6 ms·

You can tell this is political drivel because the only thing here is speculation on the motivation of the delivery of the information, not on the veracity of th

You can tell this is political drivel because the only thing here is speculation on the motivation of the delivery of the information, not on the veracity of the information itself. Krebson Security's take on this is the best one I've seen. Their conclusion is solid: https://krebsonsecurity.com/2021/09/lawsuits-indictments-revive-trump-alfa-bank-story/ https://krebsonsecurity.com/2021/09/lawsuits-indictments-rev...

opwieurposiu 5y ago
Actually there are plenty of reasons to doubt the veracity of the dns data this narrative is based on. https://justthenews.com/sites/default/files/2020-04/Ankura_AlfaBank_ResearchAnalysis_Apr2020dh.pdf.pdf.pdf https://justthenews.com/sites/default/files/2020-04/Ankura_A...
- WoahNoun 5y ago
  Is there any evidence in that article that you can cite for us? That website was started by an extremely pro-Trump Fox News contributor and I have no intention on clicking on it.
  - cnst 5y ago
    It's a PDF document produced by Ankura Consulting Group. I didn't read it, but it's extremely trivial to generate outgoing DNS traffic from many networks with their own mail and DNS infrastructure (i.e., any big bank that has their own IT department), to any other domain name. All you do is connect to their mail server, and provide the domain name to query in MAIL FROM via SMTP. Which is basically the whole evidence that connects the parties together.
    - WoahNoun 5y ago
      Alfa Bank and the Trump campaign keep saying the DNS look-ups came from marketing emails. Did the DNS look-ups happen or didn't they?
      - cnst 5y ago
        DNS queries are rarely logged. Ankara reports that the use of the domains in question is consistent with marketing campaigns in the hospitality industry. I'm still confused where the original DNS lookup dataset came from and why is it trusted. It cannot possibly be a complete dataset of all the requests for the domain in question. If anything, there's way more bot activity happening during a period of 4.5 months. A mere 10 IP addresses accounting for all requests that were ever made during a period of 4.5 months, for a public domain name (proof available from DomainTools per Ankara), is not realistic.
        WoahNoun 5y ago
        The trump domain wasn't set-up for bulk marketing email and wasn't configured like the other trump marketing domains. >The report notes that unlike other domains the Trump Organization used to send mass marketing emails, the domain at issue — mail1.trump-email.com — was configured in such a way that would have prevented it from effectively sending marketing or bulk emails. Or at least prevented most of the missives sent through the domain from ever making it past spam filters. >Nor was the domain configured like other Trump Organization domains that demonstrably did send commercial email, Jones’ analysis found. Also, the mail1.trump-email.com domain was never once flagged as sending spam by any of the 57 different spam block lists published online at the time. >“If large amounts of marketing emails were emanating from mail1.trump-email.com, it’s likely that some receivers of those emails would have marked them as spam,” Jones’ 2018 report reasons. “Spam is nothing new on the internet, and mass mailings create easily observed phenomena, such as a wide dispersion of backscatter queries from spam filters. No such evidence is found in the logs.”
        WoahNoun 5y ago
        The domain became public after the public reporting. Show me where in the Ankara report that shows that the domain mail1.trump-email.com was public during the period of the DNS activity. >Also, the mail1.trump-email.com domain was never once flagged as sending spam by any of the 57 different spam block lists published online at the time.
        5y ago
cnst 5y ago
Krebs literally posts a PNG image citing court filings listing 10 IP addresses responsible for 100% of DNS traffic for a public domain name over a period of 4.5 months. Actual origin of the underlying data is never explained, of course, but I do like how the total of the 10 is explicitly listed as 100%! Nevermind the internet bots scanning the whole internet, DomainTools and PassiveTotal reportedly having a long-term record of these same domain names since 2010 (for the "old" mail1 domain) and 2009 (for the "new" domain at the same IP address), respectively, and many other internet scanning services knowing about it, too, as per Ankura's 2020 report linked in the sibling comment. When did Krebs stop being an investigative journalist and went to being a political hack saying we shouldn't prosecute people for lying to the authorities to spur phantom investigations? Most ironic is an out of context quote from Paul Vixie about a conspiracy with out-of-band communication for DNS discovery, because clearly there's no other possible explanation for discovering public FQDNs that have been known to exist since 2009! Meanwhile, if you've ever looked at Paul's Twitter feed over the last 4 years, it's pretty clear which party he supports and which single president he despises and would have done anything to get rid of; but I'm sure that has no relevance to the case, and he is still being objective in suggesting conspiracy theories that involve DNS in some way, without ever bothering to verify the authenticity of the data that he's presented with to make public comments on. How's Krebs' the best take if it's the same lies propagated by the mainstream media? Not to mention that most DNS software doesn't even log any non-AXFR DNS requests at all (DNS works really fast over UDP and is very cheap unlike HTTP, and logging all requests to disk will slow down peak performance considerably), plus where the log comes from is never explained, either. Reminds me of diversion of media attention through "a story that nobody can disprove and which will be believed even if it's denied". Yes, Prime Minister, S2E2, "Official Secrets", ©1987 BBC.

opwieurposiu 5y ago

Actually there are plenty of reasons to doubt the veracity of the dns data this narrative is based on. https://justthenews.com/sites/default/files/2020-04/Ankura_AlfaBank_ResearchAnalysis_Apr2020dh.pdf.pdf.pdf https://justthenews.com/sites/default/files/2020-04/Ankura_A...

