Sunday, April 06, 2008

Who else used 66.185.84.204 in November 2003?

Update. As you can see here, the reason that there are so many posts from such a variety of individuals through this IP is because it was one of Rogers' proxy servers and therefore forwarded internet traffic for hundreds of thousands of users.

I had created a list of occasions where we can see 66.185.84.204 (or its host-name equivalent, wc09.mtnk.rnc.net.cable.rogers.com) being used in 2003 here, and have been adding to it as I found new examples. That list has now grown a little unwieldy, so I am replacing it with several shorter lists (indexed at the bottom). Here is a list of attested users in November, 2003, which I divide into two lists. The first list is examples of the IP (or host-name equivalent) appearing in monthly visitor logs, which only allow us to conclude that the visit had taken place sometime during the month. The second list are cases where we know the specific date.
  1. during Nov. 2003 this IP visited www.ess.uci.edu;
  2. during Nov. 2003 wc09.mtnk.rnc.net.cable.rogers.com (=66.185.84.204) visited insurgentcountry.com
  3. during Nov. 2003 wc09.mtnk.etc visited sniggle.net;
  4. during Nov. 2003, wc09.mtnk.etc visited the Internet Society of Wallonia;
  5. during Nov. 2003, this IP visited www.ess.uci.edu;
  6. during Nov. 2003 wc09.etc visited www.professionalcameras.co.uk;
  7. during Nov. 2003, wc09.mtnk.etc visited the Metalloprotein Database and Browser at the Scripps Research Institute;
  8. during Nov. 2003, wc09.mtnk.etc visited allportgroup.com;
  9. during Nov. 2003 wc09.mtnk.etc visited michaelcoren.com;
  10. during Nov. 2003 wc09.mtnk.etc visited starling.ws;
  11. during Nov. 2003 wc09.mtnk.etc visited webtichino.ch;
  12. during Nov. 2003 wc09.mtnk.etc visited the website of a Vietnamese church in Ottawa;
  13. during Nov. 2003 wc09.mtnk.etc visited idenise.net;
  14. during Nov. 2003 wc09.mtnk.etc visited www.deafrochester.com;
  15. during Nov. 2003 wc09.mtnk.etc visited www.fakepope.com;
  16. during Nov. 2003 wc09.mtnk.etc visited a fansite dedicated to the band Rasputina;
  17. during Nov. 2003 wc09.mtnk.etc visited the site of a Boy Scouts of America council in central Illinois;
  18. during Nov. 2003 wc09.mtnk.etc visited the site of Anne Owens, an illustrator;
  19. during Nov. 2003 wc09.mtnk.etc visited the allportgroup.com;
  20. during Nov. 2003 wc09.mtnk.etc visited dolls-devotion.com;
  21. during Nov. 2003 wc09.mtnk.etc visited the site of a Catholic school in Switzerland;
With specific date:
  1. on Nov. 1, 2003, "anandan" used wc09.mtnk.rnc.net.cable.rogers.com (=66.185.84.204) posted to a Tamil discussion board;
  2. on Nov. 2, 2003, wc09.mtnk.etc visited the site of an engineering lab at the University of Tennessee Chatanooga;
  3. Nov. 4, 2003, "SELLA" posted to discussion board "Historical Novels: Ponniyin Selvan vs Kadal Pura" using wc09.mtnk.etc;
  4. Nov. 5, 2003, "flaming poultice" posted to a discussion board;
  5. Nov. 6, 2003, "littlelilac" posted to a Gary Oldman discussion board;
  6. on Nov. 10, 2003, "Sella" used wc09.mtnk.etc to tell a joke;
  7. on Nov. 11, 2003, at 13:58, "lucy" allegedly used this IP to log-in at freedomsite.org;
  8. on Nov. 11, 2003, "caper" used this IP to post to Groomers BBS;
  9. on Nov. 12, 2003 "barb" used this IP to inquire about a florida vacation;
  10. on Nov. 12, 2003, "cafe" used this IP to post on Seiko watches;
  11. on Nov. 15, 2003, at 13:57, "lucy" allegedly used this IP to log into freedomsite.org;
  12. on Nov. 16, 2003, "Lyndsay" used this IP to post to an NHL discussion board;
  13. on Nov. 17, 2003, "maaran" used this IP to post a list of his favorite Tamil songs to a message board;
  14. on Nov. 18, 2003, this IP visited a computer science student's site at the University of Alberta on a famous mathematical problem;
  15. on Nov. 18, 2003, "Christine" used wc09.mtnk.etc to post to a message board in an attempt to find ring-tones for her phone;
  16. on Nov. 19, 2003, "INDIA ROX" used wc09.mtnk.etc. to post on Indian cricket;
  17. on Nov. 19, 2003, "executive" used this IP to post to a message board on height;
  18. on Nov. 20, 2003, "Nelson Gross" was using this IP when he signed the online guestbook of Leisure Island;
  19. on Nov. 21, 2003, this IP visited a computer science student's site at the University of Alberta on a famous mathematical problem;
  20. on Nov. 23, 2003, at 11:23, "lucy" allegedly used this IP to visit freedomsite.org;
  21. on Nov. 23, 2003, "Anonymous" used this IP to post to a message board called Dundalk Talk;
  22. on Nov. 23, 2003, "tomcat2004" used this IP to post to a message board on Lacrosse;
  23. on Nov. 26, 2003, "Anandi" used wc09.mtnk.etc (=66.185.84.204) to post to a Tamil message board;
  24. on Nov. 26, 2003, this IP visited Scottsonline;
  25. on Nov. 27, 2003, "Paul" used this IP to post to a videogame board;
  26. on Nov. 28, 2003, "vasanthi" posted to a discussion board on "old tamil film songs" as wc09.mtnk.etc.; on the same day he posted on carnatic music;
  27. on Nov. 28, 2003, 21:31 wc09.etc. visited www.sowter.co.uk.

