New evidence of fabrications behind the Trump-Russia theory
mate.substack.com
mate.substack.com
Krebson Security's take on this is the best one I've seen. Their conclusion is solid: https://krebsonsecurity.com/2021/09/lawsuits-indictments-rev...
https://justthenews.com/sites/default/files/2020-04/Ankura_A...
I didn't read it, but it's extremely trivial to generate outgoing DNS traffic from many networks with their own mail and DNS infrastructure (i.e., any big bank that has their own IT department), to any other domain name. All you do is connect to their mail server, and provide the domain name to query in MAIL FROM via SMTP.
Which is basically the whole evidence that connects the parties together.
Ankara reports that the use of the domains in question is consistent with marketing campaigns in the hospitality industry.
I'm still confused where the original DNS lookup dataset came from and why is it trusted. It cannot possibly be a complete dataset of all the requests for the domain in question. If anything, there's way more bot activity happening during a period of 4.5 months. A mere 10 IP addresses accounting for all requests that were ever made during a period of 4.5 months, for a public domain name (proof available from DomainTools per Ankara), is not realistic.
>The report notes that unlike other domains the Trump Organization used to send mass marketing emails, the domain at issue — mail1.trump-email.com — was configured in such a way that would have prevented it from effectively sending marketing or bulk emails. Or at least prevented most of the missives sent through the domain from ever making it past spam filters.
>Nor was the domain configured like other Trump Organization domains that demonstrably did send commercial email, Jones’ analysis found. Also, the mail1.trump-email.com domain was never once flagged as sending spam by any of the 57 different spam block lists published online at the time.
>“If large amounts of marketing emails were emanating from mail1.trump-email.com, it’s likely that some receivers of those emails would have marked them as spam,” Jones’ 2018 report reasons. “Spam is nothing new on the internet, and mass mailings create easily observed phenomena, such as a wide dispersion of backscatter queries from spam filters. No such evidence is found in the logs.”
>Also, the mail1.trump-email.com domain was never once flagged as sending spam by any of the 57 different spam block lists published online at the time.
Ankura reports that DomainTools reports the First Seen for the FQDN — with the exact same IP address throughout — as early as 2010-07-02.
If you don't believe Ankura, just purchase a report for the domain yourself from DomainTools or one of their resellers. Probably only costs a few bucks for a few lookups.
Most ironic is an out of context quote from Paul Vixie about a conspiracy with out-of-band communication for DNS discovery, because clearly there's no other possible explanation for discovering public FQDNs that have been known to exist since 2009! Meanwhile, if you've ever looked at Paul's Twitter feed over the last 4 years, it's pretty clear which party he supports and which single president he despises and would have done anything to get rid of; but I'm sure that has no relevance to the case, and he is still being objective in suggesting conspiracy theories that involve DNS in some way, without ever bothering to verify the authenticity of the data that he's presented with to make public comments on.
How's Krebs' the best take if it's the same lies propagated by the mainstream media? Not to mention that most DNS software doesn't even log any non-AXFR DNS requests at all (DNS works really fast over UDP and is very cheap unlike HTTP, and logging all requests to disk will slow down peak performance considerably), plus where the log comes from is never explained, either. Reminds me of diversion of media attention through "a story that nobody can disprove and which will be believed even if it's denied". Yes, Prime Minister, S2E2, "Official Secrets", ©1987 BBC.
https://www.kcrw.com/news/shows/lrc-presents-all-the-preside...
Many past explanations here:
https://hn.algolia.com/?dateRange=all&page=0&prefix=false&so...
Also, the author is a hyper-partisan and (left-wing, not right-wing as some here have assumed) and this report has a political agenda.
(Disclaimer: I've both benefitted from that in the past and nominated other items for the queue.)
"Whether HN is capable of discussing it substantively is a separate issue." Indeed...
How do you square that with the Steele report, which alleged exactly that? Steele and Mueller may have agreed about some details, but not about the primary claim.
And in the interest of accuracy you should also mention that Manafort was only campaign manager for two months, from June 20 to August 19 of 2016, and he was removed from the campaign, reportedly, because of his Russian connections.
"On August 17, 2016, Trump received his first security briefing. The same day, August 17, Trump shook up his campaign organization in a way that appeared to minimize Manafort's role. It was reported that members of Trump's family, particularly Kushner, who had originally been a strong backer of Manafort, had become uneasy about his Russian connections and suspected that he had not been forthright about them. Manafort stated in an internal staff memorandum that he would "remain the campaign chairman and chief strategist, providing the big-picture, long-range campaign vision". However, two days later, Trump announced his acceptance of Manafort's resignation from the campaign after Steve Bannon and Kellyanne Conway took on senior leadership roles within that campaign."[2]
1: https://www.huffpost.com/entry/paul-manafort-mueller-investi...
