Proxy servers 5: an underlying IP

To the right is a screencap of a truehits log from Feb. 2, 2003 (on which, see here and here).  This gives the Proxy's IP, name, and software version (first column), that it is set to forward the IP of the computer that it is proxying for (second column), and the number of hits that it forwarded (third column), which in this case was 82 (see the red arrow).  

The truehit logs also report their top visitors, as you can see to the right.  The fourth largest visitor of the day was from a Rogers netblock, and it also 82 hits (see the red arrow).

It seems obvious and inevitable that these two entries are to be taken together, and that the 82 hits that 66.185.84.204 had forwarded came from a single IP, 24.157.249.116.  

Now, this IP is no longer part of a Rogers block (see here, for example).  But a few years ago it seems to have been based in West Toronto.  For reasons that we don't need to go into, "arfer" posted to a broad-band discussion boarded a long list (over three thousand items!) of the Rogers blocks that he could find (see here).  About half-way down his list is this entry:

Rogers Cable Inc. Hnsn ON-ROG-10-HNSN-7 (NET-24-157-249-0-1) 24.157.249.0 - 24.157.249.255

HNSN, according to this, abbreviates Hanson and is in the western GTA.  (Presumably this is the location of some equipment; perhaps Hanson Road in Mississauga?)

In a nutshell what does this mean?  Not much, except that in February 2003, a computer in Mississauga with the IP 24.157.249.116 visited a site in Thailand; on its way there, however, its traffic was channeled by Rogers through one of its proxy servers, 66.185.84.204.  Both the proxy and the individual IP was logged.

Update.  An out-of-date database of whois-information, here, produces this:

TARGET: 24.157.249.116
NAME: ON-ROG-10-3HNSN-1
NUMBER: 24.157.249.0 - 24.157.249.255
CITY: TORONTO
STATE: ONTARIO
COUNTRY: CA
LAT: 43.70
LONG: -79.42
LAT_LONG_GRAN: City
LAST_UPDATED: 18-Apr-2001
NIC: ARIN
LOOKUP_TYPE: Block Allocation
RATING:
DOMAIN_GUESS: rogers.home.net
STATUS: OK

The block-name is slightly different, but the location is the same.

Who else used 66.185.84.204 in September 2003?

Update.  As you can see here, the reason that there are so many posts from such a variety of individuals through this IP is because it was one of Rogers' proxy servers and therefore forwarded internet traffic for hundreds of thousands of users.

I had created a list of places where we can see 66.185.84.204 (or its host-name equivalent, wc09.mtnk.rnc.net.cable.rogers.com) being used in 2003 here, and have been adding to it as I found new examples. That list has now grown a little unwieldy, so I am replacing it with several shorter lists (indexed at the bottom). Here is a list of attested used in September, 2003, which I divide into two lists. The first list is examples of the IP (or host-name equivalent) appearing in monthly visitor logs, which only allow us to conclude that the visit had taken place sometime during the month. The second list are cases where we know the specific date.

1. during Sept. 2003 this IP visited www.ess.uci.edu;
2. during Sept. 2003 wc09.mtnk.rnc.net.cable.rogers.com (=66.185.84.204) visited a metalloprotein database at the Scripps Research Institute;
3. during Sept. 2003 this IP visited the site of Sébastien Delayahe, a French programmer;
4. during Sept. 2003 this IP visited the site of the Tyendinaga Mohawk First Nation 30 times;
5. during Sept. 2003 wc09.wtnk.etc visited metalsoft.com;
6. during Sept. 2003 wc09.wtnk.etc visited insurgentcountry.com;
7. during Sept. 2003 wc09.wtnk.etc visited webticino.ch;
8. during Sept. 2003 wc09.wtnk.etc visited bards.ca;
9. during Sept. 2003 wc09.wtnk.etc visited visualriddle.com;
10. during Sept. 2003 wc09.wtnk.etc visited the site of a Vietnamese church in Ottawa;
11. during Sept. 2003 wc09.wtnk.etc visited the blog, World in Progress;
12. during Sept. 2003 wc09.wtnk.etc visited a blog;
13. during Sept. 2003 this IP visited the site of Soldatna, Alaska;

With specific date

1. on Sept. 1, 2003, "blah" used this IP to post an inquiry about a Half-life CDKey;
2. on Sept. 3, 2003, wc09.wtnk.etc (=66.185.84.204) visited wireworld.com;
3. on Sept. 4, 2003, "alon" used this IP to post an inquiry about air rifle dealers in Ontario;
4. on Sept. 5, 2003, "fake Chris" used this IP to post to a message board;
5. on Sept. 5, 2oo3, at 19:55, "90sAREover" used this IP when he posted a racist denunciation of Senator Cools;
6. on Sept. 6, 2003, wc09.wnk.etc visited StarWarsCampers.com;
7. on Sept. 8, 2003, "fake jeff" responded to "fake Chris" (see above);
8. on Sept. 8, 2003, "GP" used this IP when he posted a notice to sell a 55 gallon drum of racing fuel in Toronto;
9. on Sept. 8, 2003, "Gump" used this IP to post to a message board;
10. on Sept. 8 and 9, 2003, "Scott Taylor" used this IP to post twice to a message board for the International Plastic Modelers' Society in London, Ont.
11. on Sept. 10, 2003, "quyen" used this IP to post to a Vietnamese (?) message board in Vietnamese (?);
12. on Sept. 11, 2003, "christian" used this IP to try to sell goalie equipment;
13. on Sept. 16, 2003, "thAmaraipu" used wc09.wtnk.etc (=66.185.84.204) to post to a Tamil board;
14. on Sept. 18, 2003, "quyen" used this IP to post to a Vietnamese (?) board in Vietnamese (?);
15. on Sept. 20, 2003, wc09.wtnk.etc visited a UK site dedicated to UFOs using MSIE 5.5, Windows 98, Win 98 4.90;
16. on Sept. 20, 2003, "Steven Milstone-Turner" posted twice to a discussion board;
17. on Sept. 20-21, 2003, "quyen" again posted to a Vietnamese (?) discussion board in Vietnamese (?) (see above under Sept. 10);
18. on Sept. 23, 2003, "cdnenya" used this IP when she posted at Groomers BBS (she posted again on the same day with the same IP);
19. on Sept. 23, 2003, wc09.wtnk.etc visited StarwarsCampers.com;
20. on Sept. 23, 2003, "Anonymous" used this IP to post to a message board on 3D Racing Mania;
21. on Sept. 24, 2003, this IP visited "Mom's talk" at ChildrenToday.com;
22. on Sept. 25, 2003, this IP visited the homepage of a computer science prof. at the U. of Alberta;
23. on Sept. 25, 2003, "webmaster" used this IP to post to a soccer discussion board;
24. on Sept. 28, 2003, "cdnenya" used this IP to post again at Groomers BBS;
25. on Sept. 28, 2003, "andi" used this IP to post twice to an NHL rumour board;
26. on Sept. 28, 2003, "Scott Taylor" used this IP to post to a modellers discussion board;
27. on Sept. 28, 2003, this IP visited scottsonline;
28. on Sept. 30, 2003, wc09.wtnk.etc (=66.185.84.204) visited wireworld.com.