    Other lists can be see here:
Posted by at No comments:
Labels: , ,

Who else used 66.185.84.204 in December 2003?

Update. As you can see here, the reason that there are so many posts from such a variety of individuals through this IP is because it was one of Rogers' proxy servers and therefore forwarded internet traffic for hundreds of thousands of users.

I had created a list of places where we can see 66.185.84.204 (or its host-name equivalent, wc09.mtnk.rnc.net.cable.rogers.com) being used in 2003 here, and have been adding to it as I found new examples. That list has now grown a little unwieldy, so I am replacing it with several shorter lists (indexed at the bottom). Here is a list of attested users in December, 2003, which I divide into two lists. The first list is examples of the IP (or host-name equivalent) appearing in monthly visitor logs, which only allow us to conclude that the visit had taken place sometime during the month. The second list are cases where we know the specific date.
  1. during Dec. 2003 this IP visited www.ess.uci.edu;
  2. during Dec. 2003 wc09.mtnk.rnc.net.cable.rogers.com (=66.185.84.204) visited www.vinko.com;
  3. during Dec. 2003 wc09.mtnk.etc visited amigazone.com;
  4. during Dec. 2003 wc09.mtnk.etc visited pogopus.com;
  5. during Dec. 2003 wc09.mtnk.etc visited linkingeverest.com;
  6. during Dec. 2003 wc09.mtnk.etc visited TxCETP on www.sci.tamucc.edu;
  7. during Dec. 2003 wc09.mtnk.etc visited skynet.ie;
  8. during Dec. 2003 this IP visited the site of a West Florida chapter of the Society for Creative Anachronism;
  9. during Dec. 2003 this IP visited visualriddle.com;
  10. during Dec. 2003 this IP visited the website of a Vietnamese church in Ottawa;
  11. during Dec. 2003 wc09.mtnk.etc visited www.istad.org;
  12. during Dec. 2003 wc09.mtnk.etc visited the petdirectory.us;
  13. during Dec. 2003 wc09.mtnk.etc visited as.ctkhi.com;
  14. during Dec. 2003 wc09.mtnk.etc visited a blog at benched42.net;
  15. during Dec. 2003 wc09.mtnk.etc visited http://kalliope.anitraweb.org;
  16. during Dec. 2003 wc09.mtnk.etc visited a holiday suites site from Vancouver island;
  17. during Dec. 2003 wc09.mtnk.etc visited a Korean (?) weblog;
Specific day known:
  1. on Dec. 2, 2003, "kovalan" used wc09.etc to post to a Tamil message board;
  2. on Dec. 3, 2003, "Paramesh" used wco9.etc to ask for cooking advice;
  3. on Dec. 9, 2003, this IP visited a computer science student's site at the University of Alberta on Post's Correspondence Problem;
  4. on Dec. 10, 2003 "debbie" posted to a Home Business Discussion Board using this IP;
  5. on Dec. 11, 2003, this IP visited a computer science student's site at the University of Alberta on a famous math problem;
  6. on Dec. 13, 2003, wc09.etc visited a German online philatelic shop;
  7. on Dec. 20, 2003, "Tulika Mehta" used wc09.etc to post on Indian classical music;
  8. on Dec. 24, 2003, "Sherman Sherwood" used wc09.etc to post to a discussion board on Ondachi's "Anils Ghost"

    Other lists can be see here:
Posted by at No comments:
Labels: , ,

Who else used 66.185.84.204 in early 2004?

I had created a list of places where we can see 66.185.84.204 (or its host-name equivalent, wc09.mtnk.rnc.net.cable.rogers.com) being used in 2003 here, and have been adding to it as I found new examples. That list has now grown a little unwieldy, so I am going to replace it with several shorter lists (indexed at the bottom). Here is a list of a few of the attested examples of this IP being used in the first few months of 2004. (This list is only a sampling of what I'd found and most new discoveries have not been added.)
    Other lists can be see here:
Posted by at No comments:
Labels: , ,

Who else used 66.185.84.204 in August 2003?

