Friday, February 29, 2008

Scottsonline (199 = 205 = 200; 204 = 208)

There are many details to be extracted from logs for miscellaneous websites that help illustrate the impermanent nature of Roger's IPs in the years 2003 and 2004. Below are some Rogers IPs extracted from a log for scottsonline.com. Especially, to be noted are the coloured entries.
IP pages hits bandwidth last visit date
66.185.84.71 2 7 124154 2004 09-02 08:29:00
66.185.84.199 1 1 1686 2004 09-08 13:12:10
66.185.84.205 1 1 1686 2004 09-08 13:26:30
66.185.84.200 4 18 112762 2004 09-08 13:27:06
66.185.84.19726 86 4103099 2004 09-08 13:28:08
66.185.84.204 1 1 25877 2004 09-12 18:20:44
66.185.84.208 6 41 568401 2004 09-12 18:20:57
66.185.84.69 14 77 959341 2004 09-22 08:09:40
66.185.84.76 6 9 25130 2004 09-24 20:20:29
66.185.84.8034 284 7429937 2004 09-28 14:01:20
Beginning with the blue entries, it is theoretically possible that four Rogers customers showed up within a few minutes of one another at 13:12:10, 13:26:30, 13:27:06, and 13:28:08 of Sept. 08, 2004. But especially with the last three log entries, it is easier to believe that this is one person, and that it is yet another example of the fluidity of the Rogers IPs, and within a minute-and-a-half, the Scottsonline customer had cycled through 66.185.84.205, -200, and 197.

The same point can be made about the two red entries, from four days later. The two red log entries are only 15 seconds apart, and x.x.x.204 "hits" only a single page once before disappearing and giving way to x.x.x.208.  This is easiest to explain if this is one user whose IP has changed suddenly, as these IPs can be seen to do elsewhere.  

Whether the other IPs reflect the same users, and whether the 'blue-user' and 'red-user' is the same person, is less clear.  But given that these IPs often seem elsewhere to shift into one another, it seems highly likely not only that the red IPs and blue IPs all belong to the same user, but so, too, do the other IPs that we find here: x.x.x.69, x.x.x.76, and x.x.x.80.

Tuesday, February 26, 2008

video gaming (or, 208 = 80 = etc.)

We have seen that in 2003 and 2004 (and since), Rogers IPs bounce around quite a bit. Indeed, once one begins to look, it is not hard to find other places where the instability of Rogers' IPs can be seen. Consider the postings of a certain Necros at a message board dedicated to video-game graphics in the years 2003-2004. Each post includes not only Necros' name and message, but his IP-address, too, which allows us to detect some more IP-bouncing. 

Necros' first couple dozen posts on the board are from an AOL account. Beginning in September, 2003, however, he begins to post from a series of Rogers IPs:
no. 348 2003/10/02 66.185.84.208 (Rogers)
no. 374, 3802003/10/19-2063.139.3.74 (Rogers)*
no. 443 2003/11/30 66.185.84.208 (Rogers)
no. 460, 471 2003/12/27, 2004/01/03 63.139.106.197 (Rogers)*
no. 499, 500, 5322004/01/11, 1766.185.84.208 (Rogers)
no. 553, 560, etc. 2004/01/28 - 02/24 63.139.106.197 (Rogers)*
no. 724, 729 2004/03/16, 17 66.185.84.208 (Rogers)
no. 749, 756, etc., etc.2004/03/24-05/27 69.193.41.176 (Rogers)
no. 1117, 1126, etc. 2004/06/02, 06, 19, 07/15 66.185.84.208 (Rogers)
no. 1214, 1225, 1238 2004/08/08, 11, 13 66.185.84.80 (Rogers)
no. 1256 2004/08/17 66.185.84.208 (Rogers)
no. 1265, 1274, 1292 2004/08/21, 23, 25 69.193.222.114 (Rogers)
no. 13552004/07/07 66.185.84.208 (Rogers)
no. 1398 2004/09/21 142.150.5.189 (U. of Toronto)
no. 1402, 1407, etc. 2004/09/22-10/26 66.185.84.80 (Rogers)
no. 1497 2004/10/21 142.150.5.189 (U. of Toronto)
no. 1502 2004/10/26 142.150.5.189 (U. of Toronto)
no. 1508, 1512, etc. 2004/10/30 - 11/01 66.185.84.80 (Rogers)
no. 1551 2004/11/06 66.185.84.208 (Rogers)
no. 1556 2004/11/11 142.150.107.117 (U. of Toronto)
no. 1585 2004/11/25 142.150.107.159 (U. of Toronto)
no. 1600 2004/12/12 66.185.84.74 (Rogers)
no. 1616, 1620, 1624 2004/12/28-29 66.185.84.80 (Rogers)
The IPs, with the exception of those from the U. of Toronto seem to be all Rogers (with the possible exception discussed below), and again we see the propensity of the IPs to shift. Very common are 66.185.84.208 and 66.185.84.80.