WoahNoun 5y ago
Is there any evidence in that article that you can cite for us? That website was started by an extremely pro-Trump Fox News contributor and I have no intention on clicking on it.
- cnst 5y ago
  It's a PDF document produced by Ankura Consulting Group. I didn't read it, but it's extremely trivial to generate outgoing DNS traffic from many networks with their own mail and DNS infrastructure (i.e., any big bank that has their own IT department), to any other domain name. All you do is connect to their mail server, and provide the domain name to query in MAIL FROM via SMTP. Which is basically the whole evidence that connects the parties together.
  - WoahNoun 5y ago
    Alfa Bank and the Trump campaign keep saying the DNS look-ups came from marketing emails. Did the DNS look-ups happen or didn't they?
    - cnst 5y ago
      DNS queries are rarely logged. Ankara reports that the use of the domains in question is consistent with marketing campaigns in the hospitality industry. I'm still confused where the original DNS lookup dataset came from and why is it trusted. It cannot possibly be a complete dataset of all the requests for the domain in question. If anything, there's way more bot activity happening during a period of 4.5 months. A mere 10 IP addresses accounting for all requests that were ever made during a period of 4.5 months, for a public domain name (proof available from DomainTools per Ankara), is not realistic.
      - WoahNoun 5y ago
        The trump domain wasn't set-up for bulk marketing email and wasn't configured like the other trump marketing domains. >The report notes that unlike other domains the Trump Organization used to send mass marketing emails, the domain at issue — mail1.trump-email.com — was configured in such a way that would have prevented it from effectively sending marketing or bulk emails. Or at least prevented most of the missives sent through the domain from ever making it past spam filters. >Nor was the domain configured like other Trump Organization domains that demonstrably did send commercial email, Jones’ analysis found. Also, the mail1.trump-email.com domain was never once flagged as sending spam by any of the 57 different spam block lists published online at the time. >“If large amounts of marketing emails were emanating from mail1.trump-email.com, it’s likely that some receivers of those emails would have marked them as spam,” Jones’ 2018 report reasons. “Spam is nothing new on the internet, and mass mailings create easily observed phenomena, such as a wide dispersion of backscatter queries from spam filters. No such evidence is found in the logs.”
      - WoahNoun 5y ago
        The domain became public after the public reporting. Show me where in the Ankara report that shows that the domain mail1.trump-email.com was public during the period of the DNS activity. >Also, the mail1.trump-email.com domain was never once flagged as sending spam by any of the 57 different spam block lists published online at the time.
        5y ago

cnst 5y ago

Krebs literally posts a PNG image citing court filings listing 10 IP addresses responsible for 100% of DNS traffic for a public domain name over a period of 4.5 months. Actual origin of the underlying data is never explained, of course, but I do like how the total of the 10 is explicitly listed as 100%! Nevermind the internet bots scanning the whole internet, DomainTools and PassiveTotal reportedly having a long-term record of these same domain names since 2010 (for the "old" mail1 domain) and 2009 (for the "new" domain at the same IP address), respectively, and many other internet scanning services knowing about it, too, as per Ankura's 2020 report linked in the sibling comment. When did Krebs stop being an investigative journalist and went to being a political hack saying we shouldn't prosecute people for lying to the authorities to spur phantom investigations? Most ironic is an out of context quote from Paul Vixie about a conspiracy with out-of-band communication for DNS discovery, because clearly there's no other possible explanation for discovering public FQDNs that have been known to exist since 2009! Meanwhile, if you've ever looked at Paul's Twitter feed over the last 4 years, it's pretty clear which party he supports and which single president he despises and would have done anything to get rid of; but I'm sure that has no relevance to the case, and he is still being objective in suggesting conspiracy theories that involve DNS in some way, without ever bothering to verify the authenticity of the data that he's presented with to make public comments on. How's Krebs' the best take if it's the same lies propagated by the mainstream media? Not to mention that most DNS software doesn't even log any non-AXFR DNS requests at all (DNS works really fast over UDP and is very cheap unlike HTTP, and logging all requests to disk will slow down peak performance considerably), plus where the log comes from is never explained, either. Reminds me of diversion of media attention through "a story that nobody can disprove and which will be believed even if it's denied". Yes, Prime Minister, S2E2, "Official Secrets", ©1987 BBC.