I had created a list of places where we can see 66.185.84.204 (or its host-name equivalent, wc09.mtnk.rnc.net.cable.rogers.com) being used in 2003 here, and have been adding to it as I found new examples. That list has now grown a little unwieldy, so I am replacing it with several shorter lists (indexed at the bottom). Here is a list of attested used in August, 2003:
  1. during Aug. 2003 this IP visited the Institute for Improvement in Quality and Productivity at the U. of Waterloo;
  2. during Aug. 2003 this IP visited insurgentcountry.com
  3. during Aug. 2003 wc09.mtnk.rnc.net.cable.rogers.com (=66.185.84.204) visited fluidhose.com;
  4. during Aug. 2003 wc09.etc (=66.185.84.204) visited yumfactory.com
  5. during Aug. 2003 wc09.etc. (=66.185.84.204) visited metalsoft.com;
  6. during Aug. 2003 this IP visited the webpage of O'Brien House, a Kingston B&B;

  1. on Aug. 3, 2003, wc09.etc (=66.185.84.204) visited wireworld.com;
  2. on Aug. 6, 2003, this IP visited the publications page of a U. of Alberta computer science prof.
  3. on Aug. 9, 2003, this IP visited the site of a Nevada software engineer;
  4. on Aug. 9, 2003, "kAdhali" used wc09.etc. (=66.185.84.204) to post a poem;
  5. on Aug. 11, 2003, "Jan" used this IP to post to a "Virtues of Harmony" discussion board;
  6. on Aug. 20, 2003 "tawa" used this IP to post to a soccer message board;
  7. on Aug. 23, 2003, "Paramkathir" used wc09.etc (=66.185.84.204) to post about detective novels.
  8. on Aug. 28, 2003, "quyen" used this IP to post to a Vietnamese (?) board in Vietnamese (?);
    Other lists can be see here:
Posted by at No comments:
Labels: , ,

Who else used 66.185.84.204 in early 2003?

I had created a list of places where we can see 66.185.84.204 being used in 2003 here, and have been adding to it as new examples.  That list has now grown a little unwieldy, so I am going to replace it with several shorter lists, of which this is the first.  Included are cases where 66.185.84.204 (or its host-name equivalent, wc09.mtnk.rnc.net.cable.rogers.com) has been found. This list runs from January 1 to the end of July, 2003:
    Other lists can be see here:
Posted by at No comments:
Labels: , ,

Saturday, April 05, 2008

proxy servers 4: someone notices their proxy (75)

At least one Rogers customer was surprised to learn that his system was being proxied. In xxx, "intrudah" wrote (here):
    i was playing on some gaming ladders (rainbow 6), and i was banned because it said my ip was used by another account.  i get this on the ip analyser:
      "Your IP (69.198.213.219) appears to be behind a web proxy server (66.185.84.75) and results shown might not be for your system."
    the admins think its because of the proxy.  any thoughts?
The discussion did not develop much from there.  But note that 66.185.84.75 is one of the IPs that we have been tracking, and here it proxies for 69.198.213.219, which at one time was part of a Rogers range (see here and here).  At least in this case, the Rogers customer did not even know he was behind a proxy.
Posted by at
Labels: , ,

Thursday, April 03, 2008

proxy servers 3: what one looks like in an error log

We have already seen that some of the IPs that we've been tracking are Rogers' proxy servers (see here and, especially, here).  Now that we know what to look for, it's not difficult to find confirmation of this.  One example can be seen Nukecops.com, a help-forum for php-nuke, a web-based news publishing and content-management system.  In May 2004, a user "tuxx" asked for advice and posts his error logs, which I want to quote two chunks of.  First, this (which I have added colour to; "tuxx" had replaced the name of his site with "sitename.com" for privacy):
    9993 admin65 /usr/bin/php UNIQUE_ID=usp-9EIxsZcAAGzF610AAABb HTTP_X_FORWARDED_FOR=24.150.44.231 SERVER_PORT=80 HTTP_HOST=sitename.com DOCUMENT_ROOT=/var/www/html SCRIPT_FILENAME=/var/www/html/index232.php REQUEST_URI=/index232.php SCRIPT_NAME=/index232.php HTTP_VIA=1.0 wc09 (NetCache NetApp/5.5R3) SCRIPT_URI=http://sitename.com/index232.php HTTP_CONNECTION=keep-alive PATH_INFO=/index232.php REMOTE_PORT=63754 PATH=/usr/local/bin:/usr/bin:/bin SCRIPT_URL=/index232.php PWD=/var/www/interpreters SERVER_ADMIN=email@sitename.com REDIRECT_STATUS=200 SITE_CGIROOT=/var/www/cgi-bin HTTP_ACCEPT_LANGUAGE=en PATH_TRANSLATED=/var/www/html/index232.php HTTP_ACCEPT=*/* SITE_HTMLROOT=/var/www/html REMOTE_ADDR=66.185.85.76 SHLVL=1 SERVER_NAME=www.sitename.com SERVER_SOFTWARE=Apache/2.0.48 (Fedora) QUERY_STRING= SITE_ROOT=/ SERVER_ADDR=66.49.180.189 GATEWAY_INTERFACE=CGI/1.1 SERVER_PROTOCOL=HTTP/1.1 REDIRECT_URL=/index232.php REQUEST_METHOD=GET _=/usr/bin/php
Here we see the tell-tale signs of a proxy. The "HTTP_VIA=1.0" shows that a proxy is being used, that it's name is "wc09", and that it using Net Appliances version 5.5R3. The "HTTP_X_FORWARDED_FOR" header shows the IP that the traffic is being fowarded for. And the "REMOTE_ADDR=" header introduced the IP of the proxy, in this case 66.185.85.76 (= wc09.ym.rnc.net.cable.rogers.com).  (For a quick tutorial, see here.)

