Bouquets of Gray

buckets · at 5/06/2008 08:14:00 pm

Below and to the right is a long exerpt from Bernard Klatt's testimony of Feb. 8, 2007 (Richard Warman & the CHRC v. Marc Lemire, T1073/5405 vol. 9, pp. 1636-8) .

In it, Klatt, who had been summoned to testify as a technology expert, is discussing the phenomenon that we had identified in the last post: that is, in the logs of Sept. 5, 2003, the traffic associated with 90sAREover's visit sometimes appears as 66.185.84.204 and sometimes as 66.185.84.200. Indeed, in the three minutes following his notorious racist denunciation of Senator Anne Cools, the IP changes four times.

Klatt is unable to explain the phenomenon.

There are several troubling aspects of this. First, of course, is the fact that he he's not sure what is going on: one expects better of an "expert". Second, it is troubling that the shifting IPs (which is material to the identification that he's making) is a matter that was raised not by Klatt himself, but the Chair of Tribunal. He makes no allusion to it at all in his discussion of the Cools' post in his affidavit (paragraphs 34-41, here). His answer to the chair, however, reveals that this is something that he'd noticed before: "That one is interesting" (line 21 of p. 1636). Not interesting enough, apparently, that he should actually explain it in his testimony.

Most importantly, however, is that is a bit troubling how close Klatt came to the truth. At p. 1636, lines 22-23, for example, he recognizes that 66.185.84.200 might be a web-cache, which he repeats at p. 1638, lines 3-4, as "very likely". The correct answer, as we have seen, is that both these IPs are web-caches and that the shifting from one to the other is part of Rogers' practice of load balancing. And the idea that he might suppose that 66.185.84.200 (which had a hostname of wc04.mtnk.rnc.net.cable.rogers.com) was a web-cache, but not guess that 66.185.84.204 (with hostname wc09.mtnk.rnc.net.cable.rogers.com) was also one is a bit baffling. He was so close!

One expects better than "close", however, from an expert. We want them to be right. Mistakes in expert testimony can ruin lives. In this case, the erroneous testimony has damaged the reputation of an innocent man and exposed those who have repeated Klatt's errors to financial harm.

Other posts in the Klatt's clunkers series:

buckets · at 5/05/2008 08:56:00 pm

As we have seen, one of the key pieces of evidence in the Cools-post debate has been the IP 66.185.84.204 (which has the host name wc09.mtnk.rnc.net.cable.rogers.com). As I have shown at length in this post, the wc stands for web-cache. A web-caching proxy server keeps copies of web-pages in its storage in order to save bandwidth. This practice, now in Roger's past, is important for the present controversy for two reasons. First, Rogers proxies hid the IPs of the individual computers that they are proxying for, and it was the proxy's IP that was logged at the websites visited. Second, because the proxy is performing this function for tens of thousands of Rogers subscribers at a time, the IP by itself is of little help in tying any one of them to any specific post.

In his testimony, however, Bernard Klatt seems to have missed this important fact. Indeed, when the topic of Rogers web-caching arose, he pleaded ignorance.

Since the IP in question was a such a proxy, and in fact the single most relevant fact to the case, Klatt's admission has the effect of rendering his testimony useless.

Other posts in the Klatt's clunkers series:

buckets · at 5/05/2008 08:29:00 pm

Bernard Klatt, the technology "expert" whose bunglings we have been reviewing in this series (for other posts, see the index at the foot of this post), argued before the Canadian Human Rights Tribunal that Richard Warman was responsible for the notorious Cools posting.

Another mistake can be found in his testimony of February 7, 2007 (T1073/5405, p. 1638-9), which you can see to the right. The problem? Rogers hadn't offered cable service in BC since 2000. The chair's question seems to imply that he knows better and gave Klatt the opportunity to extract himself from an obvious error. Still, Klatt is adamant.

(And in case you might think that this was a temporary slip he repeated the error at p. 1723, lines 3-5.)

Again, this is simply wrong. By the time of Klatt's testimony, Rogers had not been in British Columbia for seven years. Shouldn't an expert know things like this?

Other posts in the Klatt's clunkers series:

buckets · at 4/20/2008 08:06:00 pm

Commenter "freemarkets" discovered an important fact when he pointed out (here) that the notorious Cools post was made by someone using RealPlayer, which has a built-in browser. As it turns out, it was RealOne Player, version 2 (see here). Here is a screen shot in which I use this version of RealOne Player (downloaded from oldversion.com) to go the site useragentstring.com:

The tell-tale sign is the string "R1 1.3" at the end, which signals this specific version of the RealOne player.

Another noteworthy fact, however, is "MSIE 6.0" earlier in the sting. This stands for Microsoft Internet Explorer 6.0. Explorer wasn't open when I took this screen capture, but these details are reported anyway. Why? As it turns out, although the RealOne browser seems perfectly adequate as a browser, it was not completely independent technologically, but depended on Internet Explorer for some of its functionality. In Jan. 2002 someone had complained to Real, Inc., that his RealOne browser wouldn't work after he had removed Internet Explorer from his system. Here is the answer he received from Real (which he then shared with the world through google groups):

"Please note that it is necessary to install MSIE 5.0x (Internet Explorer) or higher versions of the browser installed on your system for the RealOne Player to function properly. RealOne Player uses some components of Internet Explorer browser. I suggest you install Internet Explorer browser on your computer, then install RealOne Player again on your computer to resolve the problem. Please visit the Microsoft's web site (http://www.microsoft.com) to download the latest version of the MSIE browser."

