I've seen this before but rough guess:
When a SharePoint site has a reference to a resource held inside another site (not necessarily SharePoint).
e.g.
http://mysharepoint/
contains perhaps an image with the url http://someothersite/images/someimage.gif.
Not necessarily an image, it would be any resource.
Best way to check could be to view source and check to see if there are any urls pointing to outside the site.
Also check for urls starting with https: .
Hope this helps.
Another thought:
Since you're accessing the site through the IP address, maybe its treating your IP address site (http://192.168.1.1) seperately to the actual host headed sharepoint site (http://actualsharepointsite). Therefore the first authentication prompt is for the IP address host headed site and the second is for the actual host header of the sharepoint site.
To eliminate this, I would try (if you have access to these areas):
a) Logon to the actual box, and browse the site on the actual server using its proper host header (might need host file entry and proxy bypass setup depending on your environment). See how many times you're prompted for login details.
or b) In Central Admin, try to setup Alternate Access Mapping from the IP Address url to the actual host headed url.
Sorry if this doesn't help..