Beginning in 2005, we can add a few more IPs.  A few more posts are here
    no. 99, 100 2005/01/1966.185.84.76 (Rogers)


    *According to ARIN: 63.139.106.197 now falls within a block that belongs to PaeTec Communications. In 2004, however, the similar IPs seem to have belonged to Rogers: see this log (search for the IP), and this one under Tue Nov 25 22:58:23 2003 , and this one under 2004/03/07 .

Sunday, February 24, 2008

What's in a name: or, 200 = 196 = 197 = 198 = 199 = 205 = 206

We have been seeing that wikipedia histories show that Rogers' subscribers' IP addresses are not completely fixed: one can begin with one IP, shift to another, and then back within a very short space. Klatt testified that when 66.185.84.204 visited the freedomsite, the logs show shifts to 66.185.84.200 and back, and it is clear that this happened a good deal.

A good example of how much shifting could happen comes from the wikipedia article List of Biblical names. As its name implies, it is merely a long alphabetical list of characters who appeal in the bible.

Consider this section of its edit-history from February 2005. (Wikipedia logs are read from the bottom up.)
  • 18:01, 14 February 2005 PFHLai (Talk | contribs) (remove {{Vprotectedsmall}})
  • 03:42, 14 February 2005 PFHLai (Talk | contribs) (+ {{Vprotectedsmall}})
  • 03:41, 14 February 2005 PFHLai (Talk | contribs) m (Reverted edits by 66.185.84.200 to last version by PFHLai)
  • 03:37, 14 February 2005 66.185.84.200 (Talk) (→K)
  • 03:36, 14 February 2005 PFHLai (Talk | contribs) (restore a previous version after vandalism by an Anon. with multiple IPs)
  • 03:33, 14 February 2005 66.185.84.197 (Talk) (→J)
  • 03:26, 14 February 2005 66.185.84.198 (Talk) (→I)
  • 03:24, 14 February 2005 66.185.84.206 (Talk) (→H)
  • 03:21, 14 February 2005 66.185.84.205 (Talk) (→G)
  • 03:18, 14 February 2005 66.185.84.199 (Talk) (→E)
  • 03:13, 14 February 2005 66.185.84.198 (Talk) (→D)
  • 03:09, 14 February 2005 66.185.84.206 (Talk) (→C)
  • 03:06, 14 February 2005 66.185.84.196 (Talk) (→B)
  • 03:03, 14 February 2005 Rje (Talk | contribs) m (rv to last edit by Ihcoyc, semi-blanking)
  • 03:01, 14 February 2005 66.185.84.200 (Talk) (→A)
Here you can see that an editor began with 66.185.84.200, the IP mentioned by Klatt in his testimony, and in the course of 36-minutes, his IP was shifted at least 9 times. (I say 'at least', because there is no way of knowing that there weren't shifts between these postings.)

(It is clear that the user is the same -- he is engaging in what in wikipedia is called blanking-vandalism.)


Saturday, February 23, 2008

Thomas the Tank Engine III: or how 208 = 202 = 200 = 80 = 78 = 81

We have been exploring the edits made to Wikipedia by a series of Rogers IPs in 2003 and 2004. The editor shows consistent interest in a group of articles, many of which relate to the children's program Thomas the Tank Engine.