In his search for help "tuxx" has included several other passages from his error logs including this:
    9787 admin65 /usr/bin/php UNIQUE_ID=uTVIYUIxsZcAAGx8VC4AAABQ HTTP_X_FORWARDED_FOR=24.150.44.231 SERVER_PORT=80 HTTP_HOST=sitename.com DOCUMENT_ROOT=/var/www/html SCRIPT_FILENAME=/var/www/html/index232.php REQUEST_URI=/index232.php SCRIPT_NAME=/index232.php HTTP_VIA=1.0 wc09 (NetCache NetApp/5.5R3) SCRIPT_URI=http://sitename.com/index232.php HTTP_CONNECTION=keep-alive PATH_INFO=/index232.php REMOTE_PORT=5350 PATH=/usr/local/bin:/usr/bin:/bin SCRIPT_URL=/index232.php PWD=/var/www/interpreters SERVER_ADMIN=email@sitename.com REDIRECT_STATUS=200 SITE_CGIROOT=/var/www/cgi-bin HTTP_ACCEPT_LANGUAGE=en PATH_TRANSLATED=/var/www/html/index232.php HTTP_ACCEPT=*/* SITE_HTMLROOT=/var/www/html REMOTE_ADDR=66.185.84.204 SHLVL=1 SERVER_NAME=www.sitename.com SERVER_SOFTWARE=Apache/2.0.48 (Fedora) QUERY_STRING= SITE_ROOT=/ SERVER_ADDR=66.49.180.189 GATEWAY_INTERFACE=CGI/1.1 SERVER_PROTOCOL=HTTP/1.1 REDIRECT_URL=/index232.php REQUEST_METHOD=GET _=/usr/bin/php
Again, we see a proxy at work.  This time it is our old friend 66.185.84.204 = wc09.mtnk.rnc.net.cable.rogers.com, which again is shown to be a proxy.

When was this? The date of tuxx's post is May 18, 2004.  We have already seen here that truehits.net had listed 66.185.84.204 as a proxy in early 2003.  Apparently it was still one in 2004.
Posted by at
Labels: , , ,

Wednesday, April 02, 2008

proxy servers 2: other Rogers proxy servers at truehits.net

We have been trying to discover how a group of Rogers IPs are related to one another.  Our results so far are illustrated by the ball-of-string to the right, where each strand represents a user who's IP can be seen shifting from one IP to another.   We saw in the last post, however, that one of them, 66.185.84.74, was a proxy server.  It is listed as a proxy server in the logs of truehits.net from April 19th, 2003, and December 23rd and 26th, 2004.  And, by a lucky chance, it attracted the attention of John Walker of AutoCad (here), who discussed how such a proxy might affect one's logs.  

This raises the question whether there are other proxies among these IPs, and since we found this Rogers proxy at truehits.net, this is obviously the first place to look.  These other Rogers IPs are listed as proxy servers in its logs on the following dates:This means that about half of the IPs that we have been considering are proxy servers. Adding this to our ball of string, with each confirmed proxy circled (the colour is according to year), produces the graphic at the left.
Posted by at
Labels: , , , , , , , , , , ,

Tuesday, April 01, 2008

more fluidity (204 = 208 =199)

Another good example at how fluid these Rogers IPs were comes from the Dec. '03 logs from land-fortune.com (I add the IP numbers for each host-name):
    wc04.mtnk.rnc.net.cable.rogers.com (=66.186.84.199) 2 78 1.11 MB 20 Dec 2003 - 11:03
    wc09.mtnk.rnc.net.cable.rogers.com (=66.186.84.204)6 43 672.82 KB 20 Dec 2003 - 11:03
    wc13.mtnk.rnc.net.cable.rogers.com ( =66.186.84.208)3 22 421.08 KB 20 Dec 2003 - 11:02
Posted by at
Labels: , , ,