Other lists can be see here:
• Jan.-Jul., 2003.
  
• Aug. 2003.
  
• Sept. 2003.
  
• Oct. 2003.
  
• Nov. 2003.
  
• Dec. 2003.
• Jan. 2004, and following.

Who else used 66.185.84.204 in October 2003?

Update. As you can see here, the reason that there are so many posts from such a variety of individuals through this IP is because it was one of Rogers' proxy servers and therefore forwarded internet traffic for hundreds of thousands of users.

I had created a list of places where we can see 66.185.84.204 (or its host-name equivalent, wc09.mtnk.rnc.net.cable.rogers.com) being used in 2003 here, and have been adding to it as I found new examples. That list has now grown a little unwieldy, so I am replacing it with several shorter lists (indexed at the bottom). Here is a list of attested users in October, 2003, which I divide into two lists. The first list is examples of the IP (or host-name equivalent) appearing in monthly visitor logs, which only allow us to conclude that the visit had taken place sometime during the month. The second list are cases where we know the specific date.

1. between Sept. 24 and Oct. 23, 2003 this IP consulted manotick.net (a local business directory serving South Ottawa) 132 times;
   
2. during Oct. 2003, this IP visited the site of a Florida chapter of the Society for Creative Anachronism;
   
3. during Oct. 2003, wc09.etc (=66.185.84.204) visited pogopus.com;
   
4. during Oct. 2003 this IP visited www.ess.uci.edu;
   
5. during Oct. 2003 wc09.etc visited insurgentcountry.com;
   
6. during Oct. 2003 wco9.etc visited webticino.ch;
   
7. during Oct. 2003 wc09.etc visited a Danish site;
   
8. during Oct. 2003 wc09.etc visited the website of a Vietnamese church in Ottawa;
   
9. during Oct. 2003 wc09.etc visited the site of a commercial real estate broker;
   
10. during Oct. 2003 wc09.etc visited idenise.net;
    
11. during Oct. 2003 wc09.etc visited the webpage of a Danish musician;
    
12. during Oct. 2003 wc09.etc visited the site of Anne Owens, an illustrator;
    
13. during Oct. 2003 wc09.etc visited a Slovakian comics site;
    
14. during Oct. 2003 wc09.etc visited concretefloors.ca;
    
15. during Oct. 2003 wc09.etc visited the site of the Wellington (NZ) Indian Association;
    

With specific date:

1. on Oct. 1, 2003, "andi" used this IP to post to an NHL forum;
2. on Oct. 2, 2003, "hullbob" used this IP to post to the Cape Breton Screaming Eagles message board;
3. on Oct. 3, 2003, "Scott Taylor" used this IP to post to board related to the London Plastic Modelling Association;
4. on Oct. 3, 2003, this IP visited the site of Colorado Christian University;
5. on Oct. 4, 2003, "Dean" used this IP to post to a the Cape Breton Screaming Eagles message board (see above);
6. on Oct. 5, 2003, "krivraq" used this IP when he asked a goalies' forum how to keep a mask from rusting;
7. on Oct. 8, 2003, "coco_fever" used this IP to post to an NHL forum;
8. on Oct. 10, 2003, this IP posted to a discussion board on the OHL;
9. on Oct. 10, 2003, "Scott Taylor" used this IP to post to message board on modelling;
10. on Oct. 12, 2003, "Scott Taylor" again used this IP to post on modelling;
11. on Oct. 13, 2003, "doug" used this IP to post a message seeking a Roddy Piper doll;
12. on Oct. 14, 2003, this IP was a proxy for 63.139.207.87 (see discussion here);
13. on Oct. 15, 2003, at 20:46, this IP visited freedomsite.org;
    
14. on Oct. 18, 2003, "doug" again expressed his interest in a Roddy Piper doll (see Oct. 13);
15. on Oct. 18, 2003, this IP was a proxy for 24.157.32.153 (see discussion here);
16. on Oct. 19, 2003, "tahnie" used this IP to post to Groomers BBS;
    
17. on Oct. 20, 2003, "Gary Donaldson" used this IP to wish Paul a happy birthday;
18. on Oct. 22, 2003, wc09.etc visited the website of a Houston medical school;
    
19. on Oct. 24, 2003, someone used this IP to post to a board concerning women's hockey;
20. on Oct. 25, 2003, "Scott Taylor" used this IP to post again on modelling (see above under Oct. 10);
21. on Oct. 26, 2003, "SELLIAH" used this IP to praise a Tamil poet;
    
22. on Oct. 26, 2003, wc09.etc (=66.185.84.204) visited wireworld.com

Other lists can be see here:
• Jan.-Jul., 2003.
  
• Aug. 2003.
  
• Sept. 2003.
  
• Oct. 2003.
  
• Nov. 2003.
  
• Dec. 2003.
• Jan. 2004, and following.

Who else used 66.185.84.204 in November 2003?

Update. As you can see here, the reason that there are so many posts from such a variety of individuals through this IP is because it was one of Rogers' proxy servers and therefore forwarded internet traffic for hundreds of thousands of users.

I had created a list of occasions where we can see 66.185.84.204 (or its host-name equivalent, wc09.mtnk.rnc.net.cable.rogers.com) being used in 2003 here, and have been adding to it as I found new examples. That list has now grown a little unwieldy, so I am replacing it with several shorter lists (indexed at the bottom). Here is a list of attested users in November, 2003, which I divide into two lists. The first list is examples of the IP (or host-name equivalent) appearing in monthly visitor logs, which only allow us to conclude that the visit had taken place sometime during the month. The second list are cases where we know the specific date.

1. during Nov. 2003 this IP visited www.ess.uci.edu;
2. during Nov. 2003 wc09.mtnk.rnc.net.cable.rogers.com (=66.185.84.204) visited insurgentcountry.com
3. during Nov. 2003 wc09.mtnk.etc visited sniggle.net;
4. during Nov. 2003, wc09.mtnk.etc visited the Internet Society of Wallonia;
5. during Nov. 2003, this IP visited www.ess.uci.edu;
6. during Nov. 2003 wc09.etc visited www.professionalcameras.co.uk;
7. during Nov. 2003, wc09.mtnk.etc visited the Metalloprotein Database and Browser at the Scripps Research Institute;
8. during Nov. 2003, wc09.mtnk.etc visited allportgroup.com;
9. during Nov. 2003 wc09.mtnk.etc visited michaelcoren.com;
10. during Nov. 2003 wc09.mtnk.etc visited starling.ws;
11. during Nov. 2003 wc09.mtnk.etc visited webtichino.ch;
12. during Nov. 2003 wc09.mtnk.etc visited the website of a Vietnamese church in Ottawa;
13. during Nov. 2003 wc09.mtnk.etc visited idenise.net;
14. during Nov. 2003 wc09.mtnk.etc visited www.deafrochester.com;
15. during Nov. 2003 wc09.mtnk.etc visited www.fakepope.com;
16. during Nov. 2003 wc09.mtnk.etc visited a fansite dedicated to the band Rasputina;
17. during Nov. 2003 wc09.mtnk.etc visited the site of a Boy Scouts of America council in central Illinois;
18. during Nov. 2003 wc09.mtnk.etc visited the site of Anne Owens, an illustrator;
19. during Nov. 2003 wc09.mtnk.etc visited the allportgroup.com;
20. during Nov. 2003 wc09.mtnk.etc visited dolls-devotion.com;
21. during Nov. 2003 wc09.mtnk.etc visited the site of a Catholic school in Switzerland;

