Donation replicating multiple times in C&P, Salesforce and Donor bank account

[Clareodo]

Org ID: 30253
A single donation of $300 (ID 30253-1702171326003630363) made on 2/17 replicated in C&P and SF again on 2/17, then replicated 5 times on 2/18 and again 3 times yesterday, 2/21. It resulted in our client's bank account being overdrawn. We've refunded one 2/17 transaction, all 2/18 ones and voided yesterday's 2 transactions. Yesterday, support at C&P blocked his email and IP addresses to stop transactions, but were unable to resolve or investigate what caused the problem. They referred us to the Forum. We would like to troubleshoot this with you to prevent recurrence.

[CnP.Support]

Good day Clareodo

We are a bit confused. This is what we see:



The first transaction came from IP address: 192.136.22.4 (http://www.senderbase.org/lookup/?se...g=192.136.22.4) appears to be an IP at Berklee.edu. at 1:09 p.m. on 2/17 - in Massachusetts.

The second transaction came from the same IP address at 1:26 p.m. - almost 15 minutes later through the same IP address.

Next time the transaction occurred on 2/18 at 4:45 p.m., then 4:48 p.m., 4:50 p.m., 4:55 p.m. and 4:58 p.m. from IP address: 209.6.193.217 (http://www.senderbase.org/lookup/?se...=209.6.193.217) in Massachusetts.

Your organization is also located in Cambridge, Massachusetts - so all adds up.

The last 2 transactions were also done on 2/21 from the SAME IP as the original transaction, namely 192.136.22.4 - so it is the same IP as the original post.

There is no regularity to this posts as they are happening intentionally. They are all done through the same process. - the last 2 show to be about 22 minutes apart on 2/21.

The posted transactions are all coming from GravityForm.

We are also confused. Do you have any idea why these IP's are involved?

[CnP.Support]

Good day again!

We have done more digging and all transactions appear to be coming from the same persona. The IP address 192.136.22.4 appears to be an iPad tablet.

IP: 209.6.193.217



IP: 192.136.22.4



All the transactions appear to be legitimate.

I understand that they do not make sense but they are all intentionally processed. Strange indeed.