"Reel McKoi" wrote in message
...
Now that I've had my fun can anybody tell me why they can't tell the
diffrence this post from the "Reel McKoi"? (Yes it is a forgiery, but I'm
alowed one in the intrest of training.)

When usenet was designed, it wasn't designed with security concerns, user
authentication wasn't a concern.
The first news server I had access to let you edit the news spool directly,
and you could change just about anything you wanted. But let's look at your
headers and see what looks fishy.

Most of the time, the best filter is, do you really care if the post is a
fake? does it look like the original person said that? does it matter?

-S

From: "Reel McKoi"
^^^^^^^^^^^^ anyone can forge that, nothing special there.
Newsgroups: rec.ponds
References:
m
Subject: Koi changing color
Date: Tue, 25 Oct 2005 01:11:54 -0600
Lines: 27
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Outlook Express 6.00.2900.2527
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2527
X-RFC2646: Format=Flowed; Response
^^^^^^^^^^^^
Sometimes these are a good hint as if you're using the same software
that Carol does, but forgeable so not a sure thing.

NNTP-Posting-Host: $$$gwcphimjh7l57.x-privat.org
Often the NNTP-Posting-Host is the ip address of the person
posting, since you used a relay, your actual host was obfuscated.

Message-ID:
Organization: X-Privat NNTP Server - http://www.x-privat.org
X-Authenticated-User: $$h6xu9zof$n$xdo3tmmt7m-pml
X-Complaints-To:
Path:
newssvr25.news.prodigy.net!newsdbm05.news.prodigy. com!newsdst02.news.prodigy.com!newsmst01b.news.pro digy.com!prodigy.com!newscon02.news.prodigy.com!pr odigy.net!news.glorb.com!x-privat.org!draco.dragonfur.ca!not-for-mail
^^^ sometimes the path can provide clues, but not always.

Xref: newsmst01b.news.prodigy.com rec.ponds:273176