With specific date:

1. on Nov. 1, 2003, "anandan" used wc09.mtnk.rnc.net.cable.rogers.com (=66.185.84.204) posted to a Tamil discussion board;
2. on Nov. 2, 2003, wc09.mtnk.etc visited the site of an engineering lab at the University of Tennessee Chatanooga;
3. Nov. 4, 2003, "SELLA" posted to discussion board "Historical Novels: Ponniyin Selvan vs Kadal Pura" using wc09.mtnk.etc;
4. Nov. 5, 2003, "flaming poultice" posted to a discussion board;
5. Nov. 6, 2003, "littlelilac" posted to a Gary Oldman discussion board;
6. on Nov. 10, 2003, "Sella" used wc09.mtnk.etc to tell a joke;
7. on Nov. 11, 2003, at 13:58, "lucy" allegedly used this IP to log-in at freedomsite.org;
   
8. on Nov. 11, 2003, "caper" used this IP to post to Groomers BBS;
9. on Nov. 12, 2003 "barb" used this IP to inquire about a florida vacation;
10. on Nov. 12, 2003, "cafe" used this IP to post on Seiko watches;
11. on Nov. 15, 2003, at 13:57, "lucy" allegedly used this IP to log into freedomsite.org;
12. on Nov. 16, 2003, "Lyndsay" used this IP to post to an NHL discussion board;
13. on Nov. 17, 2003, "maaran" used this IP to post a list of his favorite Tamil songs to a message board;
14. on Nov. 18, 2003, this IP visited a computer science student's site at the University of Alberta on a famous mathematical problem;
15. on Nov. 18, 2003, "Christine" used wc09.mtnk.etc to post to a message board in an attempt to find ring-tones for her phone;
16. on Nov. 19, 2003, "INDIA ROX" used wc09.mtnk.etc. to post on Indian cricket;
17. on Nov. 19, 2003, "executive" used this IP to post to a message board on height;
18. on Nov. 20, 2003, "Nelson Gross" was using this IP when he signed the online guestbook of Leisure Island;
19. on Nov. 21, 2003, this IP visited a computer science student's site at the University of Alberta on a famous mathematical problem;
20. on Nov. 23, 2003, at 11:23, "lucy" allegedly used this IP to visit freedomsite.org;
21. on Nov. 23, 2003, "Anonymous" used this IP to post to a message board called Dundalk Talk;
22. on Nov. 23, 2003, "tomcat2004" used this IP to post to a message board on Lacrosse;
23. on Nov. 26, 2003, "Anandi" used wc09.mtnk.etc (=66.185.84.204) to post to a Tamil message board;
24. on Nov. 26, 2003, this IP visited Scottsonline;
25. on Nov. 27, 2003, "Paul" used this IP to post to a videogame board;
26. on Nov. 28, 2003, "vasanthi" posted to a discussion board on "old tamil film songs" as wc09.mtnk.etc.; on the same day he posted on carnatic music;
27. on Nov. 28, 2003, 21:31 wc09.etc. visited www.sowter.co.uk.

Other lists can be see here:
• Jan.-Jul., 2003.
  
• Aug. 2003.
  
• Sept. 2003.
  
• Oct. 2003.
  
• Nov. 2003.
  
• Dec. 2003.
• Jan. 2004, and following.

Who else used 66.185.84.204 in December 2003?

Update. As you can see here, the reason that there are so many posts from such a variety of individuals through this IP is because it was one of Rogers' proxy servers and therefore forwarded internet traffic for hundreds of thousands of users.

I had created a list of places where we can see 66.185.84.204 (or its host-name equivalent, wc09.mtnk.rnc.net.cable.rogers.com) being used in 2003 here, and have been adding to it as I found new examples. That list has now grown a little unwieldy, so I am replacing it with several shorter lists (indexed at the bottom). Here is a list of attested users in December, 2003, which I divide into two lists. The first list is examples of the IP (or host-name equivalent) appearing in monthly visitor logs, which only allow us to conclude that the visit had taken place sometime during the month. The second list are cases where we know the specific date.

1. during Dec. 2003 this IP visited www.ess.uci.edu;
2. during Dec. 2003 wc09.mtnk.rnc.net.cable.rogers.com (=66.185.84.204) visited www.vinko.com;
3. during Dec. 2003 wc09.mtnk.etc visited amigazone.com;
4. during Dec. 2003 wc09.mtnk.etc visited pogopus.com;
5. during Dec. 2003 wc09.mtnk.etc visited linkingeverest.com;
6. during Dec. 2003 wc09.mtnk.etc visited TxCETP on www.sci.tamucc.edu;
7. during Dec. 2003 wc09.mtnk.etc visited skynet.ie;
8. during Dec. 2003 this IP visited the site of a West Florida chapter of the Society for Creative Anachronism;
9. during Dec. 2003 this IP visited visualriddle.com;
10. during Dec. 2003 this IP visited the website of a Vietnamese church in Ottawa;
11. during Dec. 2003 wc09.mtnk.etc visited www.istad.org;
12. during Dec. 2003 wc09.mtnk.etc visited the petdirectory.us;
13. during Dec. 2003 wc09.mtnk.etc visited as.ctkhi.com;
14. during Dec. 2003 wc09.mtnk.etc visited a blog at benched42.net;
15. during Dec. 2003 wc09.mtnk.etc visited http://kalliope.anitraweb.org;
16. during Dec. 2003 wc09.mtnk.etc visited a holiday suites site from Vancouver island;
17. during Dec. 2003 wc09.mtnk.etc visited a Korean (?) weblog;

Specific day known:

1. on Dec. 2, 2003, "kovalan" used wc09.etc to post to a Tamil message board;
2. on Dec. 3, 2003, "Paramesh" used wco9.etc to ask for cooking advice;
3. on Dec. 9, 2003, this IP visited a computer science student's site at the University of Alberta on Post's Correspondence Problem;
4. on Dec. 10, 2003 "debbie" posted to a Home Business Discussion Board using this IP;
5. on Dec. 11, 2003, this IP visited a computer science student's site at the University of Alberta on a famous math problem;
6. on Dec. 13, 2003, wc09.etc visited a German online philatelic shop;
7. on Dec. 20, 2003, "Tulika Mehta" used wc09.etc to post on Indian classical music;
8. on Dec. 24, 2003, "Sherman Sherwood" used wc09.etc to post to a discussion board on Ondachi's "Anils Ghost"

Other lists can be see here:
• Jan.-Jul., 2003.
  