proxy servers 1: 66.185.84.74

I have already pointed out (here) the rather odd logs at John Walker's fourmilab.com, in which three Roger's IPs accounted for so much of the traffic for the site in January, 2004. The size of the traffic apparently attracted the attention of the site owner, who discusses it here. His conclusion? That these are proxy servers.  This is what he writes:
    The hosts with very high hit rates appear to be HTTP proxy servers which are relaying requests from hosts behind them. Here's a dump of a packet from the host at the very top of the heavy hitters report:
      wc07.wlfdle.rnc.net.cable.rogers.com -> vitesse HTTP GET / HTTP/1.1
      0: 0800 20a1 4ca0 0030 1e05 2758 0800 4500 .. .L..0..'X..E.
      16: 00ce e6a2 4000 2c06 28f1 42b9 544a c108 ....@.,.(.B.TJ..
      32: e68a b959 0050 0b64 6c2d 798e e202 8018 ...Y.P.dl-y.....
      48: 4470 c88b 0000 0101 080a 2e4f 0050 594f Dp.........O.PYO
      64: daa9 4745 5420 2f20 4854 5450 2f31 2e31 ..GET / HTTP/1.1
      80: 0d0a 486f 7374 3a20 666f 7572 6d69 6c61 ..Host: fourmila
      96: 622e 6368 0d0a 436f 6e6e 6563 7469 6f6e b.ch..Connection
      112: 3a20 6b65 6570 2d61 6c69 7665 0d0a 5072 : keep-alive..Pr
      128: 6167 6d61 3a20 6e6f 2d63 6163 6865 0d0a agma: no-cache..
      144: 582d 466f 7277 6172 6465 642d 466f 723a X-Forwarded-For:
      160: 2032 342e 3135 332e 3539 2e38 340d 0a56 24.153.59.84..V
      176: 6961 3a20 312e 3020 7763 3037 2028 4e65 ia: 1.0 wc07 (Ne
      192: 7443 6163 6865 204e 6574 4170 702f 352e tCache NetApp/5.
      208: 322e 3152 3144 3929 0d0a 0d0a 2.1R1D9)....
    As you can see, this is a proxy server forwarding a packet for a host with IP address 24.153.59.84, which resolves to CPE00e0184e28fb-CM00803785d6b6.cpe.net.cable.rogers.com, another host in the same domain (albeit a very different IP address: the proxy server is 66.185.84.74). Monitoring packets from the proxy server show it forwarding requests from an assortment of hosts behind it. 
Thus John Walker.  There are two important points for us here: (1) 66.185.84.74 is a proxy-server that was forwarding requests for a number of Rogers' customers, and (2) each of Rogers' customer will have had their own IP.  (In this case the customer is 24.153.59.84.)

There is, however, another point.  To the right is screen-capture of the last line of the packet quoted above.  In it is identified the server software that is doing the proxying (see the red arrow): Netcache by Network Appliances (NetApp).  

This is something that we see elsewhere.  A Thai web-directory, truehits.net, provides a variety of services for its customers, including daily traffic statistics that are available on the web.  One reported statistic is top proxy servers, and the same proxy server discussed by fourmilabs in January 2004 was listed by truehits as one of top proxy-servers to visit sunncity.com on April 19 2003, Dec. 23 2004, and Dec. 26 2004.

The screen cap on the left is from April 19.  It shows, not only is the same server software being used (see red arrow), but the exact same version (5.1.1R1D9), and (since it is set up to "Forward IP") with much the same configuration.  

Now, according to the fourmilabs logs, the forwarding was being done for 24.153.59.84 (a Rogers IP).  In the case of this truehits log, we can again identify the specific IP of the individual user, not merely the proxy.  Note that the proxy had forwarded 63 hits (green arrow).   

Among the top daily visitors (see right) is 24.102.79.243, which is marked here as NETBLK-RNS-EAST.  (To judge from this, RNS abbreviates Rogers Network Services.) And the number of hits is identical to the proxy's.  (It is only to be expected, of course, that an small site in Thailand might only receive one Rogers customer in a daily log.)

The important point for us is that Rogers was using this IP as proxy for all of 2003 and 2004.

One final point.  In most cases the proxy hides the individual IP, and the IP that appears in the logs is that of the  proxy, not that of the individual Rogers customer.  In the case of the fourmilabs logs, of course, Mr. Walker has fished out the individual IP for us.  Normally, however, we don't see the individual data, but we see details about his browser and operating system ("user agents").  Consider these examples from two log entries for the same proxy (66.185.84.74) during the period when this proxy was in use:
  • Tue 29-June-2004 08:07 - wc08.wlfdle.rnc.net.cable.rogers.com [=66.185.84.74, ed.] - "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" - "http://search.yahoo.com/"
  • 66.185.84.74 - - [25/Sep/2004:09:59:00 +0200] "GET /downloads/hovtext/1.0/HovText.exe HTTP/1.1" 200 1136640 "http://hovklan.com/hovtext/index.php/?page=download〈=en" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; FunWebProducts; SV1; .NET CLR 1.1.4322)"
In both cases, the IP is the proxy, and the user agent data (browser, operating system, etc.) is the individual's.
Posted by at
Labels: , , , ,

Monday, March 31, 2008

66.185.84.204 and the promiscuity of Rogers' IPs (Summary thread)

Rogers IPs
Update. When I first posted this, I didn't realize that these were all Rogers' web-caching proxy servers. The shifting that I've documented is presumably a result of the practice of load-balancing (on which see here).

Over the last several weeks and in dozens of posts, we've seen how liquid some of Rogers' IPs were in the years 2003-2005. IPs in 66.185.84.xxx range seem to have changed without warming; in extreme cases a surfer might have several IPs in several minutes. (See, for example, here from 2004 where there are five IPs in half-a-day; or here from 2003, where there are three in 8 minutes; or some of the other listed under the label "quick change").

The shifts between these IPs are trackable, but the details are widely dispersed and the overall picture difficult to make out. Hence the graphic above. Each line connects two of the Rogers' IPs in our pool; I colour-coded them by year (see the key at the top right). The evidence for some of the equivalencies are more certain than for others, which can be checked via this index:
This list reflects, of course, only the tiniest fraction of the internet traffic. Every visit to any web-page is logged somewhere, but very few of those logs are ever published online and therefore become available to us, and only a tiny fraction of internet users edit wikipedia anonymously.

Posted by at No comments:
Labels:

Who else used 66.185.84.204 in 2003?

