Friday, February 29, 2008

Scottsonline (199 = 205 = 200; 204 = 208)

There are many details to be extracted from logs for miscellaneous websites that help illustrate the impermanent nature of Roger's IPs in the years 2003 and 2004. Below are some Rogers IPs extracted from a log for Especially, to be noted are the coloured entries.
IP pages hits bandwidth last visit date 2 7 124154 2004 09-02 08:29:00 1 1 1686 2004 09-08 13:12:10 1 1 1686 2004 09-08 13:26:30 4 18 112762 2004 09-08 13:27:06 86 4103099 2004 09-08 13:28:08 1 1 25877 2004 09-12 18:20:44 6 41 568401 2004 09-12 18:20:57 14 77 959341 2004 09-22 08:09:40 6 9 25130 2004 09-24 20:20:29 284 7429937 2004 09-28 14:01:20
Beginning with the blue entries, it is theoretically possible that four Rogers customers showed up within a few minutes of one another at 13:12:10, 13:26:30, 13:27:06, and 13:28:08 of Sept. 08, 2004. But especially with the last three log entries, it is easier to believe that this is one person, and that it is yet another example of the fluidity of the Rogers IPs, and within a minute-and-a-half, the Scottsonline customer had cycled through, -200, and 197.

The same point can be made about the two red entries, from four days later. The two red log entries are only 15 seconds apart, and x.x.x.204 "hits" only a single page once before disappearing and giving way to x.x.x.208.  This is easiest to explain if this is one user whose IP has changed suddenly, as these IPs can be seen to do elsewhere.  

Whether the other IPs reflect the same users, and whether the 'blue-user' and 'red-user' is the same person, is less clear.  But given that these IPs often seem elsewhere to shift into one another, it seems highly likely not only that the red IPs and blue IPs all belong to the same user, but so, too, do the other IPs that we find here: x.x.x.69, x.x.x.76, and x.x.x.80.

Tuesday, February 26, 2008

video gaming (or, 208 = 80 = etc.)

We have seen that in 2003 and 2004 (and since), Rogers IPs bounce around quite a bit. Indeed, once one begins to look, it is not hard to find other places where the instability of Rogers' IPs can be seen. Consider the postings of a certain Necros at a message board dedicated to video-game graphics in the years 2003-2004. Each post includes not only Necros' name and message, but his IP-address, too, which allows us to detect some more IP-bouncing. 

Necros' first couple dozen posts on the board are from an AOL account. Beginning in September, 2003, however, he begins to post from a series of Rogers IPs:
no. 348 2003/10/02 (Rogers)
no. 374, 3802003/10/19-2063.139.3.74 (Rogers)*
no. 443 2003/11/30 (Rogers)
no. 460, 471 2003/12/27, 2004/01/03 (Rogers)*
no. 499, 500, 5322004/01/11, 1766.185.84.208 (Rogers)
no. 553, 560, etc. 2004/01/28 - 02/24 (Rogers)*
no. 724, 729 2004/03/16, 17 (Rogers)
no. 749, 756, etc., etc.2004/03/24-05/27 (Rogers)
no. 1117, 1126, etc. 2004/06/02, 06, 19, 07/15 (Rogers)
no. 1214, 1225, 1238 2004/08/08, 11, 13 (Rogers)
no. 1256 2004/08/17 (Rogers)
no. 1265, 1274, 1292 2004/08/21, 23, 25 (Rogers)
no. 13552004/07/07 (Rogers)
no. 1398 2004/09/21 (U. of Toronto)
no. 1402, 1407, etc. 2004/09/22-10/26 (Rogers)
no. 1497 2004/10/21 (U. of Toronto)
no. 1502 2004/10/26 (U. of Toronto)
no. 1508, 1512, etc. 2004/10/30 - 11/01 (Rogers)
no. 1551 2004/11/06 (Rogers)
no. 1556 2004/11/11 (U. of Toronto)
no. 1585 2004/11/25 (U. of Toronto)
no. 1600 2004/12/12 (Rogers)
no. 1616, 1620, 1624 2004/12/28-29 (Rogers)
The IPs, with the exception of those from the U. of Toronto seem to be all Rogers (with the possible exception discussed below), and again we see the propensity of the IPs to shift. Very common are and

