Bouquets of Gray

buckets · at 4/07/2008 02:59:00 pm

In this log entry from November 8, 2003, we see 66.185.84.204 proxying for 63.138.242.220:

And here (from December, 2003), we see it proxying for 24.102.22.213:

buckets · at 4/07/2008 02:55:00 pm

We have seen that in 2003 and 2004, 66.185.84.204 was a Roger proxy server, that forwarded traffic for Rogers customers to a variety of site (see here and here and here). Indeed, we have been able to identify the forwarded IPs of some of these:

on Oct. 14, 2003, 66.185.84.204 forwarded traffic to a page of funny quotations for 63.139.207.87 (here);
on Oct. 18, 2003, it forwarded to traffic for 24.157.32.153 to a page for an open-source engine for real-time strategy games (here);
at sometime in May, 2004, this proxy forwarded traffic for 24.150.44.231 (here);

Here is another excerpt from a visitor log from June 2003:

In this case, 66.185.84.204 is forwarding traffic for 24.192.3.164. And in another log from July of 2003, traffic is forwarded for 24.112.104.245:

The same IP's traffic was forwarded by the same proxy in August (here):

buckets · at 4/06/2008 09:36:00 pm

The IP 66.185.84.204 visited many websites in 2003, as evidenced by the many logs in which it can be found (e.g., here for October of that year). We have already seen (here and here) that this IP was used as a web proxy by Rogers in 2003 -- indeed it is even possible to identify some of the individual IPs that it forwarded traffic for (here).

An interesting visitors log from October 2003 can be seen here. In it are three interesting entries:

In each of the entries, there are two IPs. In the first, the two IPs are identical, as is the case when there is no proxying at issue. (See here.) In the second and third, our old friend wc09.mtnk.rnc.net.cable.rogers.com = 66.185.84.204 appears, again, as a proxy, now for 63.139.207.87 and 24.157.32.153, respectively.

(That the IP appears as a proxy in October 2003, a month at the center of controversy about the use of this IP in the autumn of 2003 is especially important.)

buckets · at 4/06/2008 03:03:00 pm

To the right is a screencap of a truehits log from Feb. 2, 2003 (on which, see here and here). This gives the Proxy's IP, name, and software version (first column), that it is set to forward the IP of the computer that it is proxying for (second column), and the number of hits that it forwarded (third column), which in this case was 82 (see the red arrow).

The truehit logs also report their top visitors, as you can see to the right. The fourth largest visitor of the day was from a Rogers netblock, and it also 82 hits (see the red arrow).

It seems obvious and inevitable that these two entries are to be taken together, and that the 82 hits that 66.185.84.204 had forwarded came from a single IP, 24.157.249.116.

Now, this IP is no longer part of a Rogers block (see here, for example). But a few years ago it seems to have been based in West Toronto. For reasons that we don't need to go into, "arfer" posted to a broad-band discussion boarded a long list (over three thousand items!) of the Rogers blocks that he could find (see here). About half-way down his list is this entry:

Rogers Cable Inc. Hnsn ON-ROG-10-HNSN-7 (NET-24-157-249-0-1) 24.157.249.0 - 24.157.249.255

HNSN, according to this, abbreviates Hanson and is in the western GTA. (Presumably this is the location of some equipment; perhaps Hanson Road in Mississauga?)

In a nutshell what does this mean? Not much, except that in February 2003, a computer in Mississauga with the IP 24.157.249.116 visited a site in Thailand; on its way there, however, its traffic was channeled by Rogers through one of its proxy servers, 66.185.84.204. Both the proxy and the individual IP was logged.

Update. An out-of-date database of whois-information, here, produces this:

TARGET: 24.157.249.116
NAME: ON-ROG-10-3HNSN-1
NUMBER: 24.157.249.0 - 24.157.249.255
CITY: TORONTO
STATE: ONTARIO
COUNTRY: CA
LAT: 43.70
LONG: -79.42
LAT_LONG_GRAN: City
LAST_UPDATED: 18-Apr-2001
NIC: ARIN
LOOKUP_TYPE: Block Allocation
RATING:
DOMAIN_GUESS: rogers.home.net
STATUS: OK

The block-name is slightly different, but the location is the same.

Bouquets of Gray

Monday, April 07, 2008

proxy servers 8: yet another two underlying IPs

proxy servers 7: still two more underlying IPs

Sunday, April 06, 2008

Proxy servers 6: two more underlying IPs

Proxy servers 5: an underlying IP

Noteworthy posts

Worth Reading

Blog Archive