Sunday, April 06, 2008

Proxy servers 6: two more underlying IPs

The IP 66.185.84.204 visited many websites in 2003, as evidenced by the many logs in which it can be found (e.g., here for October of that year).  We have already seen (here and here) that this IP was used as a web proxy by Rogers in 2003 -- indeed it is even possible to identify some of the individual IPs that it forwarded traffic for (here).

An interesting visitors log from October 2003 can be seen here.  In it are three interesting entries:
    Thu Oct 9 19:50:52 2003|cpe00c0f0219072-cm.cpe.net.cable.rogers.com|24.157.169.36| http://www.cs.ualberta.ca/~mburo/courses/605.RTS/|834:24.157.169.36$|Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
    Tue Oct 14 15:06:57 2003|wc09.mtnk.rnc.net.cable.rogers.com|66.185.84.204| http://www.cs.ualberta.ca/~mburo/quotes.html|4202:63.139.207.87$|Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.0.3705; .NET CLR 1.1.4322)
    Sat Oct 18 07:37:43 2003|wc09.mtnk.rnc.net.cable.rogers.com|66.185.84.204| http://www.cs.ualberta.ca/~mburo/orts/orts.html|243:24.157.32.153$|Mozilla/4.0 (compatible; MSIE 5.15; Mac_PowerPC)
In each of the entries, there are two IPs.  In the first, the two IPs are identical, as is the case when there is no proxying at issue.  (See here.)  In the second and third, our old friend wc09.mtnk.rnc.net.cable.rogers.com = 66.185.84.204 appears, again, as a proxy, now for 63.139.207.87 and 24.157.32.153, respectively.

(That the IP appears as a proxy in October 2003, a month at the center of controversy about the use of this IP in the autumn of 2003 is especially important.)

No comments: