Was a Trump Server Communicating With Russia?

So, IMO (as a security researcher familiar with DNS) this article was pretty terrible.<p>Here&#x27;s a mirror of the actual source site, with links to the &quot;data&quot;. <a href="http:&#x2F;&#x2F;gdd.i2p.xyz&#x2F;" rel="nofollow">http:&#x2F;&#x2F;gdd.i2p.xyz&#x2F;</a> &quot;Data&quot; in quotes because it&#x27;s just easily falsifible text files. (From the content on the mirror, and this reddit account [1], I&#x27;m guessing that the original site was at <a href="http:&#x2F;&#x2F;gdd.i2p" rel="nofollow">http:&#x2F;&#x2F;gdd.i2p</a> )<p>You can find a diagram [2] provided by &quot;Tea Leaves&quot; that purports to show what was going on. Tea Leaves claims to have access to logs from CDCServices (which are included on the mirror), who are the authoriative DNS servers for &quot;Trump-Email.com&quot;. Tea Leaves also claims that Trump-Email.com is owned by Trump (with 100% certainty... because of the WHOIS record... you can form your own opinion on that).<p>Tea Leaves also claims that only three IP addresses have made DNS requests for Trump-Email.com. Two of which (Tea Leaves claims) are associated with Alfa Bank in Russia, and one of which is associated with Spectrum Health. (See <a href="http:&#x2F;&#x2F;gdd.i2p.xyz&#x2F;" rel="nofollow">http:&#x2F;&#x2F;gdd.i2p.xyz&#x2F;</a> for a conspiracy theorist rant about Spectrum Health.)<p>Tea Leaves claims -- but does not provide evidence for (neither does Slate) -- that mail1.Trump-Email.com somehow restricts access to only these IP addresses. Tea Leaves claims -- but also does not provide evidence for -- that the DNS records for Trump-Email.com were pulled after Alfa Bank was contacted for a statement.<p>I do recommend reading <a href="http:&#x2F;&#x2F;gdd.i2p.xyz&#x2F;" rel="nofollow">http:&#x2F;&#x2F;gdd.i2p.xyz&#x2F;</a> if this is interesting to you.<p>[1] <a href="https:&#x2F;&#x2F;www.reddit.com&#x2F;user&#x2F;LeavesTeaLeaves" rel="nofollow">https:&#x2F;&#x2F;www.reddit.com&#x2F;user&#x2F;LeavesTeaLeaves</a><p>[2] <a href="https:&#x2F;&#x2F;imgur.com&#x2F;SCv8X9n" rel="nofollow">https:&#x2F;&#x2F;imgur.com&#x2F;SCv8X9n</a>

What I want to know: who is creating these logs where, why are they allowing the researchers that have access to them to talk about such details, and what does privacy legislation in the areas they operate in has to say about it?

This is the method of conspiracy theory, is it not? A peculiar observation is made, analyzed obsessively, and fitted into a speculative narrative.<p>Honestly, I&#x27;m all for further discrediting an already-discredited campaign, but this seems like a genuinely bizarre way to go about it.

This link (<a href="https:&#x2F;&#x2F;krypt3ia.wordpress.com&#x2F;2016&#x2F;10&#x2F;08&#x2F;gdd53-a-russian-hosted-i2p-site-that-claims-trumps-email-system-had-ties-to-alfabank-russia&#x2F;" rel="nofollow">https:&#x2F;&#x2F;krypt3ia.wordpress.com&#x2F;2016&#x2F;10&#x2F;08&#x2F;gdd53-a-russian-ho...</a>) actually has links to the data.

What I find more interesting than the story itself is how this DNS technique could be used for surveillance.<p>Could anyone elaborate at a technical level what someone could do to prevent this kind of metadata in communications from being detected? E.g. are there any messaging apps that can obscure traffic analysis like this?

Shane Harris from the Intercept said the following on Twitter: &quot;FWIW at least five outlets including The Intercept have been looking at this for weeks and decided it didn&#x27;t add up&quot;<p><a href="https:&#x2F;&#x2F;twitter.com&#x2F;samfbiddle&#x2F;status&#x2F;793264979399045120" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;samfbiddle&#x2F;status&#x2F;793264979399045120</a>

&gt; “I’ve never seen a server set up like that.”<p>Probably only uses Microsoft Windows Server 2012.

Why is this on HN? If we are going to open Pandora&#x27;s Box here, we need to be posting regularly about how HC is breaking the law and how Google, Facebook, and Twitter are suppressing free speech. I don&#x27;t think anyone wants to go there so these posts should be removed.

And? What is this article even suggesting?

I find the author&#x27;s fogginess about DNS infuriating. I think if he&#x27;s going to cover something this important in such a suggestive manner he does have a duty to get to grips with what it is and roughly how it works and make that plain to a lay audience.<p>He makes DNS sound intrinsically sinister.

So someone at a bank in russia stayed at a trump hotel once, and now he gets spam from a trump marketing server. Can someone explain how this is a sinister consiracy to stop Hillary&#x27;s war with Russia in Syria and Ukraine?

[removed]

Whatever it takes to get the spotlight off HRC being investigated by the FBI.