2: https://en.wikipedia.org/wiki/Paul_Manafort#Chairman_of_Trum...
>As explained in Section IV above, the Office’s investigation uncovered evidence of numerous links (i.e., contacts) between Trump Campaign officials and individuals having or claiming to have ties to the Russian government. The Office evaluated the contacts under several sets of federal laws, including conspiracy laws and statutes governing foreign agents who operate in the United States. After considering the available evidence, the Office did not pursue charges under these statutes against any of the individuals discussed in Section IV above—with the exception of FARA charges against Paul Manafort and Richard Gates based on their activities on behalf of Ukraine.
>One of the interactions between the Trump Campaign and Russian-affiliated individuals—the June 9, 2016 meeting between high-ranking campaign officials and Russians promising derogatory information on Hillary Clinton—implicates an additional body of law: campaign finance statutes. Schemes involving the solicitation or receipt of assistance from foreign sources raise difficult statutory and constitutional questions. As explained below, the Office evaluated those questions in connection with the June 9 meeting [REDACTED]. The Office ultimately concluded that, even if the principal legal questions were resolved favorably to the government, a prosecution would encounter difficulties proving that Campaign officials or Investigative Technique individuals connected to the Campaign willfully violated the law.
>Finally, although the evidence of contacts between Campaign officials and Russia affiliated individuals may not have been sufficient to establish or sustain criminal charges, several U.S. persons connected to the Campaign made false statements about those contacts and took other steps to obstruct the Office’s investigation and those of Congress. This Office has therefore charged some of those individuals with making false statements and obstructing justice.
Don't spread misinformation, that was a DIRECT QUOTE from the Mueller report: "Ultimately, the investigation did not establish that the Campaign coordinated or conspired with the Russian government in its election-interference activities." You can see it in [1] or [2] or in the report itself.
So there were a few contacts. So what? Presidential campaigns talk to a lot of people and don't vet them all in advance.
As your own quote says: "After considering the available evidence, the Office did not pursue charges under these statutes against any of the individuals discussed in Section IV above—with the exception of FARA charges against Paul Manafort and Richard Gates based on their activities on behalf of Ukraine [not Russia]."
1: https://www.factcheck.org/2019/04/what-the-mueller-report-sa...
2: https://www.theguardian.com/us-news/ng-interactive/2019/apr/...
Why cover up the meetings and contacts then? why obstruct the investigation?
I'd love to see someone do a teardown or analysis on the voting machines or that "F" vote curve. But that probably won't happen for another 30 years until this all blows over and we can talk about it objectively again.
It sounds like swing voters didn't really care about Trump's scandals - they perhaps were just frustrated with his conduct and handling of the pandemic and ensuing social unrest.
This was misleading due to me misunderstanding and my own biases.
As least try and understand the details of what is going on.
Really? My impression was that they were the only ones who cared (in the sense that they could make a decision one way or the other, as opposed to being fated to a decision by one's sociopolitical loyalties/hatreds).
https://www.intelligence.senate.gov/sites/default/files/docu...
And the evidence of a cover-up by the Trump Corporate IT director (Cho) is on the following pages.
>According to Cho, at the time of the suspicious activity, the domain maill.trumpemail.com belonged to the Trump Organization's email marketing company, Cendyn Hospitality Marketing.5142 Cho learned from Cendyn that the trump-email.com domain was originally created for Trump Hotels email marketing sometime between 2009 and 20115143 and the domain had been used as recently as November 2015 for Trump Hotel marketing emails.5144 At some point prior to September 29, 2016, the domain registration was transferred from Cendyn to the Trump Organization; internal emails suggested it may have occurred on September 23, 2016, around the time the press began inquiring, although Cho could not identify any specific date with certainty.5145 According to Cho, the Trump domain had been used to send mass marketing emails, but not to receive email.5146
>Cho looked up the IP addresses belonging to the two Alfa Bank servers. Based on a port scan of one server's IP address on October 1, 2016, Cho found that it was not configured as an email or web server: "It only had port 53 open, which is a port for DNS lookup."5147 From this, he inferred that both of the Alfa Bank servers were configured as DNS servers, and therefore could not have been used to transmit email communications to the Trump domain. 5148 Cho did not explain if he also conducted a port scan of the other Alfa Bank IP address, or how he determined that the configuration on October 1, 2016 would have been the same as the server's configuration during the time period in question.