The list of appearances of 66.185.84.204 in 2003 grew too lengthy for a single list, so I've divided its content into these shorter lists:
Posted by at No comments:
Labels: ,

Sunday, March 30, 2008

rip-off (75 = 76 = 77 =78 =79 =81)

“There are three things in the world that deserve no mercy -- hypocrisy, fraud, and tyranny,” someone said. This is presumably why the internet is so merciless.

In this thread at Howard Forums, dating from March 2004, to judge from the Wayback machine, "drumming27" complains that he had agreed to sell an xbox to "Mr. Chow", but had never been paid, and now is unable to contact Chow. Drumming gives all the information that he has on "Chow", including the shipping address, all the IPs that in the communications. The list of IPs is again telling, since they are mostly Rogers:
    192.139.71.69 (torfw1.nesbittburns.com)
    209.161.243.29 (209.161.243.29) 24.102.71.218 (CPE00045ae17926-CM012069962605.cpe.net.cable.rogers.com)
    24.153.37.33 (CPE000c6efd4c43-CM000e5c6eb738.cpe.net.cable.rogers.com)
    24.156.41.95 (CPE000c6e83883a-CM014270033677.cpe.net.cable.rogers.com)
    63.230.237.230 (63-230-237-230.phnx.qwest.net)
    65.48.68.214 (65.48.68.214)
    65.50.50.102 (CPE000c6e806d9b-CM014310003972.cpe.net.cable.rogers.com)
    66.185.84.75 (wc08.wlfdle.rnc.net.cable.rogers.com)
    66.185.84.76 (wc09.wlfdle.rnc.net.cable.rogers.com)
    66.185.84.77 (wc10.wlfdle.rnc.net.cable.rogers.com)
    66.185.84.78 (wc11.wlfdle.rnc.net.cable.rogers.com)
    66.185.84.79 (wc12.wlfdle.rnc.net.cable.rogers.com)
    66.185.84.81 (wc14.wlfdle.rnc.net.cable.rogers.com)
    66.75.109.220 (cpe-66-75-109-220.socal.rr.com)
Some might have been struck by the number of IPs involved in such a simple transaction. But for those who have been following my recent posts, Rogers IPs within this group seem to do this a lot. Here it seems that Chow, too, had IP shifts from x.x.x.75 to x.x.x.76, etc., in early 2004.
Posted by at
Labels: , , , , , ,

another user of 66.185.84.204

The Armed Forces Institute of Pathology is part of the American Defense Department, it provides consultation, education and research. Its educational wing offers courses, and the registration logs for some of these can be seen on line. In January, 2004, someone registered in one of their on-line courses using the IP 66.185.84.204 (see here, here, and here).  You can see the name by clicking on the links and searching the IPs -- but it an Ottawa area physician who is listed among the authors of a paper on Calcified Colonic Mass.
Posted by at

How many different users used 66.185.84.204 to visit northern sites in 2002-2003?

ArcticCircle.ca is a web-host and central hub for a variety of northern communities. It has some great photo-albums and attracts a fair bit of traffic from across the country.

Included in its traffic are numerous visits from the mysterious Rogers IP, 66.185.84.204. Indeed, within its logs are 32 separate visits from that IP between January 2002 and April 2003. The logs preserve date, time, site visited, and details about the operating-system and browser of the visitor.

Here are the 32 visits by 66.185.84.204, in chronological order, together with the logged data.

no. date config log
1 20-Jan-02 Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Q312461) here
2 23-Jan-02 Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Q312461) here
3 31-Jan-02 Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Q312461) here
4 03-Feb-02 Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Q312461) here
5 28-Feb-02 Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Q312461) here
6 03-Mar-02 Mozilla/4.0 (compatible; MSIE 5.0; Windows 98) here
7 11-Apr-02 Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90; Hotbar 3.0) here
8 11-Apr-02 Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; AtHome0107) here
9 25-Apr-02 Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)(R1 1.1) here
10 01-May-02 Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90) here
11 02-May-02 Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Q312461) here
12 23-May-02 Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Q312461) here
13 26-May-02 Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt; AtHome0107) here
14 07-Jun-02 Mozilla/4.78 [en] (Win98; U) here
15 10-Jun-02 Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90; MSOCD; AtHome021SI) here
16 17-Jun-02 Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.0.3705) here
17 20-Jun-02 Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90; H010818; Rogers Hi-Speed Internet) here
18 24-Jun-02 Mozilla/4.0 (compatible; MSIE 5.5; Windows 98) here
19 13-Oct-02 Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90; Q312461; MSOCD; AtHome021SI; YComp 5.0.0.0; .NET CLR 1.0.3705) here
20 30-Oct-02 Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; AtHome0107) here
21 06-Jan-03 Mozilla/4.0 (compatible; MSIE 5.0; Windows 98) here
22 06-Jan-03 Mozilla/4.0 (compatible; MSIE 5.0; Windows 98) here
23 11-Jan-03 Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) here
24 02-Feb-03 Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Rogers Hi-Speed Internet) here
25 16-Feb-03 Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; MSOCD; AtHome021SI; (R1 1.1)) here
26 26-Feb-03 Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) here
27 01-Mar-03 Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Q312461; YComp 5.0.2.5) here
28 05-Apr-03 Mozilla/4.0 (compatible; MSIE 5.16; Mac_PowerPC) here
29 18-Apr-03 Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Rogers Hi-Speed Internet) here
30 21-Apr-03 Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Rogers Hi-Speed Internet) here
These are obviously not all the same individual, though some of these are return visitors. Here are the easier identifications:
  • 1 =2 =3 =4 =11 =12
  • 5 = 29?
  • 6 = 21 =22
  • 7 = 15?
  • 8 (= 20?)
  • 9 = 13?
  • 10 = 17? = 19?
  • 14
  • 16 ?= 23 = 26 29
  • 18 = 20
  • 24 = 30
  • 25
  • 28
A few of these, too, might also be the same individual using a different computer via a wireless network, etc.