So, Explorer is needed to run RealOne.

It is probably for this reason that whenever RealOne visited a site, its user agent communicated not only its own details in its user agent string, but also details about the version of Internet Explorer on the host computer. A long list of user agent strings in which we find some version of the RealOne Player can be at botsvsbrowsers.com.

But more can be said about this. As we saw, 90sAREover's user-agent string read something like this: "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Rogers Hi-Speed Internet; (R1 1.3))". Just as above, "R1 1.3" refers to the RealOne Player, and MSIE 6.0 refers to the browser that the RealOne used to help it surf the net. But this wasn't just any version of that browser, but one customized by Rogers and distributed to its customers: hence the "Rogers Hi-Speed Internet" tag (here).

The user agent string from Warman's visit shows that he had no such set-up: his version of Explorer was un-customized, and as I've shown (here), this argues against identifying him as the 90sAREover poster.

buckets · at 4/20/2008 07:32:00 pm

When RealPlayer is used as a browser, the user-agent string left behind reveals not only the version that is used to visit a site, but also some details about the version of Internet Explorer that is resident on the surfer's computer.

We have already seen (here) that Microsoft allows customization of user-agent strings. I customized a version of Explorer by inserting "Buckets", surfed over to useragentstring.com, and took this screen shot:

Then I exited Explorer, rebooted, and visited the same site using the RealOne Player. Here is the screen shot:

Note that the change to the user agent string that I had made for Explorer (inserting 'Buckets') is still there, even though I'm using RealOne, not Explorer.

The presence of "Rogers Hi-speed Internet" in the user agent of 90sAREover, therefore, requires that his browser was one of those customized by Rogers, even if he wasn't using it to directly visit freedomsite.org.

buckets · at 4/15/2008 03:19:00 pm

Whenever you visit a site on the internet, you leave details behind about where you are coming from and information about your computer configuration. These details are included in your user-agent string. (For a tutorial to user-agent strings, see here.) As we have seen, the user-agent string of the Cools poster will have been this:

Rogers Hi-Speed Internet

; (R1 1.3)

I have already argued that the "R1 1.3" (blue) means that the Cools poster had Real Player (version 1.3) installed. Commenter "freemarkets", however, points out in the comments of that post that in order to register in a user string, Real Player must be running, which weakens its exculpatory value.

But what about the entry "Rogers Hi-Speed Internet" in red? Clearly it identifies the poster as a Rogers subscriber, but that cannot the whole story, since it is not found in the user agent string of all Rogers' customers. Indeed, most don't. Take, for example, the thirty or so visits the proxy 66.185.84.204 made to the site ArcticCircle.ca in 2002 and 2003 that I have presented here. The user-agent data is listed for these visits, but only four of them include "Rogers Hi-Speed Internet". The same impression arises from the logs here, where over 3000 visits from various Rogers IPs were recorded from mid-2002 to mid-2005, and fewer than 50 have "Rogers Hi-Speed Internet" in their user agent string.

So what is happening here? In fact, this designation is mostly about the browser being used. If you've ever seen a version of Internet Explorer dedicated to a specific company (Yahoo!, Rogers, Bell, etc.), you'll have encountered browser customization, a process Microsoft describes at length here. The relevant section:

Customization Examples for ICPs

To showcase your organization's information and services on the Internet, you might want to consider the following customization options:

Add links to your organization's Web sites. For example, if your organization is a radio station, you could add links to Web pages that highlight playlists and composers' biographies.

Update the browser with your organization's logo and appropriate graphics. You can add your organization's name to the title bar and your organization's logo seen in Windows Update Setup for Internet Explorer and Internet Tools. In addition, you can replace the browser logo with your organization's logo or other graphics.

Track information about your customized browser by using a user agent string, which is a string of characters that a Web browser sends when it visits an Internet site. The custom string that you append to the user agent string enables Web sites to compile statistics about how many of your customers are using your browser to view those sites.

Note especially the red. Custom versions of Explorer were typically signalled in the user agent string. And this is what Rogers did: create a customized version and distribute it their clients. It looked a little different, reminded their subscribers they were (joy!) Rogers' customers, set the default web-page to Rogers' site, etc. Also -- and this is the important point here -- this special customized edition of Rogers left its mark at every web-site they ever visited, with the "Rogers Hi-Speed Internet" tag in the user agent string.

Of course, not all Rogers customers used the special Rogers version. Indeed, the vast majority seem to have opted for the one that came with their machine, or that they downloaded themselves. This group -- who may have been over 90% of Rogers customers -- did not have the "Rogers Hi-Speed" tag in their user-agent string. (Indeed, as you can see here and here, the user agent string might continue even after a change of ISP -- it's about the browser being used, not the ISP.)

So, what does this have to do with our present inquiry?

