Jesse Rehmer wrote:

> My first thought when reading the original post with the Path header, and
> checking that I see the same Path on my server, is that some fuckery is going
> on. Whether malicious intent, misconfiguration, or maybe a mixture of both,
> I'm not sure, but am kind of curious.

Regarding the test, I still haven't seen the original message in the mixmin
feed yet, but I expected it to be delayed over that of the paganini copy.

Regarding the PATH: header with "aioe" in it when aioe can't be in the loop
I posted to news.mixmin.net:563 & read from news.dizum.net:119

This is the resulting PATH: header.
Path: sewer!news.mixmin.net!.POSTED!sewer!alphared!news.uzoreto.com!aioe.org!uC+u+wrvCiJRhswcuU7oWw.user.46.165.242.75.POSTED!not-for-mail

What would be useful to everyone, certainly to me, I think, would be if
someone can take apart the path and tell the rest of us what it's saying.

For example, what IP address is that in the PATH: header?
It's not what a ping shows me of news.mixmin.net anyway.
C:\> ping news.mixmin.net
Pinging fleegle.mixmin.net [144.76.182.167] with 32 bytes of data:
C:\> tracert news.mixmin.net
With the last few hops not having anything near 46.165.242.75 in them...
17 253 ms 185 ms 190 ms ae4.cs1.ams17.nl.eth.zayo.com [64.125.28.36]
18 186 ms 191 ms 215 ms ae2.cs1.fra6.de.eth.zayo.com [64.125.29.58]
19 199 ms 198 ms * ae0.cs1.fra9.de.eth.zayo.com [64.125.29.55]
20 193 ms 236 ms 202 ms ae1.mcs1.fra9.de.eth.zayo.com [64.125.29.65]
21 199 ms 207 ms 189 ms as24940.frankfurt.megaport.com [62.69.146.15]
22 198 ms 200 ms * hos-tr3.ex3k4.dc4.fsn1.hetzner.com [213.239.224.69]
23 196 ms 178 ms 191 ms ex9k1.dc11.fsn1.hetzner.com [213.239.203.142]
24 182 ms 189 ms 176 ms fleegle.mixmin.net [144.76.182.167]

A google for 46.165.242.75 shows https://www.whois.com/whois/46.165.242.75
inetnum: 46.165.240.0 - 46.165.247.255
netname: Leaseweb
descr: Leaseweb Deutschland GmbH
person: RIPE Mann
address: Kleyerstrasse 75-87
address: 60326 Frankfurt am Main
address: Germany

Does that point to anything that makes sense to you why/how it's there?

And maybe can someone who knows how a PATH: works tell us how many hops it took
and who injected which bang-section into that specific nntp PATH: header?

1. !not-for-mail
2. !uC+u+wrvCiJRhswcuU7oWw.user.46.165.242.75.POSTED
3. !aioe.org <=== how'd that get there?????
4. !news.uzoreto.com
5. !alphared
6. !sewer
7. !.POSTED
8. !news.mixmin.net
9. sewer

Andy Burnelli <nospam@nospam.net> wrote in
news:tt99ur$3b541$1@paganini.bofh.team:

> Jesse Rehmer wrote:
>
>> My first thought when reading the original post with the Path header,
>> and checking that I see the same Path on my server, is that some
>> fuckery is going on. Whether malicious intent, misconfiguration, or
>> maybe a mixture of both, I'm not sure, but am kind of curious.
>
> Regarding the test, I still haven't seen the original message in the
> mixmin feed yet, but I expected it to be delayed over that of the
> paganini copy.
>
> Regarding the PATH: header with "aioe" in it when aioe can't be in the
> loop I posted to news.mixmin.net:563 & read from news.dizum.net:119
>
> This is the resulting PATH: header.
> Path:
> sewer!news.mixmin.net!.POSTED!sewer!alphared!news.uzoreto.com!aioe.org
> !uC+u+wrvCiJRhswcuU7oWw.user.46.165.242.75.POSTED!not-for-mail
>
> What would be useful to everyone, certainly to me, I think, would be
> if someone can take apart the path and tell the rest of us what it's
> saying.
>
> For example, what IP address is that in the PATH: header?
> It's not what a ping shows me of news.mixmin.net anyway.
> C:\> ping news.mixmin.net
> Pinging fleegle.mixmin.net [144.76.182.167] with 32 bytes of
> data:
> C:\> tracert news.mixmin.net
> With the last few hops not having anything near 46.165.242.75 in
> them...
> 17 253 ms 185 ms 190 ms ae4.cs1.ams17.nl.eth.zayo.com
> [64.125.28.36] 18 186 ms 191 ms 215 ms
> ae2.cs1.fra6.de.eth.zayo.com [64.125.29.58] 19 199 ms 198 ms
> * ae0.cs1.fra9.de.eth.zayo.com [64.125.29.55] 20 193 ms 236
> ms 202 ms ae1.mcs1.fra9.de.eth.zayo.com [64.125.29.65] 21 199 ms
> 207 ms 189 ms as24940.frankfurt.megaport.com [62.69.146.15] 22
> 198 ms 200 ms * hos-tr3.ex3k4.dc4.fsn1.hetzner.com
> [213.239.224.69] 23 196 ms 178 ms 191 ms
> ex9k1.dc11.fsn1.hetzner.com [213.239.203.142] 24 182 ms 189 ms
> 176 ms fleegle.mixmin.net [144.76.182.167]
>
> A google for 46.165.242.75 shows
> https://www.whois.com/whois/46.165.242.75
> inetnum: 46.165.240.0 - 46.165.247.255
> netname: Leaseweb
> descr: Leaseweb Deutschland GmbH
> person: RIPE Mann
> address: Kleyerstrasse 75-87
> address: 60326 Frankfurt am Main
> address: Germany
>
> Does that point to anything that makes sense to you why/how it's
> there?
>
> And maybe can someone who knows how a PATH: works tell us how many
> hops it took and who injected which bang-section into that specific
> nntp PATH: header?
>
> 1. !not-for-mail
> 2. !uC+u+wrvCiJRhswcuU7oWw.user.46.165.242.75.POSTED
> 3. !aioe.org <=== how'd that get there?????
> 4. !news.uzoreto.com
> 5. !alphared
> 6. !sewer
> 7. !.POSTED
> 8. !news.mixmin.net
> 9. sewer

Dude, you've ben told multiple times by multiple different posters how the
path functions and you refuse to accept it.

It doesn't matter how many times you rehash and ask, it's not going to
change.