But one way or another it is difficult to avoid the conclusion that up to a dozen different individuals visited one of the sites at ArcticCircle.ca using the same IP address.
Posted by at No comments:
Labels: ,

Quincy Library group (204 = 201)

In the guest log of the Quincy Library group are several examples of quick shifts between 66.185.84.204 and 66.185.84.201 in June 2002.
  • 66.185.84.201 - [06/16/02 02:18:18 PDT] - ERR: No Comments
  • 66.185.84.204 - [06/16/02 02:18:50 PDT] - ERR: No Comments
  • 66.185.84.201 - [06/17/02 22:33:33 PDT] - ERR: No Comments
  • 66.185.84.204 - [06/17/02 22:35:26 PDT] - ERR: No Comments
  • 66.185.84.201 - [06/19/02 19:28:07 PDT] - ERR: No Comments
  • 66.185.84.204 - [06/19/02 19:28:18 PDT] - ERR: No Comments
Posted by at
Labels: , , ,

Kelly Inn Yellowstone (204 = 202; 209 = 202; 81 = 74; 73 = 74; 201=202)

Extracted here are the entries for the Rogers IPs in the 66.185.84.xxx-range from the Kelly Inn, in Wyoming.  These are probably all the same user, but especially to be noted are the coloured pairs, where we see IPs quickly shifting in the midst of a visit.  (I'll limit myself here to shifts of two minutes or less.)
907 Wed Mar 27 16:59:56 2002 66.185.84.204 http://www.wyellowstone.com/kellyinn/
908 Wed Mar 27 17:00:23 2002 66.185.84.202 http://www.wyellowstone.com/kellyinn/
2780 Mon Apr 15 15:16:59 2002 66.185.84.209 http://www.wyellowstone.com/kellyinn/
2781 Mon Apr 15 15:17:28 2002 66.185.84.209 http://www.wyellowstone.com/kellyinn/
2783 Mon Apr 15 15:18:20 2002 66.185.84.202 http://www.wyellowstone.com/kellyinn/
3353 Sat Apr 20 14:49:58 2002 66.185.84.209 http://www.wyellowstone.com/kellyinn/
3354 Sat Apr 20 14:56:01 2002 66.185.84.202 http://www.wyellowstone.com/kellyinn/
3355 Sat Apr 20 15:03:12 2002 66.185.84.209 http://www.wyellowstone.com/kellyinn/
3359 Sat Apr 20 15:13:15 2002 66.185.84.209 http://www.wyellowstone.com/kellyinn/
3360 Sat Apr 20 15:31:20 2002 66.185.84.202 http://www.wyellowstone.com/kellyinn/
3361 Sat Apr 20 15:31:23 2002 66.185.84.202 http://www.wyellowstone.com/kellyinn/
12891 Thu Jun 20 22:06:18 2002 66.185.84.81 http://www.wyellowstone.com/kellyinn/
12892 Thu Jun 20 22:06:42 2002 66.185.84.74 http://www.wyellowstone.com/kellyinn/
13360 Mon Jun 24 9:33:59 2002 66.185.84.209 http://www.wyellowstone.com/kellyinn/
13361 Mon Jun 24 9:35:34 2002 66.185.84.202 http://www.wyellowstone.com/kellyinn/
40173 Thu May 15 16:00:20 2003 66.185.84.201
40187 Thu May 15 18:37:25 2003 66.185.84.201
46977 Wed Jun 25 20:40:20 2003 66.185.84.201 http://www.wyellowstone.com/kellyinn/
47768 Mon Jun 30 22:22:23 2003 66.185.84.73 http://www.wyellowstone.com/kellyinn/
47769 Mon Jun 30 22:23:10 2003 66.185.84.74 http://www.wyellowstone.com/kellyinn/
54685 Tue Aug 5 19:49:34 2003 66.185.84.73 http://www.wyellowstone.com/kellyinn/
54686 Tue Aug 5 19:49:54 2003 66.185.84.74 http://www.wyellowstone.com/kellyinn/
54865 Wed Aug 6 20:00:26 2003 66.185.84.201
54866 Wed Aug 6 20:01:19 2003 66.185.84.202
62646 Sat Dec 20 9:18:34 2003 66.185.84.201 http://www.wyellowstone.com/kellyinn/
64440 Mon Feb 2 20:13:36 2004 66.185.84.73 http://www.wyellowstone.com/kellyinn/
64441 Mon Feb 2 20:15:25 2004 66.185.84.74 http://www.wyellowstone.com/kellyinn/
Again we see the fluidity of these IPs: one could not be sure that one's IP would be the same from the beginning of a session to the end.
Posted by at
Labels: , , , , , , ,