• Aug. 2003.
  
• Sept. 2003.
  
• Oct. 2003.
  
• Nov. 2003.
  
• Dec. 2003.
• Jan. 2004, and following.

Who else used 66.185.84.204 in early 2004?

I had created a list of places where we can see 66.185.84.204 (or its host-name equivalent, wc09.mtnk.rnc.net.cable.rogers.com) being used in 2003 here, and have been adding to it as I found new examples. That list has now grown a little unwieldy, so I am going to replace it with several shorter lists (indexed at the bottom). Here is a list of a few of the attested examples of this IP being used in the first few months of 2004. (This list is only a sampling of what I'd found and most new discoveries have not been added.)

• during Jan. 2004,wc09.mtnk.rnc.net.cable.rogers.com (=66.185.84.204) visited genesis.jpl.nasa.gov;
• during Jan. 2004, wc09.etc visited gkutoronto.com
• during Jan. 2004 wc09.etc. visited www.vinko.com
• during Jan. 2004, this IP visited www.grebo-heights.wox.org/bowie;
• during Jan. 2004 wc09.etc visited www.3danvil.com
• on Jan. 2, 2004, this IP edited the Wikipedia entry on Gullane Entertainment Ltd.;
• on Jan. 3, 2004, this IP edited the Wikipedia entry on Rick Mercer's Monday Report;
• on Jan. 13, 2004, "ihatedildosmackers" used wc09.etc
• on Jan. 15, 2004, "jess" used this IP to post advice on a message board;
• on Jan. 18, 2004, a physician registered with the Armed Forces Institute of Pathology using this IP;
• on Jan. 18, 2004, "nriuthi" used wc09.etc to say hello;
• on Jan. 21, 2004, wc09.etc visited Novaman's website (dedicated to the 1973 and 1974 Nova);
• on Jan. 22, 2004, "cafe" posted to forum on Seiko watches;

• on Feb. 1, 2004, "salman" used wc09 to post on cricket
• on Feb. 9, 2004, "Parameshwary" used wc09.etc (=66.185.84.204) to post about reading Tamil script on-line;
• on Feb. 9, 2004, "sarah" used wc09.etc to post a request for a ring tone (giving her phone number, which is 519-xxx.xxxx);
• on Feb. 19, 2004, "sella" used wc09.etc to praise all languages as equal to his native Tamil;
• on Feb. 20, 2004, "Kones" used wc09.etc. to post a request for a Tamil (?) song;
• on Feb. 21, 2004, "zara" used wco9.etc (=66.185.84.204) to post on Hindi music;
• on Feb. 22, 2004, this IP visited the VMELinux project;
• on Feb. 26, 2004, this IP edited the Wikipedia entry on List of English-language Canadian television series;
• on March 27, 2004, this IP visited the computer engineering site at Parma University;
• on April 19, 2004 "cdnenya" used this IP to post to groomers.net;
• during May, 2004, this IP visited www.linkingeverest.com.

Other lists can be see here:
• Jan.-Jul., 2003.
  
• Aug. 2003.
  
• Sept. 2003.
  
• Oct. 2003.
  
• Nov. 2003.
  
• Dec. 2003.
• Jan. 2004, and following.

Who else used 66.185.84.204 in August 2003?

I had created a list of places where we can see 66.185.84.204 (or its host-name equivalent, wc09.mtnk.rnc.net.cable.rogers.com) being used in 2003 here, and have been adding to it as I found new examples. That list has now grown a little unwieldy, so I am replacing it with several shorter lists (indexed at the bottom). Here is a list of attested used in August, 2003:

1. during Aug. 2003 this IP visited the Institute for Improvement in Quality and Productivity at the U. of Waterloo;
2. during Aug. 2003 this IP visited insurgentcountry.com
3. during Aug. 2003 wc09.mtnk.rnc.net.cable.rogers.com (=66.185.84.204) visited fluidhose.com;
4. during Aug. 2003 wc09.etc (=66.185.84.204) visited yumfactory.com
5. during Aug. 2003 wc09.etc. (=66.185.84.204) visited metalsoft.com;
6. during Aug. 2003 this IP visited the webpage of O'Brien House, a Kingston B&B;

1. on Aug. 3, 2003, wc09.etc (=66.185.84.204) visited wireworld.com;
2. on Aug. 6, 2003, this IP visited the publications page of a U. of Alberta computer science prof.
3. on Aug. 9, 2003, this IP visited the site of a Nevada software engineer;
4. on Aug. 9, 2003, "kAdhali" used wc09.etc. (=66.185.84.204) to post a poem;
5. on Aug. 11, 2003, "Jan" used this IP to post to a "Virtues of Harmony" discussion board;
6. on Aug. 20, 2003 "tawa" used this IP to post to a soccer message board;
7. on Aug. 23, 2003, "Paramkathir" used wc09.etc (=66.185.84.204) to post about detective novels.
8. on Aug. 28, 2003, "quyen" used this IP to post to a Vietnamese (?) board in Vietnamese (?);

Other lists can be see here:
• Jan.-Jul., 2003.
  
• Aug. 2003.
  
• Sept. 2003.
  
• Oct. 2003.
  
• Nov. 2003.
  
• Dec. 2003.
• Jan. 2004, and following.

Who else used 66.185.84.204 in early 2003?

I had created a list of places where we can see 66.185.84.204 being used in 2003 here, and have been adding to it as new examples.  That list has now grown a little unwieldy, so I am going to replace it with several shorter lists, of which this is the first.  Included are cases where 66.185.84.204 (or its host-name equivalent, wc09.mtnk.rnc.net.cable.rogers.com) has been found. This list runs from January 1 to the end of July, 2003:

• on Jan. 3, 2003, this IP accessed the site of a Nevada software architect
• on Jan. 6, 2003, someone using Windows 98 visited ArcticCircle.ca with this IP;
• on Jan. 7, 2003, this IP visited a Helsinki University computer science page
• on Jan. 11 and Feb. 26, 2003, someone using Windows XP visited ArcticCircle.ca with this IP;
• on Jan. 13, 2003, "DVDfun" used this IP to post on a forum for XVCD users.
• on Jan. 31, 2003, wc09.mtnk.rnc.net.cable.rogers.com (=66.185.84.204) visited an Israeli mechanical engineering site;