We have already seen that the Cools-poster (90sAREover) had Real Player installed on his computer and (as "freemarkets points out) had it open when he visited freedomsite.org. We now also know that his visit was completed using a version of Internet Explorer that had been customized by Rogers.

And Richard Warman? His visit to freedomsite.org on Oct. 15, 2003 (a month after the Cools post) left the following log entry (the user agent is underlined in blue):

As you can see, Warman does not have the "Rogers Hi-Speed" tag in his user agent string, therefore he was not using a customized Rogers browser. This presents an obstacle to any attempt to identify Warman as the Cools-poster.

buckets · at 4/13/2008 10:17:00 pm

Whenever you visit an internet site, you leave certain details behind about your computer, including what browser you use. These details are called your user agent string; the widget to the right (produced by danasoft) uses your user agent string to give you your own private message. (To learn more, see here.)

We have seen (here),that the notorious Cools post was made on Sept. 5, 2003, by a computer with a user agent that will have looked like this:

Rogers Hi-Speed Internet; (R1 1.3)

As we saw in the last post the details in red here show that the Cools poster, had a computer running Windows 98 and had a version of Microsoft Exporer 6 that had been supplied by Rogers cable (hence the "Rogers"-part of what is in red). The computer also had Real Player (version 1.3) installed and used it to visit the site.

We also know that Warman visited freedomsite.org on October 15, 2003, leaving behind this log entry:

The user agent is underlined in blue. There is an important difference from the Cools poster. What is red in the Cools poster's user agent data is missing from Warman's. Warman, like many Rogers' customers, has no "Rogers Hi-Speed Internet" in his user agent (the version of Explorer on this machine was a generic one, not one supplied by Rogers: see here). Moreover, he did not use Real Player to visit the site (thus no "R1 1.3").*

But this means the user agent data is not identical. So, what do we have to prove Warman wrote the Cools post? An IP shared by almost a million people, and a computer that is differently configured. One might begin to manufacture scenarios in which Warman made both posts, but they're getting into lottery-like odds. At the very least, the forensics require that the posts were made from different machines.

*Note. Commenter "freemarkets" points out (surely correctly) that the Real Player had to be both installed and playing in order for it to register in the user string. See now here.

Edited and revised for clarity and accuracy.

For more commentary see this more recent post.

buckets · at 4/13/2008 09:18:00 pm

In the last post (here), we saw that Bernard Klatt, Lemire's expert witness in his ongoing CHRC hearing, revealed 90sAREover's user agent data to be this:

"Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Rogers Hi-Speed Internet; (R1 1.3))"Now, Klatt successfully identified the browser (Internet Explorer version 6.0) and Operating System (Windows 98). He was less successful in explaining the latter two items "Rogers Hi-Speed Internet; (R1 1.3))".

Apparently he didn't know User Agent String, a handy-dandy site that takes any user-agent and breaks it up into nice understandable parts. Entering our string yields the following table

Internet Explorer 6.0
Mozilla	It's a Mozilla based browser
4.0	Mozilla Version
compatible	Compatibility flag Indicates that this browser is compatible with a common set of features
MSIE 6.0	Name : MSIE 6.0 Version = 6.0
Windows 98	OS-or-CPU : Windows 98
Rogers Hi-Speed Internet	Rogers Communications Internet provider. Partnered with Yahoo! to offer Rogers-Yahoo! Hi-Speed Internet.
R1 1.3	Using Real Player as a browser
All Internet Explorer user agent strings

Now, especially to be noted is how wide of the mark is Klatt's explanation of R1 1.3. His explanation (p. 1634):

This is clearly wrong, as the useragent.com search shows. "R1 1.3" does not refer to Cisco firmware, but to the fact that the user of this computer had a Real Player installed.

The "Rogers Hi-Speed Internet" is less clear. Not all Rogers' users have it. In the thirty visits from a dozen or so users of 66.185.84.204 here, only a couple have it. (To judge from this, the Rogers-tag here means that the version of Explorer being used was one supplied by Rogers, not a generic version.)

More shortly.

Update. Commenter "freemarkets" points out that the Real Player only shows up in the string if it is being used, not installed.

Clarifications to Rogers Hi-Speed made; quote from Klatt on R113 added.

buckets · at 4/13/2008 04:40:00 pm

Here are pages 1633-5 of Richard Warman and the Canadian Human Rights Tribunal v. Marc Lemire (T1073/5405 vol. 9) of Feb. 8, 2007. In it, Lemire's expert witness, Bernard Klatt, is testifying about the logs of Lemire's site, and trying to make the case that "90sAREover" was identical to "lucy" (a username of Richard Warman).

In the following passage, Klatt describes a few of the log-entries. He has already pointed out that "90sAREover" and "lucy" share the same IP: 66.185.84.204, but as we've seen elsewhere, this does not prove they were identical: that IP is a proxy shared by hundreds of thousands of Rogers' customers. Below Klatt describes other facts found in the entry:

p. 1633

p. 1634

p. 1635

Now, to judge from Klatt's remarks here, the log entry, which will have ended with user-agent data, must have looked something like this:

"Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Rogers Hi-Speed Internet; (R1 1.3))"This is something that we have paralleled in weblogs elsewhere. This exact same configuration can be found in this log of June 4, 2004, of the Engineering School at the University of Illinois. The date of that log rather spoils Klatt's theory that this is a firmware update from Cisco. There is a better explanation that we'll return to in the next post.