One such article was its American spin-off Shining Time Station.  Here is the edit history of its first six weeks (the logs read from the bottom):
    14:42, 31 December 2003 66.185.84.208
    20:22, 30 December 2003 66.185.84.208
    20:21, 30 December 2003 66.185.84.208
    20:19, 30 December 2003 66.185.84.208
    23:27, 12 November 2003 Dysprosia m (fmt)
    23:27, 12 November 2003 Minesweeper (fmt)
    23:00, 12 November 2003 66.185.84.208
    20:59, 12 November 2003 66.185.84.208
    20:58, 12 November 2003 66.185.84.208
    20:44, 12 November 2003 66.185.84.208
    20:41, 12 November 2003 66.185.84.208
    00:15, 12 November 2003 66.185.84.208
    20:30, 10 November 2003 66.185.84.208
    20:14, 10 November 2003 66.185.84.202 (Talk)
As you can see, the article was first created on Nov. 10, 2003 by an anonymous editor using the Rogers IP 66.185.84.202. Only minutes later, 66.185.84.208 edited it, and continued over the next few days. Over the coming months, it is slowly built-up by Rogers IPs such as 66.185.84.200 in this edit of March 2004.  And those of 66.185.84.208, 66.185.84.80, and 66.185.84.81 here:
    22:56, 20 November 2004 66.185.84.81
    00:10, 10 November 2004 66.185.84.208
    21:33, 23 October 2004 66.185.84.80
The five or six Rogers IPs related to this article do not, presumably, show that there was a hot-bed of interest for Shining Time Station in one neighbourhood in Southern Ontario.  Rather, this is again an illustration of how fluid the IPs were in those years: one editor with an interest in Thomas the Tank Engine was assigned different IP addresses at different times.

Thomas the Tank Engine II: or how 208 = 80


At the following link you can see the edit history of the wikipedia article for Salty the Diesel Engine, a minor character in the Thomas the Tank Engine series.

Salty's article was created as a 'stub' on 15 Oct. 2004 by 66.185.84.208; an attempt was made to redirect it to the main Thomas the Tank Engine page, a couple hours later. Within a day, the original editor returned and undid the redirect.

It is hard to avoid the conclusion that an editor who uses 66.185.84.208 might sometimes use 66.185.84.80.

Friday, February 22, 2008

Rammstein: or, 204 = 207




We've been looking at the fluidity of Roger's IPs in the years 2003 and 2004. Another example of this comes from late 2004, when a wikipedia used 66.185.88.204 to edit the rock group Rammstein and the song of the same name. A week later, the same editor (one assumes) returned to edit the rock group's article, and then two months later, when they had 66.185.88.207

Rick Mercer's Monday Report I: or, how 204 = 206


I pointed out here that on Sept. 5, 2003, a Rogers customer using 66.x.x.204 seems to have been temporarily rerouted through 66.x.x.200 (and perhaps back-and-forth several times). And here that on Jan. 2, 2004, one was rerouted through x.x.x.208.

On Jan. 1, 2004, someone used 66.x.x.204 to edit Rick Mercer's Monday Report. A snippit of the log for these days can be seen here, where you can see that x.x.x.208 was used Jan. 1, x.x.x.204 on Jan. 3, and yet another IP, 66.185.84.206, on Jan. 5.

Thomas the Tank Engine I: or how 204 = 208

We have already seen here that on Sept. 5, 2003, a Rogers communications customer was routed through both 66.185.84.204 and 66.185.84.200 during a short visit. Below I will point out that sometimes the x.x.x.204 user is routed through x.x.x.208.

One of the largest data set for IPs is wikipedia, since it allows its editors to choose whether or not sign in when they edit. By examining an article's history, you can see the names of editors who signed-in and the IPs of those who didn't.


Take the article Gullane Entertainment Ltd. (which redirects to Gullane Entertainment, a television production company that produces children's programming, best known for the series Thomas the Tank Engine

Now, if you click on the "history" tab above the article, you can see its editing history, where you'll see that on Jan. 2, 2004, 66.185.84.204 made a small edit to the article, replacing an internal link with an external. Only a few days earlier, however, the article was created by 66.185.84.208 and had provided all of the information in it, and within a few months 66.185.84.208 edited the article again.

Now, it is fairly clear that these two IPs are the same editor, and what this illustrates is something that several commentators in other blogs have noted. No one seems to hold these IPs long.

Klatt's testimony, or sometimes 204 = 200

Here are pages 1636-8 of Richard Warman and the Canadian Human Rights Tribunal v. Marc Lemire (T1073/5405 vol. 9) of Feb. 8, 2007. In it, Bernard Klatt is testifying about the logs of Lemire's site.

The point to note is that during his visit to the site on Sept. 5, 2003, the user "90sareover" showed up in Lemire's logs both as 66.185.84.204 and as 66.185.84.200, although only visiting the site briefly. Klatt is unable to explain this, but it is a phenomenon that is worth keeping in mind, since if 90sAREover had hit return in one of the moments when his traffic was being channeled through 66.185.84.200, we'd not be having this discussion.

p. 1636:
KlattOn200a

p. 1637:
KlattOn200b

p. 1638:
KlattOn200c

Saturday, February 16, 2008