@TheMadPirate @kaia @moth_ball @pernia It's statistics and data points. A connection comes from a place, describes itself in the headers, and then does a thing. That's it: you see a weird thing.

Then you can use whois (if you are doing low-volume) or download the NRO delegated stats DB (if high) to find out if the fedposting is coming from Germany or not.