Update As you can see from the actual logs (which can be perused in my post on the Klatt affidavit in Warman v. Lemire), the conclusion reached above is correct and 90sAREover's user agent string was follows: "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Rogers Hi-Speed Internet; (R1 1.3))". Since this is different from the set-up used by Warman in October and November, the posts were made from different computers.

buckets · at 4/12/2008 09:29:00 pm

This is a bad sign:

(For the context, see here and here.)

buckets · at 4/09/2008 11:26:00 pm

There is an interesting article in the networking magazine Network Computing of 1999 about Rogers' plans for the next few years. Concerned about the challenges that expected increases in traffic would bring, together with the expectation that e-commerce would become more important (making it all the more important that the traffic got through expeditiously), Rogers developed load-balancing technology to prevent server overload. Some selected quotes:

Ten Alteon Networks ACEswitch 180 server switches balance the traffic flows among Rogers' five Web and cache servers, as well as its VPN and firewall servers. The Gigabit Ethernet server switches redirect traffic when one server goes down or gets jammed with HTTP traffic. The switches also route and handle the packet filtering for Rogers' firewalls, and all of Rogers' servers are connected via Gigabit Ethernet. ………

When a user requests Internet access, the switch directs that request to a proxy server. "It's load-sharing among cache proxies, and if they all aren't available, it then redirects the traffic to the Internet," rather than to the proxy server, Howell says.This seems to be the explanation for the shifting IPs that we noticed earlier. Those shifts are taking place among various proxy servers.

buckets · at 4/07/2008 10:02:00 pm

As we have seen, wc09.mtnk.rnc.net.cable.rogers.com (=66.185.84.204), which has recently been at the central of controversy, is one of Rogers' web-caching proxy servers. These proxies are named with the prefix wc~ (for 'web caching'), a number, and a geographical reference.

So far, we have seen 14 proxies with the mtnk designation, and 14 with a wlfdle bank. Given the pattern, it only took a moment to identify a third bank of proxies, again 14 in number, this time with the abbreviation ym. This brings the number of identified proxy servers to 42, which are:

IP	hostname	IP	hostname	IP	hostname
66.185.84.68	wc01.wlfdle.~	66.185.84.196	wc01.mtnk.~	66.185.85.68	wc01.ym.~
66.185.84.69	wc02.wlfdle.~	66.185.84.197	wc02.mtnk.~	66.185.85.69	wc02.ym.~
66.185.84.70	wc03.wlfdle.~	66.185.84.198	wc03.mtnk.~	66.185.85.70	wc03.ym.~
66.185.84.71	wc04.wlfdle.~	66.185.84.199	wc04.mtnk.~	66.185.85.71	wc04.ym.~
66.185.84.72	wc05.wlfdle.~	66.185.84.200	wc05.mtnk.~	66.185.85.72	wc05.ym.~
66.185.84.73	wc06.wlfdle.~	66.185.84.201	wc06.mtnk.~	66.185.85.73	wc06.ym.~
66.185.84.74	wc07.wlfdle.~	66.185.84.202	wc07.mtnk.~	66.185.85.74	wc07.ym.~
66.185.84.75	wc08.wlfdle.~	66.185.84.203	wc08.mtnk.~	66.185.85.75	wc08.ym.~
66.185.84.76	wc09.wlfdle.~	66.185.84.204	wc09.mtnk.~	66.185.85.76	wc09.ym.~
66.185.84.77	wc10.wlfdle.~	66.185.84.205	wc10.mtnk.~	66.185.85.77	wc10.ym.~
66.185.84.78	wc11.wlfdle.~	66.185.84.206	wc11.mtnk.~	66.185.85.78	wc11.ym.~
66.185.84.79	wc12.wlfdle.~	66.185.84.207	wc12.mtnk.~	66.185.85.79	wc12.ym.~
66.185.84.80	wc13.wlfdle.~	66.185.84.208	wc13.mtnk.~	66.185.85.80	wc13.ym.~
66.185.84.81	wc14.wlfdle.~	66.185.84.209	wc14.mtnk.~	66.185.85.81	wc14.ym.~

Update. According to this, mtnk abbreviates "Newkirk"; wlfdle, "Wolfedale"; and ym, "York Mills".

Update 2. Presumably these are located at the Rogers offices at these addresses:

3573 Wolfedale Rd, Mississauga
855 York Mills Rd, North York
244 Newkirk Road, Richmond Hill

buckets · at 4/07/2008 08:15:00 pm

We have seen that 66.185.84.204 = wc09.mtnk.rnc.net.cable.rogers.com was functioning as a proxy in 2003 (here and here and here and here and here and here and here). What does this mean that it was a proxy?

Rogers itself once explained this in its FAQ. That FAQ has since disappeared, but it was quoted in full on the site of the Residential Broadbant Users Association (here; an archived version from Sept. 2003 can be seen here).