Saturday, March 29, 2008

Visiting Huizhou (197 = 198 = 206 = 196)

Below is bit of a log from a site run by the Chinese government for the administrative district of Huizhou  is highly suggestive of how Rogers worked.  The links are all dead now, which is probably just as well since I don't read Chinese. Still, they give an idea of one surfer's progress.
时 间 IP 操作系统 浏览器 来 源 网 页
15 3/14/02 4:47:44 211.155.36.46 Win XP MSIE 6.x http://xiaogang.net/lb5000/forums.cgi?forum=6
14 3/14/02 4:46:39 211.155.36.46 Win XP MSIE 6.x http://xiaogang.net/lb5000/forums.cgi?forum=6
13 3/14/02 4:45:55 211.155.36.46 Win XP MSIE 6.x http://xiaogang.net/lb5000/forums.cgi?forum=5
12 3/14/02 4:45:55 211.155.36.46 Win XP MSIE 6.x http://xiaogang.net/lb5000/forums.cgi?forum=5
11 3/14/02 4:45:12 66.185.84.196 Win XP MSIE 6.x http://www.xiaogang.net/lb5000/forums.cgi?forum=15
10 3/14/02 4:44:55 66.185.84.197 Win XP MSIE 6.x http://www.xiaogang.net/lb5000/forums.cgi?forum=15
9 3/14/02 4:44:02 218.6.192.132 Win XP MSIE 6.x
8 3/14/02 4:43:34 66.185.84.206 Win XP MSIE 6.x http://www.xiaogang.net/lb5000/forums.cgi?forum=15
7 3/14/02 4:43:22 66.185.84.198 Win XP MSIE 6.x http://www.xiaogang.net/lb5000/forums.cgi?forum=15
6 3/14/02 4:42:14 211.155.36.46 Win XP MSIE 6.x http://xiaogang.net/lb5000/forums.cgi?forum=3&action=resetposts
5 3/14/02 4:42:08 66.185.84.198 Win XP MSIE 6.x http://www.xiaogang.net/lb5000/forums.cgi?forum=5&show=25
4 3/14/02 4:40:42 66.185.84.197 Win XP MSIE 6.x http://www.xiaogang.net/lb5000/forums.cgi?forum=5
3 3/14/02 4:40:13 66.185.84.197 Win XP MSIE 6.x http://www.xiaogang.net/lb5000/forums.cgi?forum=5
2 3/14/02 4:39:23 211.155.36.46 Win XP MSIE 6.x http://xiaogang.net/lb5000/forums.cgi?forum=3
1 3/14/02 4:38:39 66.185.84.198 Win XP MSIE 6.x http://www.xiaogang.net/lb5000/post.cgi?action=reply&forum=5&topic=81

There seem to be three people visiting the site at the same, one of them is from Beijing (211.155.36.46, nos. 2, 6, 12-15), another from Chengdu (218.6.192.132: no. 9), and the third a Rogers customer from Ontario, whose IP is shifting (nos. 1, 3-5, 7-8, 10-11).

Beginning at the bottom (no. 1), our Rogers' customer has posted something to forum 5 with x.x.x.198; a minute later, he looks at forum 5 (nos. 3-4), but now has x.x.x.197; he goes to read post (?) 25 of forum 5 (no. 5), but with x.x.x.198 again; then, still x.x.x.198, he looks at forum 15 (no. 7), but within seconds his IP becomes x.x.x.206 (no. 8), then x.x.x.197 (no. 10), then x.x.x.196 (no. 11).

Addendum.  From the same site, the log from Feb. 27, 2002, shows that x.x.x.204 = x.x.x.198.

Addendum 2.  From the same site, the log from March 11, 2002, shows that x.x.x.197 = x.x.x.198 = x.x.x.205.

Addendum 3.  From the same site, the logs from March 14, 2002, and March 21, 2002, show that x.x.x.198 = x.x.x.203


Posted by at
Labels: , , , , , , , ,

This post has 22 minutes (197 = 206)

Over the last five years, the wikipedia articles on subjects to do with Canadian television have been heavily reworked by the Rogers IPs that we have been following. If you look at the contribution histories of 66.185.84.208 (here) and 66.185.84.206 (here) you'll see many, many edits to articles such as Rick Mercer, the CBC, the List of English programs on the CBC, etc.  

A very popular show with these IPs is This Hour has 22 Minutes, which a handful of the Rogers IPs that we have been tracking have made hundreds of edits to.  

And so, December 5-6, 2003, the edit history shows a dozen or so edits by 66.185.84.206 (here), all reworking the same section.  Then we see this: 
    (diff) 20:53, 6 December 2003 66.185.84.206
    (diff) 20:52, 6 December 2003 66.185.84.197
    (diff) 20:51, 6 December 2003 66.185.84.206
The quick shift from x.x.x.203 to x.x.x.197 and back again all took place within a couple minutes, and again shows how fluid these IPs could be.
Posted by at
Labels: , , ,
Subscribe to: Posts (Atom)