>Cho did not recall conducting a system-wide review of the Trump Organization network to determine if there wer~ any connections from the Trump Organization side with any of the Alfa Bank servers.5149 Instead, he looked up the public IP addresses for two separate Alfa Bank email servers he had identified, which he then provided to Cendyn to check if Cendyn could identify communications involving those servers.5150 In response, Cendyn found six messages to Alfa Bank recipients from clients using one of its email applications, but stated that these communications were not connected to the Trump Organization.5151 Cendyn identified these as emails sent by existing banking or hotel customers of Cendyn through a meeting management application to an Alfa Bank email address.5152 Cho did not locate any substantive communications between the Trump Organization and the two Alfa Bank servers and did not pursue further investigation of the DNS activity.5
>Cendyn did not explain how the unusualDNS lookup activity might relate to those emails and did not filter its records to find information like the DNS logs at issue.515~ Nonetheless, based on Cendyn's findings, Cho concluded that the rough "correlation" between these email~ and the DNS logs might explain how the press had "put these together as some kind of activity between Alfa Bank and Cendyn, which happened to have one of their host names with our Trump name in it, 'Trump-email.com."'5155 The Committee did not engage C,endyn on this matter.
> Unprompted, the Committee also received two letters, dated March 16 and July 20, 2018, from an attorney representing Alfa Bank conveying the findings of internal investigations into the unusual DNS activity. The letters represented that Alfa Bank had retained Mandiant, acyber incident response firm, to conduct an internal investigation based on the DNS logs and had found no evidence of substantive communications between Alfa Bank and the Trump Organization.5156 However, one letter noted that Alfa Bank had "continue[d] to receive unsolicited marketing emails from an address allegedly affiliated with the Trump Organization," which it did not identify.5157 As to the cause of the DNS activity, that letter posited Mandiant's "working hypothesis is that the activity was caused by a marketing or spam campaign directed at Alfa Bank employees by a marketing server affiliated with the Trump Organization."5158
And then several paragraphs of blacked out text.
This check goes through a local recursive DNS server. You often have to have the DNS port open for recursive DNS servers to work properly (over UDP). Which would be the IP address where the lookup were to originate from.
How exactly is receiving a spam marketing email from a big hotel chain by a bank employee controversial?
>But Cendyn told CNN that its contract to provide email marketing services to the Trump Organization ended in March 2016 — weeks before the DNS lookups chronicled by the researchers started appearing. Cendyn told CNN that a different client had been communicating with Alfa Bank using Cendyn communications applications — a claim that Alfa Bank denied.
>Scrutinizing the Trump Organization’s online footprint, the researchers determined that for several months during the spring and summer of 2016, Internet servers at Alfa Bank in Russia, Spectrum Health in Michigan, and Heartland Payment Systems in New Jersey accounted for nearly all of the several thousand DNS lookups for a specific Trump Organization server (mail1.trump-email.com).
>Foer wrote that The Times hadn’t yet been in touch with the Trump campaign about the DNS data when the Trump email domain suddenly went offline. Odder still, four days later the Trump Organization created a new host — trump1.contact-client.com — and the very first DNS lookup to that new domain came from servers at Alfa Bank.
It's never even explained where the log comes from in the first place! How convenient!
Tried and true diversion tactic: a story that nobody can disprove and which will be believed even if it's denied. Yes, Prime Minister, S2E2, "Official Secrets", ©1987 BBC.
https://www.emptywheel.net/2021/09/22/john-durham-is-the-jim...
Or if you'd prefer a more technical discussion, Krebs has a nice update;
https://krebsonsecurity.com/2021/09/lawsuits-indictments-rev...
https://news.ycombinator.com/item?id=28629227
You might move the discussion there and away from this one.
Is HN somehow immune from the manipulation that much larger, much better funded sites have experienced (where ample evidence exists)?
This was not some criticism of HN, this was a valid question which people should ponder on. Presumably most of us HN readers do not expect the content to be targeted manipulation or disinformation. But we cannot be blind to the possibility... else what is the point of even being here?
When I am hitting HN (tonight at least) about every 15 minutes out of boredom, and I see a story pop up on the front page with rapidly increasing votes - especially a story that is rather controversial and not typically what HN people get uniformly excited about - I wonder if something unusual is going on.
Perhaps it really is a lot of pro-Trump HN readers using their Friday afternoons to upvote this story, but that also seems unlikely.
I don't think you need to invoke "pro-Trump readers" to explain why a story like this might get upvoted. Not everyone is a passionate partisan.
Presumably Eric Schmidt?