The Rogers FAQ defines a proxy and describes how it is used:

The proxy is a local HTTP (web) server internal to a regional/main data center, which caches (stores) frequently requested content. It was originally implemented in order to greatly reduce unnecessary network traffic, particularly backbone traffic leading to the @Home Network in the US. When you want to access a website via your proxy, you send a request to your proxy, which then checks to see if any of the related content is stored locally. If it isn't, the proxy will access the remote server and send back the information you originally requested. The new information is then cached on the proxy for a predetermined period of time.

Note that the Rogers FAQ actually tells us that accessing a site through a proxy will send the proxy to the site. Any logs at the site will capture the proxy's IP. This is presumably why so much traffic can be identified for these years (see here and here and here) -- because 66.185.84.204 is forwarding numerous users. Also note that its job is to act as a web cache — indeed, as I conclude here, this is what the "wc" in wc09.mtnk.rnc.net.cable.rogers.com stands for.

buckets · at 4/07/2008 02:59:00 pm

In this log entry from November 8, 2003, we see 66.185.84.204 proxying for 63.138.242.220:

And here (from December, 2003), we see it proxying for 24.102.22.213:

buckets · at 4/07/2008 02:55:00 pm

We have seen that in 2003 and 2004, 66.185.84.204 was a Roger proxy server, that forwarded traffic for Rogers customers to a variety of site (see here and here and here). Indeed, we have been able to identify the forwarded IPs of some of these:

on Oct. 14, 2003, 66.185.84.204 forwarded traffic to a page of funny quotations for 63.139.207.87 (here);
on Oct. 18, 2003, it forwarded to traffic for 24.157.32.153 to a page for an open-source engine for real-time strategy games (here);
at sometime in May, 2004, this proxy forwarded traffic for 24.150.44.231 (here);

Here is another excerpt from a visitor log from June 2003:

In this case, 66.185.84.204 is forwarding traffic for 24.192.3.164. And in another log from July of 2003, traffic is forwarded for 24.112.104.245:

The same IP's traffic was forwarded by the same proxy in August (here):

buckets · at 4/06/2008 09:36:00 pm

The IP 66.185.84.204 visited many websites in 2003, as evidenced by the many logs in which it can be found (e.g., here for October of that year). We have already seen (here and here) that this IP was used as a web proxy by Rogers in 2003 -- indeed it is even possible to identify some of the individual IPs that it forwarded traffic for (here).

An interesting visitors log from October 2003 can be seen here. In it are three interesting entries:

In each of the entries, there are two IPs. In the first, the two IPs are identical, as is the case when there is no proxying at issue. (See here.) In the second and third, our old friend wc09.mtnk.rnc.net.cable.rogers.com = 66.185.84.204 appears, again, as a proxy, now for 63.139.207.87 and 24.157.32.153, respectively.

(That the IP appears as a proxy in October 2003, a month at the center of controversy about the use of this IP in the autumn of 2003 is especially important.)

buckets · at 4/06/2008 03:03:00 pm

To the right is a screencap of a truehits log from Feb. 2, 2003 (on which, see here and here). This gives the Proxy's IP, name, and software version (first column), that it is set to forward the IP of the computer that it is proxying for (second column), and the number of hits that it forwarded (third column), which in this case was 82 (see the red arrow).

The truehit logs also report their top visitors, as you can see to the right. The fourth largest visitor of the day was from a Rogers netblock, and it also 82 hits (see the red arrow).

It seems obvious and inevitable that these two entries are to be taken together, and that the 82 hits that 66.185.84.204 had forwarded came from a single IP, 24.157.249.116.

Now, this IP is no longer part of a Rogers block (see here, for example). But a few years ago it seems to have been based in West Toronto. For reasons that we don't need to go into, "arfer" posted to a broad-band discussion boarded a long list (over three thousand items!) of the Rogers blocks that he could find (see here). About half-way down his list is this entry:

Rogers Cable Inc. Hnsn ON-ROG-10-HNSN-7 (NET-24-157-249-0-1) 24.157.249.0 - 24.157.249.255

HNSN, according to this, abbreviates Hanson and is in the western GTA. (Presumably this is the location of some equipment; perhaps Hanson Road in Mississauga?)

In a nutshell what does this mean? Not much, except that in February 2003, a computer in Mississauga with the IP 24.157.249.116 visited a site in Thailand; on its way there, however, its traffic was channeled by Rogers through one of its proxy servers, 66.185.84.204. Both the proxy and the individual IP was logged.

Update. An out-of-date database of whois-information, here, produces this:

TARGET: 24.157.249.116
NAME: ON-ROG-10-3HNSN-1
NUMBER: 24.157.249.0 - 24.157.249.255
CITY: TORONTO
STATE: ONTARIO
COUNTRY: CA
LAT: 43.70
LONG: -79.42
LAT_LONG_GRAN: City
LAST_UPDATED: 18-Apr-2001
NIC: ARIN
LOOKUP_TYPE: Block Allocation
RATING:
DOMAIN_GUESS: rogers.home.net
STATUS: OK

The block-name is slightly different, but the location is the same.

buckets · at 4/06/2008 11:23:00 am

Update. As you can see here, the reason that there are so many posts from such a variety of individuals through this IP is because it was one of Rogers' proxy servers and therefore forwarded internet traffic for hundreds of thousands of users.

