You can see an example of the DNS logs collected on page 803 of the Senate Intelligence report rather than reading blog. Clearly the Alfa bank did DNS lookups o

You can see an example of the DNS logs collected on page 803 of the Senate Intelligence report rather than reading blog. Clearly the Alfa bank did DNS lookups of the Trump domain and the explanation doesn't pass the smell test. https://www.intelligence.senate.gov/sites/default/files/documents/report_volume5.pdf https://www.intelligence.senate.gov/sites/default/files/docu... And the evidence of a cover-up by the Trump Corporate IT director (Cho) is on the following pages. >According to Cho, at the time of the suspicious activity, the domain maill.trumpemail.com belonged to the Trump Organization's email marketing company, Cendyn Hospitality Marketing.5142 Cho learned from Cendyn that the trump-email.com domain was originally created for Trump Hotels email marketing sometime between 2009 and 20115143 and the domain had been used as recently as November 2015 for Trump Hotel marketing emails.5144 At some point prior to September 29, 2016, the domain registration was transferred from Cendyn to the Trump Organization; internal emails suggested it may have occurred on September 23, 2016, around the time the press began inquiring, although Cho could not identify any specific date with certainty.5145 According to Cho, the Trump domain had been used to send mass marketing emails, but not to receive email.5146 >Cho looked up the IP addresses belonging to the two Alfa Bank servers. Based on a port scan of one server's IP address on October 1, 2016, Cho found that it was not configured as an email or web server: "It only had port 53 open, which is a port for DNS lookup."5147 From this, he inferred that both of the Alfa Bank servers were configured as DNS servers, and therefore could not have been used to transmit email communications to the Trump domain. 5148 Cho did not explain if he also conducted a port scan of the other Alfa Bank IP address, or how he determined that the configuration on October 1, 2016 would have been the same as the server's configuration during the time period in question. >Cho did not recall conducting a system-wide review of the Trump Organization network to determine if there wer~ any connections from the Trump Organization side with any of the Alfa Bank servers.5149 Instead, he looked up the public IP addresses for two separate Alfa Bank email servers he had identified, which he then provided to Cendyn to check if Cendyn could identify communications involving those servers.5150 In response, Cendyn found six messages to Alfa Bank recipients from clients using one of its email applications, but stated that these communications were not connected to the Trump Organization.5151 Cendyn identified these as emails sent by existing banking or hotel customers of Cendyn through a meeting management application to an Alfa Bank email address.5152 Cho did not locate any substantive communications between the Trump Organization and the two Alfa Bank servers and did not pursue further investigation of the DNS activity.5 >Cendyn did not explain how the unusualDNS lookup activity might relate to those emails and did not filter its records to find information like the DNS logs at issue.515~ Nonetheless, based on Cendyn's findings, Cho concluded that the rough "correlation" between these email~ and the DNS logs might explain how the press had "put these together as some kind of activity between Alfa Bank and Cendyn, which happened to have one of their host names with our Trump name in it, 'Trump-email.com."'5155 The Committee did not engage C,endyn on this matter. > Unprompted, the Committee also received two letters, dated March 16 and July 20, 2018, from an attorney representing Alfa Bank conveying the findings of internal investigations into the unusual DNS activity. The letters represented that Alfa Bank had retained Mandiant, acyber incident response firm, to conduct an internal investigation based on the DNS logs and had found no evidence of substantive communications between Alfa Bank and the Trump Organization.5156 However, one letter noted that Alfa Bank had "continue[d] to receive unsolicited marketing emails from an address allegedly affiliated with the Trump Organization," which it did not identify.5157 As to the cause of the DNS activity, that letter posited Mandiant's "working hypothesis is that the activity was caused by a marketing or spam campaign directed at Alfa Bank employees by a marketing server affiliated with the Trump Organization."5158 And then several paragraphs of blacked out text.