4 ms·
So, IMO (as a security researcher familiar with DNS) this article was pretty terrible. Here's a mirror of the actual source site, with links to the "data". htt
by acid__ 10y ago
So, IMO (as a security researcher familiar with DNS) this article was pretty terrible.
Here's a mirror of the actual source site, with links to the "data". http://gdd.i2p.xyz/ http://gdd.i2p.xyz/ "Data" in quotes because it's just easily falsifible text files. (From the content on the mirror, and this reddit account [1], I'm guessing that the original site was at http://gdd.i2p http://gdd.i2p )
You can find a diagram [2] provided by "Tea Leaves" that purports to show what was going on. Tea Leaves claims to have access to logs from CDCServices (which are included on the mirror), who are the authoriative DNS servers for "Trump-Email.com". Tea Leaves also claims that Trump-Email.com is owned by Trump (with 100% certainty... because of the WHOIS record... you can form your own opinion on that).
Tea Leaves also claims that only three IP addresses have made DNS requests for Trump-Email.com. Two of which (Tea Leaves claims) are associated with Alfa Bank in Russia, and one of which is associated with Spectrum Health. (See http://gdd.i2p.xyz/ http://gdd.i2p.xyz/ for a conspiracy theorist rant about Spectrum Health.)
Tea Leaves claims -- but does not provide evidence for (neither does Slate) -- that mail1.Trump-Email.com somehow restricts access to only these IP addresses. Tea Leaves claims -- but also does not provide evidence for -- that the DNS records for Trump-Email.com were pulled after Alfa Bank was contacted for a statement.
I do recommend reading http://gdd.i2p.xyz/ http://gdd.i2p.xyz/ if this is interesting to you.
[1] https://www.reddit.com/user/LeavesTeaLeaves https://www.reddit.com/user/LeavesTeaLeaves
[2] https://imgur.com/SCv8X9n https://imgur.com/SCv8X9n
- meowface 10y agoI agree (and I am no fan of Trump, and would never vote for him). "Tea Leaves" makes one other interesting claim: >Different in every way from traffic seen on adjacent servers managed by the same server company, this specially configured server has been exclusively corresponding with Alfa-Bank and Spectrum If he can back up the claims about IP restriction (how could he really prove this, anyway?) & the traffic truly being different from all other Cendyn mail domains, then this does deserve some further scrutiny. >Tea Leaves claims -- but also does not provide evidence for -- that the DNS records for Trump-Email.com were pulled after Alfa Bank was contacted for a statement. I actually have access to some of the same research systems and can confirm that that part is accurate. (I can provide full evidence if you like.) It doesn't necessarily mean anything nefarious, though. The Trump campaign formally stated it was an old record that's no longer in use, so decommissioning the domain isn't necessarily unusual.
- kobayashi 10y agoCan you say as to how long the trump-email[dot]com was active before it started SERVFAILing? Also, I'd love to see the evidence if you're actually able to provide it.
- hackuser 10y ago> decommissioning the domain isn't necessarily unusual It is the timing that is unusual: The Trump organization decommissioned the domain right after Alfa Bank - and only Alfa Bank, not the Trump organization - was asked about it. It's very unlikely to be coincidence. And according to the source, the Trump org setup a new domain to replace it and it was first contacted by Alfa. Both are strong evidence of coordination between humans at Alfa Bank and Trump org. to secure and continue the communication. What they were communicating, of course, is unknown to us.
- detaro 10y agoHere is one of the quoted experts being unhappy with how their words are used to support the article: https://krypt3ia.wordpress.com/2016/11/01/shits-gone-plaid-gdd53-and-slate/ https://krypt3ia.wordpress.com/2016/11/01/shits-gone-plaid-g...
- hackuser 10y ago> Here's a mirror of the actual source site, with links to the "data". http://gdd.i2p.xyz/ http://gdd.i2p.xyz/ The source says they have no idea what that host is; it's not clear that it's an accurate mirror.