I had created a list of places where we can see 66.185.84.204 (or its host-name equivalent, wc09.mtnk.rnc.net.cable.rogers.com) being used in 2003 here, and have been adding to it as I found new examples. That list has now grown a little unwieldy, so I am replacing it with several shorter lists (indexed at the bottom). Here is a list of attested used in September, 2003, which I divide into two lists. The first list is examples of the IP (or host-name equivalent) appearing in monthly visitor logs, which only allow us to conclude that the visit had taken place sometime during the month. The second list are cases where we know the specific date.

during Sept. 2003 this IP visited www.ess.uci.edu;
during Sept. 2003 wc09.mtnk.rnc.net.cable.rogers.com (=66.185.84.204) visited a metalloprotein database at the Scripps Research Institute;
during Sept. 2003 this IP visited the site of Sébastien Delayahe, a French programmer;
during Sept. 2003 this IP visited the site of the Tyendinaga Mohawk First Nation 30 times;
during Sept. 2003 wc09.wtnk.etc visited metalsoft.com;
during Sept. 2003 wc09.wtnk.etc visited insurgentcountry.com;
during Sept. 2003 wc09.wtnk.etc visited webticino.ch;
during Sept. 2003 wc09.wtnk.etc visited bards.ca;
during Sept. 2003 wc09.wtnk.etc visited visualriddle.com;
during Sept. 2003 wc09.wtnk.etc visited the site of a Vietnamese church in Ottawa;
during Sept. 2003 wc09.wtnk.etc visited the blog, World in Progress;
during Sept. 2003 wc09.wtnk.etc visited a blog;
during Sept. 2003 this IP visited the site of Soldatna, Alaska;

With specific date

on Sept. 1, 2003, "blah" used this IP to post an inquiry about a Half-life CDKey;
on Sept. 3, 2003, wc09.wtnk.etc (=66.185.84.204) visited wireworld.com;
on Sept. 4, 2003, "alon" used this IP to post an inquiry about air rifle dealers in Ontario;
on Sept. 5, 2003, "fake Chris" used this IP to post to a message board;
on Sept. 5, 2oo3, at 19:55, "90sAREover" used this IP when he posted a racist denunciation of Senator Cools;
on Sept. 6, 2003, wc09.wnk.etc visited StarWarsCampers.com;
on Sept. 8, 2003, "fake jeff" responded to "fake Chris" (see above);
on Sept. 8, 2003, "GP" used this IP when he posted a notice to sell a 55 gallon drum of racing fuel in Toronto;
on Sept. 8, 2003, "Gump" used this IP to post to a message board;
on Sept. 8 and 9, 2003, "Scott Taylor" used this IP to post twice to a message board for the International Plastic Modelers' Society in London, Ont.
on Sept. 10, 2003, "quyen" used this IP to post to a Vietnamese (?) message board in Vietnamese (?);
on Sept. 11, 2003, "christian" used this IP to try to sell goalie equipment;
on Sept. 16, 2003, "thAmaraipu" used wc09.wtnk.etc (=66.185.84.204) to post to a Tamil board;
on Sept. 18, 2003, "quyen" used this IP to post to a Vietnamese (?) board in Vietnamese (?);
on Sept. 20, 2003, wc09.wtnk.etc visited a UK site dedicated to UFOs using MSIE 5.5, Windows 98, Win 98 4.90;
on Sept. 20, 2003, "Steven Milstone-Turner" posted twice to a discussion board;
on Sept. 20-21, 2003, "quyen" again posted to a Vietnamese (?) discussion board in Vietnamese (?) (see above under Sept. 10);
on Sept. 23, 2003, "cdnenya" used this IP when she posted at Groomers BBS (she posted again on the same day with the same IP);
on Sept. 23, 2003, wc09.wtnk.etc visited StarwarsCampers.com;
on Sept. 23, 2003, "Anonymous" used this IP to post to a message board on 3D Racing Mania;
on Sept. 24, 2003, this IP visited "Mom's talk" at ChildrenToday.com;
on Sept. 25, 2003, this IP visited the homepage of a computer science prof. at the U. of Alberta;
on Sept. 25, 2003, "webmaster" used this IP to post to a soccer discussion board;
on Sept. 28, 2003, "cdnenya" used this IP to post again at Groomers BBS;
on Sept. 28, 2003, "andi" used this IP to post twice to an NHL rumour board;
on Sept. 28, 2003, "Scott Taylor" used this IP to post to a modellers discussion board;
on Sept. 28, 2003, this IP visited scottsonline;
on Sept. 30, 2003, wc09.wtnk.etc (=66.185.84.204) visited wireworld.com.

buckets · at 4/06/2008 11:13:00 am

Update. As you can see here, the reason that there are so many posts from such a variety of individuals through this IP is because it was one of Rogers' proxy servers and therefore forwarded internet traffic for hundreds of thousands of users.

