folks?

The only thing I can offer up is I ran Windows Update on this workstation earlier in the day. I don't know if it is theoretically possible the update triggered cached information on his machine. Grasping at straws, but we need to know if there is risk of this happening again. Ideas?

[jmestep]

Find out where the ip address is located. How do you know it was one of your workstations? By the ip address? If so, are you the only ones with that IP address or is it something like an AOL or Time warner address?
Night janitor?

[Shopping Cart Admin]

Hello,

My original guess was that the server time or timeoffset was not correct.

Administration > Configure > Store

confirm TimeZone Offset is correct.

[WylieE]

Find out where the ip address is located. How do you know it was one of your workstations? By the ip address? If so, are you the only ones with that IP address or is it something like an AOL or Time warner address?
Night janitor?

It was an IP address on our internal subnet. I've gone back and reviewed the orders again and just realized the blank orders have no customer IP address. They all have the same customer information, which matches the operator of the workstation. If I look at the customer's navigation history, I see no activity remotely near the time the orders were placed. (Time on all workstations is set by the server.)

No night janitors and I've checked with the owners. No one was here and the building alarm was on. (No night shift here.)

Timezone offset is correct, btw. (Pacific Daylight Time)

[Shopping Cart Admin]

Hello,

Time on all workstations is set by the server.

Either the time was off on the server or it's possible your misreading the results or you need to call Ghost Busters! Considering your server is not available from the internet, obviously the requests came from inside your office. I've never heard of such a report in 15 years of doing this, so I don't think it's anything I'd be losing sleep over and it's certainly not an issue with AbleCommerce that is going to 'manifest' itself again .

[AbleMods]

Have you been testing PayPal payment processing?

The only time I've seen phantom orders in AC7 as you've described is when the PayPal payment gateway (on PayPal's side) sends multiple IPN notifications to the AC7 website. AC7 will receive the responses and create new, empty orders instead of associating the inbound information with the correct existing order. When I've seen this, it's been an issue on PayPals side and not AC7.

This can easily happen if your firewall did not allow the inbound PayPal traffic before and now does - PayPal will queue the IPN notifications and retry for a specific period of time.

Any firewall changes that day? any time during the day?

IPN notifications with PayPal can frequently be delayed or non-existent

[WylieE]

Have you been testing PayPal payment processing?

The only time I've seen phantom orders in AC7 as you've described is when the PayPal payment gateway (on PayPal's side) sends multiple IPN notifications to the AC7 website. AC7 will receive the responses and create new, empty orders instead of associating the inbound information with the correct existing order. When I've seen this, it's been an issue on PayPals side and not AC7.

This can easily happen if your firewall did not allow the inbound PayPal traffic before and now does - PayPal will queue the IPN notifications and retry for a specific period of time.

Any firewall changes that day? any time during the day?

IPN notifications with PayPal can frequently be delayed or non-existent

Hi Joe,

No Paypal for us. No firewall changes either. The only strap I can grasp on to is the fact I ran Windows Update on the workstation in question that day. My only theory is a cookie/session or something got released..??? I have no idea how something like that could happen though.

Mike - Checked the time/timezone on the server and they're properly set. Wish it had been that easy. I'd rather call Nancy Drew and the Hardy Boys than Ghostbusters....... For now I'll delete the orders and keep this in the back of my mind.

[AbleMods]

Stranger things have happened.

I watched the Colts win yesterday...talk about bizarre things that can happen that defy explanation.