Hi Dojo,
When I look at all the open connections via the SLNet Client Test tool, I noticed that there is a connection with the name 'HTML5 App (Administrator...' which I would not expect. If I recall correctly, this naming of a connection implies that a user is connected using one of the web apps (e.g. dashboards). At the moment, there is no one connected. I also wouldn't expect to see 'Administrator' here. Is this some kind of core connection? I notice that it is constantly polling the DMA status. (which causes my SLNet log to be spammed a bit)
Not sure but maybe it's a scheduled BPA test? I saw BPAs making connections as 'administrator', and those can be scheduled. Just a guess...