• during Feb. 2003 this IP visited alexa.ists2.com;
• on Feb. 2 and Apr. 21, 2003, someone using Windows 98 visited ArcticCircle.ca with this IP;
• on Feb. 9, 2003, "rahman" used this IP to taunt another poster at a Tamil music site;
• on Feb. 15, 2003, someone using Windows 98 visited ArcticCircle.ca with this IP;
• on Feb. 24, 2003, "sam" used this IP to post at a forum on Indian musician A.R. Rahman;


• during March 2003 wc09.mtnk.rnc.net.cable.rogers.com (=66.185.84.204) visited fluidhose.com;
• during March 2003 this IP visited the webpage of O'Brien House, a Kingston B&B;
• on March 1, 2003, someone using Windows 98 visited ArcticCircle.ca with this IP;
• on March 1, 2003, "tj" used this IP to post at a form on Tamil music;
• on March 9, 2003, "PLE" used this IP to post at forum about Tamil MP3s;


• during April 2003 this IP visited www.gardendigest.com;
• on April 5, 2003, someone using a PowerPC-based Mac visited ArcticCircle.ca with this IP;
• on April 17, 2003, "shane" used this IP to post to an xbox365 message board;
• on April 18, 2003, someone using Windows XP visited ArcticCircle.ca with this IP;
• on April 20, 2003, this IP took a quiz at www.badsamaritan.com
• on April 21, 2003, someone using Windows 98 visited ArcticCircle.ca with this IP;
• on April 24, 2003, this IP visited the site of a Nevada software architect

• during May 2003 this IP visited the webpage of O'Brien House, a Kingston B&B;
• during May 2003 this IP visited the site of a Florida chapter of the Society for Creative Anachronism;
• on May 13, 2003, "karan" used wc09.etc (=66.185.84.204) to post a request for a Tamil ringtone;
• on May 23, 2003, "groomerjc" used this IP to post to Groomers BBS;

• during June 2003 this IP visited the webpage of O'Brien House, a Kingston B&B;
• on June 1, 2003, this IP visited the site of a Nevada software architect
• on June 9, 2003, "Kovalan" used wc09.mtnk.rnc.net.cable.rogers.com (=66.185.84.204) to post on Tamil(?) poetry;

• during July 2003, wc09.etc visited insurgentcountry.com;
• on July 17, 2003, "Mushtaq" used wc09.etc (=66.185.84.204) to request a recipe for mutton biriyani.

Other lists can be see here:
• Jan.-Jul., 2003.
  
• Aug. 2003.
  
• Sept. 2003.
  
• Oct. 2003.
  
• Nov. 2003.
  
• Dec. 2003.
• Jan. 2004, and following.

proxy servers 4: someone notices their proxy (75)

At least one Rogers customer was surprised to learn that his system was being proxied. In xxx, "intrudah" wrote (here):

i was playing on some gaming ladders (rainbow 6), and i was banned because it said my ip was used by another account.  i get this on the ip analyser: "Your IP (69.198.213.219) appears to be behind a web proxy server (66.185.84.75) and results shown might not be for your system." the admins think its because of the proxy.  any thoughts?

The discussion did not develop much from there.  But note that 66.185.84.75 is one of the IPs that we have been tracking, and here it proxies for 69.198.213.219, which at one time was part of a Rogers range (see here and here).  At least in this case, the Rogers customer did not even know he was behind a proxy.

proxy servers 3: what one looks like in an error log

We have already seen that some of the IPs that we've been tracking are Rogers' proxy servers (see here and, especially, here).  Now that we know what to look for, it's not difficult to find confirmation of this.  One example can be seen Nukecops.com, a help-forum for php-nuke, a web-based news publishing and content-management system.  In May 2004, a user "tuxx" asked for advice and posts his error logs, which I want to quote two chunks of.  First, this (which I have added colour to; "tuxx" had replaced the name of his site with "sitename.com" for privacy):

9993 admin65 /usr/bin/php UNIQUE_ID=usp-9EIxsZcAAGzF610AAABb HTTP_X_FORWARDED_FOR=24.150.44.231 SERVER_PORT=80 HTTP_HOST=sitename.com DOCUMENT_ROOT=/var/www/html SCRIPT_FILENAME=/var/www/html/index232.php REQUEST_URI=/index232.php SCRIPT_NAME=/index232.php HTTP_VIA=1.0 wc09 (NetCache NetApp/5.5R3) SCRIPT_URI=http://sitename.com/index232.php HTTP_CONNECTION=keep-alive PATH_INFO=/index232.php REMOTE_PORT=63754 PATH=/usr/local/bin:/usr/bin:/bin SCRIPT_URL=/index232.php PWD=/var/www/interpreters SERVER_ADMIN=email@sitename.com REDIRECT_STATUS=200 SITE_CGIROOT=/var/www/cgi-bin HTTP_ACCEPT_LANGUAGE=en PATH_TRANSLATED=/var/www/html/index232.php HTTP_ACCEPT=*/* SITE_HTMLROOT=/var/www/html REMOTE_ADDR=66.185.85.76 SHLVL=1 SERVER_NAME=www.sitename.com SERVER_SOFTWARE=Apache/2.0.48 (Fedora) QUERY_STRING= SITE_ROOT=/ SERVER_ADDR=66.49.180.189 GATEWAY_INTERFACE=CGI/1.1 SERVER_PROTOCOL=HTTP/1.1 REDIRECT_URL=/index232.php REQUEST_METHOD=GET _=/usr/bin/php

Here we see the tell-tale signs of a proxy. The "HTTP_VIA=1.0" shows that a proxy is being used, that it's name is "wc09", and that it using Net Appliances version 5.5R3. The "HTTP_X_FORWARDED_FOR" header shows the IP that the traffic is being fowarded for. And the "REMOTE_ADDR=" header introduced the IP of the proxy, in this case 66.185.85.76 (= wc09.ym.rnc.net.cable.rogers.com).  (For a quick tutorial, see here.)

In his search for help "tuxx" has included several other passages from his error logs including this:

9787 admin65 /usr/bin/php UNIQUE_ID=uTVIYUIxsZcAAGx8VC4AAABQ HTTP_X_FORWARDED_FOR=24.150.44.231 SERVER_PORT=80 HTTP_HOST=sitename.com DOCUMENT_ROOT=/var/www/html SCRIPT_FILENAME=/var/www/html/index232.php REQUEST_URI=/index232.php SCRIPT_NAME=/index232.php HTTP_VIA=1.0 wc09 (NetCache NetApp/5.5R3) SCRIPT_URI=http://sitename.com/index232.php HTTP_CONNECTION=keep-alive PATH_INFO=/index232.php REMOTE_PORT=5350 PATH=/usr/local/bin:/usr/bin:/bin SCRIPT_URL=/index232.php PWD=/var/www/interpreters SERVER_ADMIN=email@sitename.com REDIRECT_STATUS=200 SITE_CGIROOT=/var/www/cgi-bin HTTP_ACCEPT_LANGUAGE=en PATH_TRANSLATED=/var/www/html/index232.php HTTP_ACCEPT=*/* SITE_HTMLROOT=/var/www/html REMOTE_ADDR=66.185.84.204 SHLVL=1 SERVER_NAME=www.sitename.com SERVER_SOFTWARE=Apache/2.0.48 (Fedora) QUERY_STRING= SITE_ROOT=/ SERVER_ADDR=66.49.180.189 GATEWAY_INTERFACE=CGI/1.1 SERVER_PROTOCOL=HTTP/1.1 REDIRECT_URL=/index232.php REQUEST_METHOD=GET _=/usr/bin/php

Again, we see a proxy at work.  This time it is our old friend 66.185.84.204 = wc09.mtnk.rnc.net.cable.rogers.com, which again is shown to be a proxy.