Beginning in 2005, we can add a few more IPs.  A few more posts are here
    no. 99, 100 2005/01/1966.185.84.76 (Rogers)

    *According to ARIN: now falls within a block that belongs to PaeTec Communications. In 2004, however, the similar IPs seem to have belonged to Rogers: see this log (search for the IP), and this one under Tue Nov 25 22:58:23 2003 , and this one under 2004/03/07 .

Sunday, February 24, 2008

What's in a name: or, 200 = 196 = 197 = 198 = 199 = 205 = 206

We have been seeing that wikipedia histories show that Rogers' subscribers' IP addresses are not completely fixed: one can begin with one IP, shift to another, and then back within a very short space. Klatt testified that when visited the freedomsite, the logs show shifts to and back, and it is clear that this happened a good deal.

A good example of how much shifting could happen comes from the wikipedia article List of Biblical names. As its name implies, it is merely a long alphabetical list of characters who appeal in the bible.

Consider this section of its edit-history from February 2005. (Wikipedia logs are read from the bottom up.)
  • 18:01, 14 February 2005 PFHLai (Talk | contribs) (remove {{Vprotectedsmall}})
  • 03:42, 14 February 2005 PFHLai (Talk | contribs) (+ {{Vprotectedsmall}})
  • 03:41, 14 February 2005 PFHLai (Talk | contribs) m (Reverted edits by to last version by PFHLai)
  • 03:37, 14 February 2005 (Talk) (→K)
  • 03:36, 14 February 2005 PFHLai (Talk | contribs) (restore a previous version after vandalism by an Anon. with multiple IPs)
  • 03:33, 14 February 2005 (Talk) (→J)
  • 03:26, 14 February 2005 (Talk) (→I)
  • 03:24, 14 February 2005 (Talk) (→H)
  • 03:21, 14 February 2005 (Talk) (→G)
  • 03:18, 14 February 2005 (Talk) (→E)
  • 03:13, 14 February 2005 (Talk) (→D)
  • 03:09, 14 February 2005 (Talk) (→C)
  • 03:06, 14 February 2005 (Talk) (→B)
  • 03:03, 14 February 2005 Rje (Talk | contribs) m (rv to last edit by Ihcoyc, semi-blanking)
  • 03:01, 14 February 2005 (Talk) (→A)
Here you can see that an editor began with, the IP mentioned by Klatt in his testimony, and in the course of 36-minutes, his IP was shifted at least 9 times. (I say 'at least', because there is no way of knowing that there weren't shifts between these postings.)

(It is clear that the user is the same -- he is engaging in what in wikipedia is called blanking-vandalism.)

Saturday, February 23, 2008

Thomas the Tank Engine III: or how 208 = 202 = 200 = 80 = 78 = 81

We have been exploring the edits made to Wikipedia by a series of Rogers IPs in 2003 and 2004. The editor shows consistent interest in a group of articles, many of which relate to the children's program Thomas the Tank Engine.

