The voice of "Robert Briggs" drifted in on the cyber-winds,
from the sea of virtual chaos...
>> Don't know how to analyze the path property.
>> Here is what my news server had to say about the first such post:
<snip>
> So this one *claims* to have started out at "attbi_s54", and
> visited the USA, Italy, Germany, and the USA (I may have missed
> some) on its way to "attbi_s02".
<snip>
> The paths may well be quite similar near their ends, but the
> middle parts can differ a lot even with "normal" Usenet routing,
> let alone the sort of lies rogues sometimes tell to try to cover
> their tracks.
Posts often take a "varied" path around the Usenet, often due to mostly
to volume...
The only effective way to see where a post was from is to compare three
or more like posts for similar path entries, and if you add in the fact
that his Forgeries (for this batch) where all from "217.141.239.221"
(interbusiness.it), so it's reasonable to assume that Open Proxy is
also using a local news server (where it has valid access).
If "Dip Slime" was pre loading, which is quite likely, everything past
"!news.cs.interbusiness.it" in the path header would be there just to
cover his tracks.
--
The Tech Zero, Maxx Pollare - Traveling without moving...