When was this? The date of tuxx's post is May 18, 2004.  We have already seen here that truehits.net had listed 66.185.84.204 as a proxy in early 2003.  Apparently it was still one in 2004.

proxy servers 2: other Rogers proxy servers at truehits.net

We have been trying to discover how a group of Rogers IPs are related to one another.  Our results so far are illustrated by the ball-of-string to the right, where each strand represents a user who's IP can be seen shifting from one IP to another.   We saw in the last post, however, that one of them, 66.185.84.74, was a proxy server.  It is listed as a proxy server in the logs of truehits.net from April 19th, 2003, and December 23rd and 26th, 2004.  And, by a lucky chance, it attracted the attention of John Walker of AutoCad (here), who discussed how such a proxy might affect one's logs.  

This raises the question whether there are other proxies among these IPs, and since we found this Rogers proxy at truehits.net, this is obviously the first place to look.  These other Rogers IPs are listed as proxy servers in its logs on the following dates:

• 66.185.84.72: Dec. 8, 2004
  
• 66.185.84.74: April 19, 2003; Dec. 23 and 26, 2004 (see above)
  
• 66.185.84.76: Jan. 1, 2003; Jan. 5, 2003; Jan. 8, 2003; July 12, 2003; July 17, 2003, July 25, 2003; Nov. 1, 2003; Nov. 6, 2003; Nov. 11, 2003
• 66.185.84.77: Dec. 21, 2004
  
• 66.185.84.78: June 13 2003; June 14 2003
  
• 66.185.84.79: Jan. 2, 2005
  
• 66.185.84.80: Mar. 6, 2005
  
• 66.185.84.196: Aug., 2002
  
• 66.185.84.200: Mar. 24, 2002; Apr. 7, 2002
  
• 66.185.84.202: Feb. 9, 2003; April 7, 2003
• 66.185.84.204: Jan. 7, 2003; Feb. 2, 2003

This means that about half of the IPs that we have been considering are proxy servers. Adding this to our ball of string, with each confirmed proxy circled (the colour is according to year), produces the graphic at the left.

more fluidity (204 = 208 =199)

Another good example at how fluid these Rogers IPs were comes from the Dec. '03 logs from land-fortune.com (I add the IP numbers for each host-name):

wc04.mtnk.rnc.net.cable.rogers.com	(=66.186.84.199)	2	78	1.11 MB	20 Dec 2003 - 11:03
wc09.mtnk.rnc.net.cable.rogers.com	(=66.186.84.204)	6	43	672.82 KB	20 Dec 2003 - 11:03
wc13.mtnk.rnc.net.cable.rogers.com	( =66.186.84.208)	3	22	421.08 KB	20 Dec 2003 - 11:02

proxy servers 1: 66.185.84.74

I have already pointed out (here) the rather odd logs at John Walker's fourmilab.com, in which three Roger's IPs accounted for so much of the traffic for the site in January, 2004. The size of the traffic apparently attracted the attention of the site owner, who discusses it here. His conclusion? That these are proxy servers.  This is what he writes:

The hosts with very high hit rates appear to be HTTP proxy servers which are relaying requests from hosts behind them. Here's a dump of a packet from the host at the very top of the heavy hitters report: wc07.wlfdle.rnc.net.cable.rogers.com -> vitesse HTTP GET / HTTP/1.1 0: 0800 20a1 4ca0 0030 1e05 2758 0800 4500 .. .L..0..'X..E. 16: 00ce e6a2 4000 2c06 28f1 42b9 544a c108 ....@.,.(.B.TJ.. 32: e68a b959 0050 0b64 6c2d 798e e202 8018 ...Y.P.dl-y..... 48: 4470 c88b 0000 0101 080a 2e4f 0050 594f Dp.........O.PYO 64: daa9 4745 5420 2f20 4854 5450 2f31 2e31 ..GET / HTTP/1.1 80: 0d0a 486f 7374 3a20 666f 7572 6d69 6c61 ..Host: fourmila 96: 622e 6368 0d0a 436f 6e6e 6563 7469 6f6e b.ch..Connection 112: 3a20 6b65 6570 2d61 6c69 7665 0d0a 5072 : keep-alive..Pr 128: 6167 6d61 3a20 6e6f 2d63 6163 6865 0d0a agma: no-cache.. 144: 582d 466f 7277 6172 6465 642d 466f 723a X-Forwarded-For: 160: 2032 342e 3135 332e 3539 2e38 340d 0a56 24.153.59.84..V 176: 6961 3a20 312e 3020 7763 3037 2028 4e65 ia: 1.0 wc07 (Ne 192: 7443 6163 6865 204e 6574 4170 702f 352e tCache NetApp/5. 208: 322e 3152 3144 3929 0d0a 0d0a 2.1R1D9).... As you can see, this is a proxy server forwarding a packet for a host with IP address 24.153.59.84, which resolves to CPE00e0184e28fb-CM00803785d6b6.cpe.net.cable.rogers.com, another host in the same domain (albeit a very different IP address: the proxy server is 66.185.84.74). Monitoring packets from the proxy server show it forwarding requests from an assortment of hosts behind it.

Thus John Walker.  There are two important points for us here: (1) 66.185.84.74 is a proxy-server that was forwarding requests for a number of Rogers' customers, and (2) each of Rogers' customer will have had their own IP.  (In this case the customer is 24.153.59.84.)

There is, however, another point.  To the right is screen-capture of the last line of the packet quoted above.  In it is identified the server software that is doing the proxying (see the red arrow): Netcache by Network Appliances (NetApp).  

This is something that we see elsewhere.  A Thai web-directory, truehits.net, provides a variety of services for its customers, including daily traffic statistics that are available on the web.  One reported statistic is top proxy servers, and the same proxy server discussed by fourmilabs in January 2004 was listed by truehits as one of top proxy-servers to visit sunncity.com on April 19 2003, Dec. 23 2004, and Dec. 26 2004.

The screen cap on the left is from April 19.  It shows, not only is the same server software being used (see red arrow), but the exact same version (5.1.1R1D9), and (since it is set up to "Forward IP") with much the same configuration.  

Now, according to the fourmilabs logs, the forwarding was being done for 24.153.59.84 (a Rogers IP).  In the case of this truehits log, we can again identify the specific IP of the individual user, not merely the proxy.  Note that the proxy had forwarded 63 hits (green arrow).   

