4 ms·

It's a pretty common and standard practice for the mail servers to check that the domain specified in the MAIL FROM command of SMTP does exist. If it doesn't, t

by cnst 5y ago

It's a pretty common and standard practice for the mail servers to check that the domain specified in the MAIL FROM command of SMTP does exist. If it doesn't, the mail is immediately rejected at the SMTP level. This check goes through a local recursive DNS server. You often have to have the DNS port open for recursive DNS servers to work properly (over UDP). Which would be the IP address where the lookup were to originate from. How exactly is receiving a spam marketing email from a big hotel chain by a bank employee controversial?

WoahNoun 5y ago
Because if it was a marketing campaign, there would be other IP addresses doing a DNS lookup. Alfa bank was 77% of the DNS requests and another 20% were from Spectrum Health which is associated with the DeVos family. That doesn't sound like a marketing campaign. And the marketing company said they stopped sending emails before the DNS lookups happened. The Trump org also created a new domain and the first DNS request was Alfa bank. >But Cendyn told CNN that its contract to provide email marketing services to the Trump Organization ended in March 2016 — weeks before the DNS lookups chronicled by the researchers started appearing. Cendyn told CNN that a different client had been communicating with Alfa Bank using Cendyn communications applications — a claim that Alfa Bank denied. >Scrutinizing the Trump Organization’s online footprint, the researchers determined that for several months during the spring and summer of 2016, Internet servers at Alfa Bank in Russia, Spectrum Health in Michigan, and Heartland Payment Systems in New Jersey accounted for nearly all of the several thousand DNS lookups for a specific Trump Organization server (mail1.trump-email.com). >Foer wrote that The Times hadn’t yet been in touch with the Trump campaign about the DNS data when the Trump email domain suddenly went offline. Odder still, four days later the Trump Organization created a new host — trump1.contact-client.com — and the very first DNS lookup to that new domain came from servers at Alfa Bank.
- cnst 5y ago
  That log of 10 IP addresses accounting for 100% of DNS requests over a period of 4.5 months (from Krebs) is complete BS. The domain name in question was publicly known — records available in DomainTools per Ankura report. There's way more background DNS scanning of public names going on, all the time, for there to not be maybe an order of magnitude more requests. It's never even explained where the log comes from in the first place! How convenient! Tried and true diversion tactic: a story that nobody can disprove and which will be believed even if it's denied. Yes, Prime Minister, S2E2, "Official Secrets", ©1987 BBC.

by cnst 5y ago

WoahNoun 5y ago

Because if it was a marketing campaign, there would be other IP addresses doing a DNS lookup. Alfa bank was 77% of the DNS requests and another 20% were from Spectrum Health which is associated with the DeVos family. That doesn't sound like a marketing campaign. And the marketing company said they stopped sending emails before the DNS lookups happened. The Trump org also created a new domain and the first DNS request was Alfa bank. >But Cendyn told CNN that its contract to provide email marketing services to the Trump Organization ended in March 2016 — weeks before the DNS lookups chronicled by the researchers started appearing. Cendyn told CNN that a different client had been communicating with Alfa Bank using Cendyn communications applications — a claim that Alfa Bank denied. >Scrutinizing the Trump Organization’s online footprint, the researchers determined that for several months during the spring and summer of 2016, Internet servers at Alfa Bank in Russia, Spectrum Health in Michigan, and Heartland Payment Systems in New Jersey accounted for nearly all of the several thousand DNS lookups for a specific Trump Organization server (mail1.trump-email.com). >Foer wrote that The Times hadn’t yet been in touch with the Trump campaign about the DNS data when the Trump email domain suddenly went offline. Odder still, four days later the Trump Organization created a new host — trump1.contact-client.com — and the very first DNS lookup to that new domain came from servers at Alfa Bank.

cnst 5y ago
That log of 10 IP addresses accounting for 100% of DNS requests over a period of 4.5 months (from Krebs) is complete BS. The domain name in question was publicly known — records available in DomainTools per Ankura report. There's way more background DNS scanning of public names going on, all the time, for there to not be maybe an order of magnitude more requests. It's never even explained where the log comes from in the first place! How convenient! Tried and true diversion tactic: a story that nobody can disprove and which will be believed even if it's denied. Yes, Prime Minister, S2E2, "Official Secrets", ©1987 BBC.