I had created a list of places where we can see 66.185.84.204 (or its host-name equivalent, wc09.mtnk.rnc.net.cable.rogers.com) being used in 2003 here, and have been adding to it as I found new examples. That list has now grown a little unwieldy, so I am replacing it with several shorter lists (indexed at the bottom). Here is a list of attested users in October, 2003, which I divide into two lists. The first list is examples of the IP (or host-name equivalent) appearing in monthly visitor logs, which only allow us to conclude that the visit had taken place sometime during the month. The second list are cases where we know the specific date.

between Sept. 24 and Oct. 23, 2003 this IP consulted manotick.net (a local business directory serving South Ottawa) 132 times;
during Oct. 2003, this IP visited the site of a Florida chapter of the Society for Creative Anachronism;
during Oct. 2003, wc09.etc (=66.185.84.204) visited pogopus.com;
during Oct. 2003 this IP visited www.ess.uci.edu;
during Oct. 2003 wc09.etc visited insurgentcountry.com;
during Oct. 2003 wco9.etc visited webticino.ch;
during Oct. 2003 wc09.etc visited a Danish site;
during Oct. 2003 wc09.etc visited the website of a Vietnamese church in Ottawa;
during Oct. 2003 wc09.etc visited the site of a commercial real estate broker;
during Oct. 2003 wc09.etc visited idenise.net;
during Oct. 2003 wc09.etc visited the webpage of a Danish musician;
during Oct. 2003 wc09.etc visited the site of Anne Owens, an illustrator;
during Oct. 2003 wc09.etc visited a Slovakian comics site;
during Oct. 2003 wc09.etc visited concretefloors.ca;
during Oct. 2003 wc09.etc visited the site of the Wellington (NZ) Indian Association;

With specific date:

on Oct. 1, 2003, "andi" used this IP to post to an NHL forum;
on Oct. 2, 2003, "hullbob" used this IP to post to the Cape Breton Screaming Eagles message board;
on Oct. 3, 2003, "Scott Taylor" used this IP to post to board related to the London Plastic Modelling Association;
on Oct. 3, 2003, this IP visited the site of Colorado Christian University;
on Oct. 4, 2003, "Dean" used this IP to post to a the Cape Breton Screaming Eagles message board (see above);
on Oct. 5, 2003, "krivraq" used this IP when he asked a goalies' forum how to keep a mask from rusting;
on Oct. 8, 2003, "coco_fever" used this IP to post to an NHL forum;
on Oct. 10, 2003, this IP posted to a discussion board on the OHL;
on Oct. 10, 2003, "Scott Taylor" used this IP to post to message board on modelling;
on Oct. 12, 2003, "Scott Taylor" again used this IP to post on modelling;
on Oct. 13, 2003, "doug" used this IP to post a message seeking a Roddy Piper doll;
on Oct. 14, 2003, this IP was a proxy for 63.139.207.87 (see discussion here);
on Oct. 15, 2003, at 20:46, this IP visited freedomsite.org;
on Oct. 18, 2003, "doug" again expressed his interest in a Roddy Piper doll (see Oct. 13);
on Oct. 18, 2003, this IP was a proxy for 24.157.32.153 (see discussion here);
on Oct. 19, 2003, "tahnie" used this IP to post to Groomers BBS;
on Oct. 20, 2003, "Gary Donaldson" used this IP to wish Paul a happy birthday;
on Oct. 22, 2003, wc09.etc visited the website of a Houston medical school;
on Oct. 24, 2003, someone used this IP to post to a board concerning women's hockey;
on Oct. 25, 2003, "Scott Taylor" used this IP to post again on modelling (see above under Oct. 10);
on Oct. 26, 2003, "SELLIAH" used this IP to praise a Tamil poet;
on Oct. 26, 2003, wc09.etc (=66.185.84.204) visited wireworld.com

buckets · at 4/06/2008 11:03:00 am

Update. As you can see here, the reason that there are so many posts from such a variety of individuals through this IP is because it was one of Rogers' proxy servers and therefore forwarded internet traffic for hundreds of thousands of users.

I had created a list of occasions where we can see 66.185.84.204 (or its host-name equivalent, wc09.mtnk.rnc.net.cable.rogers.com) being used in 2003 here, and have been adding to it as I found new examples. That list has now grown a little unwieldy, so I am replacing it with several shorter lists (indexed at the bottom). Here is a list of attested users in November, 2003, which I divide into two lists. The first list is examples of the IP (or host-name equivalent) appearing in monthly visitor logs, which only allow us to conclude that the visit had taken place sometime during the month. The second list are cases where we know the specific date.

during Nov. 2003 this IP visited www.ess.uci.edu;
during Nov. 2003 wc09.mtnk.rnc.net.cable.rogers.com (=66.185.84.204) visited insurgentcountry.com
during Nov. 2003 wc09.mtnk.etc visited sniggle.net;
during Nov. 2003, wc09.mtnk.etc visited the Internet Society of Wallonia;
during Nov. 2003, this IP visited www.ess.uci.edu;
during Nov. 2003 wc09.etc visited www.professionalcameras.co.uk;
during Nov. 2003, wc09.mtnk.etc visited the Metalloprotein Database and Browser at the Scripps Research Institute;
during Nov. 2003, wc09.mtnk.etc visited allportgroup.com;
during Nov. 2003 wc09.mtnk.etc visited michaelcoren.com;
during Nov. 2003 wc09.mtnk.etc visited starling.ws;
during Nov. 2003 wc09.mtnk.etc visited webtichino.ch;
during Nov. 2003 wc09.mtnk.etc visited the website of a Vietnamese church in Ottawa;
during Nov. 2003 wc09.mtnk.etc visited idenise.net;
during Nov. 2003 wc09.mtnk.etc visited www.deafrochester.com;
during Nov. 2003 wc09.mtnk.etc visited www.fakepope.com;
during Nov. 2003 wc09.mtnk.etc visited a fansite dedicated to the band Rasputina;
during Nov. 2003 wc09.mtnk.etc visited the site of a Boy Scouts of America council in central Illinois;
during Nov. 2003 wc09.mtnk.etc visited the site of Anne Owens, an illustrator;
during Nov. 2003 wc09.mtnk.etc visited the allportgroup.com;
during Nov. 2003 wc09.mtnk.etc visited dolls-devotion.com;
during Nov. 2003 wc09.mtnk.etc visited the site of a Catholic school in Switzerland;