Among the top daily visitors (see right) is 24.102.79.243, which is marked here as NETBLK-RNS-EAST.  (To judge from this, RNS abbreviates Rogers Network Services.) And the number of hits is identical to the proxy's.  (It is only to be expected, of course, that an small site in Thailand might only receive one Rogers customer in a daily log.)

The important point for us is that Rogers was using this IP as proxy for all of 2003 and 2004.

One final point.  In most cases the proxy hides the individual IP, and the IP that appears in the logs is that of the  proxy, not that of the individual Rogers customer.  In the case of the fourmilabs logs, of course, Mr. Walker has fished out the individual IP for us.  Normally, however, we don't see the individual data, but we see details about his browser and operating system ("user agents").  Consider these examples from two log entries for the same proxy (66.185.84.74) during the period when this proxy was in use:

• Tue 29-June-2004 08:07 - wc08.wlfdle.rnc.net.cable.rogers.com [=66.185.84.74, ed.] - "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" - "http://search.yahoo.com/"
  
• 66.185.84.74 - - [25/Sep/2004:09:59:00 +0200] "GET /downloads/hovtext/1.0/HovText.exe HTTP/1.1" 200 1136640 "http://hovklan.com/hovtext/index.php/?page=download〈=en" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; FunWebProducts; SV1; .NET CLR 1.1.4322)"

In both cases, the IP is the proxy, and the user agent data (browser, operating system, etc.) is the individual's.

66.185.84.204 and the promiscuity of Rogers' IPs (Summary thread)

Update. When I first posted this, I didn't realize that these were all Rogers' web-caching proxy servers. The shifting that I've documented is presumably a result of the practice of load-balancing (on which see here).

Over the last several weeks and in dozens of posts, we've seen how liquid some of Rogers' IPs were in the years 2003-2005. IPs in 66.185.84.xxx range seem to have changed without warming; in extreme cases a surfer might have several IPs in several minutes. (See, for example, here from 2004 where there are five IPs in half-a-day; or here from 2003, where there are three in 8 minutes; or some of the other listed under the label "quick change").

The shifts between these IPs are trackable, but the details are widely dispersed and the overall picture difficult to make out. Hence the graphic above. Each line connects two of the Rogers' IPs in our pool; I colour-coded them by year (see the key at the top right). The evidence for some of the equivalencies are more certain than for others, which can be checked via this index:

• 66.185.84.72 (Nov. '04 =81)
• 66.185.84.73 (Nov. '04 =203 =208, Jun. '03 =74, Feb. '04 =74),
• 66.185.84.74 (Jun. '02 =81, Oct. '03 =80 =208, Jun. '03 =73, Jan. '04 =202, Feb. '04 =74)
• 66.185.84.75 (Mar. '04 =76 =77 =78 =79 =81)
• 66.185.84.76 (Mar. '04 =75 =77 =78 =79 =81) Jun. '04 =77, Oct. '04 =71 =80 =199 =200 =204 =205 =208)
• 66.185.84.77 (Mar. '04 =75 =76 =78 =79 =81, Jun. '04 =76, Oct. '04 =205, Jan. '05 =209)
• 66.185.84.78 (Nov. '03 =80, Jan. '04 =80, Mar. '04 =75 =76 =77 =79 =81, Apr. '04=202 =208, Aug. '04 =80, Nov. '04 = 81)
  
• 66.185.84.79 (Mar. '04 =75 =76 =77 =78 =71, Jan. '05 = 81 =206 =208)
• 66.185.84.80 (Oct. '03 =74 = 208, Nov. '03 =78, Jan. '04 =78, Aug. '04 =78, Nov. '04 =208, Oct. '04 =71 =199 =200 =204 =205 =208, Oct. '04 =81 =208)
  
• 66.185.84.81 (Jun. '02 =74, Mar. '04 =75 =76 =77 =78 =79, Apr. '04 =208 =80, Nov. '04 =72, Dec. '04 =72, Jan. '05 =79 =206 =208)
  
• 66.185.84.196 (Mar. '02 =197 =198 =206, Feb. '05 =197 =198 =199 =200 =205 =206)
  
• 66.185.84.197 (Mar. '02 =196 =198 =206 =205, Dec. '03 =206, Oct. '04 =199 =200 =204 =205 =208 , Feb. '05 =198 =199 =201 =203, Feb. '05 =199 =200 =204 =206 =208 =209, Feb. '05 =196 =198 =199 =200 =205 =206)
  
• 66.185.84.198 (Feb. '02 =204, Mar. '02 =196 =197 =203 =206, Feb. '05 =196 =197 =199 =200 =205 =206, Feb. '05 =197 = 201 =203 =205)
  
• 66.185.84.199 (Nov. '03 =207 =208, Dec. '03 =204 =208, Oct. '04 =197 =200 =204 =205 =208, Feb. '05 =197 =198 =201 =203 =205, Feb. '05 =197 =200 =204 =206 =208 =209, Feb. '05 =196 =197 =198 =200 =205 =206 )
  
• 66.185.84.200 (Sept. '03 =204, Nov. '03 =208, Oct. '04 =197 =199 =204 =207, Feb. '05 =196 =197 =198 =199 =205 =206, Feb. '05 =197 =199 =204 =206 =208 =209)
  
• 66.185.84.201 (Jun. '02 =204, Aug. '03 =202, Feb. '05 =197 =198 =199 =203 =205)
• 66.185.84.202 (Mar. '02 =204, Jun. '02 = 209, Aug. '03 =201, Nov. '03 =208, Jan. '04 =74, April '04 =204 =206 =208 =209)
  
• 66.185.84.203 (Mar. '02 = 198, July '03 =208, Nov. '04 =73 =208, Feb. '05 =197 =198 =199 =201 =205)
  
• 66.185.84.204 (Jun. '02 =201, Feb. '02 =198, Mar. '02 =202, Sept. '03 =200, Dec. '03 =199 =208, Apr. '04 =202 =206 =208 =209, Oct. '04 =197 =199 =200 =207, Feb. '05 =196 =197 =198 =199 =200 =206, Feb. '05 = 197 =199 =200 =206 =208 =209, Feb. '05 =207, Feb. '05 =197 =198 =199 =201 =203)
  
• 66.185.84.205 (Mar. '02 =197 =198, Nov. '05 =197 =199 =200 =204 =206 =208 =209)
• 66.185.84.206 (Mar. '02 =196 =197 =198, Nov. '03 =208, Dec. '03 =197, Dec. '03 =208, Jan. '04 =204, April '04 =202 =204 =208 =209, Jan. '05 =79 =81 =208, Feb. '05 =196 =197 =198 =199 =200, Feb. '05 =197 =199 =200 =204 =208 =209)
  
• 66.185.84.207 (Nov. '03 =199 =208, Oct. '04 =197 =199 =200 =204, Feb. '05 =204)
• 66.185.84.208 (July '03 =203, Oct. '03 =74 =80, Nov. '03 =199 =207, Nov. '03 =206, Nov. '03 =202, Dec. '03 =206, Dec. '03 =199 =204, Jan. '04, April '04 =202 =204 =206 =209, Oct. '04 =199 =200 =204 =205, Nov. '04 =197 =198 =200 =204 = 206 =209, Jan. '05 =79 =81 =206, Feb. '05 =197 =199 =200 =204 =206 =209)
• 66.185.84.209 (Jun. '02 =202, April '04 =202 =204 =206 =208, Jan. '05 =77, Feb. '05 =197 =199 =200 =204 =206 =208)

This list reflects, of course, only the tiniest fraction of the internet traffic. Every visit to any web-page is logged somewhere, but very few of those logs are ever published online and therefore become available to us, and only a tiny fraction of internet users edit wikipedia anonymously.