One such article was its American spin-off Shining Time Station.  Here is the edit history of its first six weeks (the logs read from the bottom):
    14:42, 31 December 2003
    20:22, 30 December 2003
    20:21, 30 December 2003
    20:19, 30 December 2003
    23:27, 12 November 2003 Dysprosia m (fmt)
    23:27, 12 November 2003 Minesweeper (fmt)
    23:00, 12 November 2003
    20:59, 12 November 2003
    20:58, 12 November 2003
    20:44, 12 November 2003
    20:41, 12 November 2003
    00:15, 12 November 2003
    20:30, 10 November 2003
    20:14, 10 November 2003 (Talk)
As you can see, the article was first created on Nov. 10, 2003 by an anonymous editor using the Rogers IP Only minutes later, edited it, and continued over the next few days. Over the coming months, it is slowly built-up by Rogers IPs such as in this edit of March 2004.  And those of,, and here:
    22:56, 20 November 2004
    00:10, 10 November 2004
    21:33, 23 October 2004
The five or six Rogers IPs related to this article do not, presumably, show that there was a hot-bed of interest for Shining Time Station in one neighbourhood in Southern Ontario.  Rather, this is again an illustration of how fluid the IPs were in those years: one editor with an interest in Thomas the Tank Engine was assigned different IP addresses at different times.

Thomas the Tank Engine II: or how 208 = 80

At the following link you can see the edit history of the wikipedia article for Salty the Diesel Engine, a minor character in the Thomas the Tank Engine series.

Salty's article was created as a 'stub' on 15 Oct. 2004 by; an attempt was made to redirect it to the main Thomas the Tank Engine page, a couple hours later. Within a day, the original editor returned and undid the redirect.

It is hard to avoid the conclusion that an editor who uses might sometimes use

Friday, February 22, 2008

Rammstein: or, 204 = 207

We've been looking at the fluidity of Roger's IPs in the years 2003 and 2004. Another example of this comes from late 2004, when a wikipedia used to edit the rock group Rammstein and the song of the same name. A week later, the same editor (one assumes) returned to edit the rock group's article, and then two months later, when they had

Rick Mercer's Monday Report I: or, how 204 = 206

I pointed out here that on Sept. 5, 2003, a Rogers customer using 66.x.x.204 seems to have been temporarily rerouted through 66.x.x.200 (and perhaps back-and-forth several times). And here that on Jan. 2, 2004, one was rerouted through x.x.x.208.

On Jan. 1, 2004, someone used 66.x.x.204 to edit Rick Mercer's Monday Report. A snippit of the log for these days can be seen here, where you can see that x.x.x.208 was used Jan. 1, x.x.x.204 on Jan. 3, and yet another IP,, on Jan. 5.

Thomas the Tank Engine I: or how 204 = 208

We have already seen here that on Sept. 5, 2003, a Rogers communications customer was routed through both and during a short visit. Below I will point out that sometimes the x.x.x.204 user is routed through x.x.x.208.

One of the largest data set for IPs is wikipedia, since it allows its editors to choose whether or not sign in when they edit. By examining an article's history, you can see the names of editors who signed-in and the IPs of those who didn't.

Take the article Gullane Entertainment Ltd. (which redirects to Gullane Entertainment, a television production company that produces children's programming, best known for the series Thomas the Tank Engine

Now, if you click on the "history" tab above the article, you can see its editing history, where you'll see that on Jan. 2, 2004, made a small edit to the article, replacing an internal link with an external. Only a few days earlier, however, the article was created by and had provided all of the information in it, and within a few months edited the article again.

Now, it is fairly clear that these two IPs are the same editor, and what this illustrates is something that several commentators in other blogs have noted. No one seems to hold these IPs long.

Klatt's testimony, or sometimes 204 = 200

Here are pages 1636-8 of Richard Warman and the Canadian Human Rights Tribunal v. Marc Lemire (T1073/5405 vol. 9) of Feb. 8, 2007. In it, Bernard Klatt is testifying about the logs of Lemire's site.

The point to note is that during his visit to the site on Sept. 5, 2003, the user "90sareover" showed up in Lemire's logs both as and as, although only visiting the site briefly. Klatt is unable to explain this, but it is a phenomenon that is worth keeping in mind, since if 90sAREover had hit return in one of the moments when his traffic was being channeled through, we'd not be having this discussion.

p. 1636:

p. 1637:

p. 1638:

Saturday, February 16, 2008