With specific date:

on Nov. 1, 2003, "anandan" used wc09.mtnk.rnc.net.cable.rogers.com (=66.185.84.204) posted to a Tamil discussion board;
on Nov. 2, 2003, wc09.mtnk.etc visited the site of an engineering lab at the University of Tennessee Chatanooga;
Nov. 4, 2003, "SELLA" posted to discussion board "Historical Novels: Ponniyin Selvan vs Kadal Pura" using wc09.mtnk.etc;
Nov. 5, 2003, "flaming poultice" posted to a discussion board;
Nov. 6, 2003, "littlelilac" posted to a Gary Oldman discussion board;
on Nov. 10, 2003, "Sella" used wc09.mtnk.etc to tell a joke;
on Nov. 11, 2003, at 13:58, "lucy" allegedly used this IP to log-in at freedomsite.org;
on Nov. 11, 2003, "caper" used this IP to post to Groomers BBS;
on Nov. 12, 2003 "barb" used this IP to inquire about a florida vacation;
on Nov. 12, 2003, "cafe" used this IP to post on Seiko watches;
on Nov. 15, 2003, at 13:57, "lucy" allegedly used this IP to log into freedomsite.org;
on Nov. 16, 2003, "Lyndsay" used this IP to post to an NHL discussion board;
on Nov. 17, 2003, "maaran" used this IP to post a list of his favorite Tamil songs to a message board;
on Nov. 18, 2003, this IP visited a computer science student's site at the University of Alberta on a famous mathematical problem;
on Nov. 18, 2003, "Christine" used wc09.mtnk.etc to post to a message board in an attempt to find ring-tones for her phone;
on Nov. 19, 2003, "INDIA ROX" used wc09.mtnk.etc. to post on Indian cricket;
on Nov. 19, 2003, "executive" used this IP to post to a message board on height;
on Nov. 20, 2003, "Nelson Gross" was using this IP when he signed the online guestbook of Leisure Island;
on Nov. 21, 2003, this IP visited a computer science student's site at the University of Alberta on a famous mathematical problem;
on Nov. 23, 2003, at 11:23, "lucy" allegedly used this IP to visit freedomsite.org;
on Nov. 23, 2003, "Anonymous" used this IP to post to a message board called Dundalk Talk;
on Nov. 23, 2003, "tomcat2004" used this IP to post to a message board on Lacrosse;
on Nov. 26, 2003, "Anandi" used wc09.mtnk.etc (=66.185.84.204) to post to a Tamil message board;
on Nov. 26, 2003, this IP visited Scottsonline;
on Nov. 27, 2003, "Paul" used this IP to post to a videogame board;
on Nov. 28, 2003, "vasanthi" posted to a discussion board on "old tamil film songs" as wc09.mtnk.etc.; on the same day he posted on carnatic music;
on Nov. 28, 2003, 21:31 wc09.etc. visited www.sowter.co.uk.

Bouquets of Gray

Tuesday, May 06, 2008

Klatt's Clunkers 8: Bernard Klatt comes close

Monday, May 05, 2008

Klatt's Clunkers 7: Bernard Klatt doesn't understand Rogers web caching

Klatt's clunkers 6: Bernard Klatt on Rogers service in BC

Sunday, April 20, 2008

90sAREover's browser: RealOne with customized Explorer

experimenting with RealOne and Explorer's customization options

Tuesday, April 15, 2008

Why Warman is probably innocent, part 2: Rogers Hi-Speed Internet

Sunday, April 13, 2008

Why Warman is probably innocent

What does "R1 1.3" mean in a user agent?

Klatt on 90sAREover's user agent

Saturday, April 12, 2008

What to look for when recruiting an expert witness

Wednesday, April 09, 2008

Load-balancing at Rogers

Monday, April 07, 2008

How many proxies does Rogers have?

proxy servers 9: what Rogers said about their own proxying

proxy servers 8: yet another two underlying IPs

proxy servers 7: still two more underlying IPs

Sunday, April 06, 2008

Proxy servers 6: two more underlying IPs

Proxy servers 5: an underlying IP

Who else used 66.185.84.204 in September 2003?

Who else used 66.185.84.204 in October 2003?

Who else used 66.185.84.204 in November 2003?

Noteworthy posts

Worth Reading

Blog Archive