Bitdefender Events showing login event after I was at a location.

Thebrewster

I've just gone through my Login Events and I can see 3 logins (1 failed, 2 successful) at an IP address of somewhere I was at, or near enough. The issue is, they start after I left that location. The first one that was successful was 5 hours after. The second, failed attempt 16 hours later, the third, successful, seconds later. None of them used Two-Factor Authentication.

If it means anything, they happen only a day after I installed BitDefender Mobile for the first time.

Is this a common thing synchronising issue?

Alexandru_BD

Hi,

For starters, IP location doesn't equal physical presence. IP addresses are assigned by ISPs dynamically and often reused for hours or days. Sometimes, they are geolocated to the last known gateway, not your device. So if you were at or near that location earlier, it’s very common for your IP to remain the same for several hours after you leave, or for your traffic to still route through the same regional gateway. I think a 5 to 16h delay is well within normal ISP behavior, somewhere around that timeframe. Mobile security apps do trigger background auth checks, and when you install Bitdefender Mobile Security, several things happen. There's account validation, cloud reputation sync, token refreshes, and background session checks. These do not always trigger 2FA, because they often reuse an existing trusted session token, and they're classified as known device and known session logins. This in my opinion would explain the successful logins without 2FA, or a failed attempt followed immediately by a successful one (token refresh retry). That timing pattern is classic backend re-authentication, not a human attacker, so I wouldn't worry about that.

Attackers don’t usually retry within seconds from the same IP, and they would trigger 2FA challenges or lockouts.
Systems, however, retry after a transient auth failure, refresh expired tokens, and fall back to secondary auth endpoints. This exact pattern is extremely common in legitimate sync processes. Correlation with Bitdefender install matters, and it strongly points to account/service synchronization, not compromise. 🙂

Regards