Who else used 66.185.84.204 in 2003?

The list of appearances of 66.185.84.204 in 2003 grew too lengthy for a single list, so I've divided its content into these shorter lists:

• Jan.-Jul., 2003.
  
• Aug. 2003.
  
• Sept. 2003.
  
• Oct. 2003.
  
• Nov. 2003.
  
• Dec. 2003.
• Jan. 2004, and following.

rip-off (75 = 76 = 77 =78 =79 =81)

“There are three things in the world that deserve no mercy -- hypocrisy, fraud, and tyranny,” someone said. This is presumably why the internet is so merciless.

In this thread at Howard Forums, dating from March 2004, to judge from the Wayback machine, "drumming27" complains that he had agreed to sell an xbox to "Mr. Chow", but had never been paid, and now is unable to contact Chow. Drumming gives all the information that he has on "Chow", including the shipping address, all the IPs that in the communications. The list of IPs is again telling, since they are mostly Rogers:

192.139.71.69 (torfw1.nesbittburns.com)
209.161.243.29 (209.161.243.29) 24.102.71.218 (CPE00045ae17926-CM012069962605.cpe.net.cable.rogers.com)
24.153.37.33 (CPE000c6efd4c43-CM000e5c6eb738.cpe.net.cable.rogers.com)
24.156.41.95 (CPE000c6e83883a-CM014270033677.cpe.net.cable.rogers.com)
63.230.237.230 (63-230-237-230.phnx.qwest.net)
65.48.68.214 (65.48.68.214)
65.50.50.102 (CPE000c6e806d9b-CM014310003972.cpe.net.cable.rogers.com)
66.185.84.75 (wc08.wlfdle.rnc.net.cable.rogers.com)
66.185.84.76 (wc09.wlfdle.rnc.net.cable.rogers.com)
66.185.84.77 (wc10.wlfdle.rnc.net.cable.rogers.com)
66.185.84.78 (wc11.wlfdle.rnc.net.cable.rogers.com)
66.185.84.79 (wc12.wlfdle.rnc.net.cable.rogers.com)
66.185.84.81 (wc14.wlfdle.rnc.net.cable.rogers.com)
66.75.109.220 (cpe-66-75-109-220.socal.rr.com)

Some might have been struck by the number of IPs involved in such a simple transaction. But for those who have been following my recent posts, Rogers IPs within this group seem to do this a lot. Here it seems that Chow, too, had IP shifts from x.x.x.75 to x.x.x.76, etc., in early 2004.

another user of 66.185.84.204

The Armed Forces Institute of Pathology is part of the American Defense Department, it provides consultation, education and research. Its educational wing offers courses, and the registration logs for some of these can be seen on line. In January, 2004, someone registered in one of their on-line courses using the IP 66.185.84.204 (see here, here, and here).  You can see the name by clicking on the links and searching the IPs -- but it an Ottawa area physician who is listed among the authors of a paper on Calcified Colonic Mass.

How many different users used 66.185.84.204 to visit northern sites in 2002-2003?

ArcticCircle.ca is a web-host and central hub for a variety of northern communities. It has some great photo-albums and attracts a fair bit of traffic from across the country.

Included in its traffic are numerous visits from the mysterious Rogers IP, 66.185.84.204. Indeed, within its logs are 32 separate visits from that IP between January 2002 and April 2003. The logs preserve date, time, site visited, and details about the operating-system and browser of the visitor.

Here are the 32 visits by 66.185.84.204, in chronological order, together with the logged data.

no.	date	config	log
1	20-Jan-02	Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Q312461)	here
2	23-Jan-02	Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Q312461)	here
3	31-Jan-02	Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Q312461)	here
4	03-Feb-02	Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Q312461)	here
5	28-Feb-02	Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Q312461)	here
6	03-Mar-02	Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)	here
7	11-Apr-02	Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90; Hotbar 3.0)	here
8	11-Apr-02	Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; AtHome0107)	here
9	25-Apr-02	Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)(R1 1.1)	here
10	01-May-02	Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)	here
11	02-May-02	Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Q312461)	here
12	23-May-02	Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Q312461)	here
13	26-May-02	Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt; AtHome0107)	here
14	07-Jun-02	Mozilla/4.78 [en] (Win98; U)	here
15	10-Jun-02	Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90; MSOCD; AtHome021SI)	here
16	17-Jun-02	Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.0.3705)	here
17	20-Jun-02	Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90; H010818; Rogers Hi-Speed Internet)	here
18	24-Jun-02	Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)	here
19	13-Oct-02	Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90; Q312461; MSOCD; AtHome021SI; YComp 5.0.0.0; .NET CLR 1.0.3705)	here
20	30-Oct-02	Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; AtHome0107)	here
21	06-Jan-03	Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)	here
22	06-Jan-03	Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)	here
23	11-Jan-03	Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)	here
24	02-Feb-03	Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Rogers Hi-Speed Internet)	here
25	16-Feb-03	Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; MSOCD; AtHome021SI; (R1 1.1))	here
26	26-Feb-03	Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)	here
27	01-Mar-03	Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Q312461; YComp 5.0.2.5)	here
28	05-Apr-03	Mozilla/4.0 (compatible; MSIE 5.16; Mac_PowerPC)	here
29	18-Apr-03	Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Rogers Hi-Speed Internet)	here
30	21-Apr-03	Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Rogers Hi-Speed Internet)	here

These are obviously not all the same individual, though some of these are return visitors. Here are the easier identifications:

• 1 =2 =3 =4 =11 =12
  
• 5 = 29?
  
• 6 = 21 =22
  
• 7 = 15?
  
• 8 (= 20?)
  
• 9 = 13?
  
• 10 = 17? = 19?
  
• 14
  
• 16 ?= 23 = 26 29
  
• 18 = 20
  
• 24 = 30
  
• 25
  
• 28

A few of these, too, might also be the same individual using a different computer via a wireless network, etc.

But one way or another it is difficult to avoid the conclusion that up to a dozen different individuals visited one of the sites at ArcticCircle.ca using the same IP address.