Trump email server’s suspicious communication with Russian bank

This is a bit more disturbing than some e-mails that weren’t marked classified when they were originally sent or read, don’tchathink?

It all started when some of the nation’s top white-hat hackers started studying patterns of cyberattacks on American political entites. Things quickly turned strange when they discovered bizarre web server lookups between a Trump organization mail server and two Russian computers.

The irregular pattern of server lookups actually resembled the pattern of human conversation—conversations that began during office hours in New York and continued during office hours in Moscow. It dawned on the researchers that this wasn’t an attack, but a sustained relationship between a server registered to the Trump Organization and two servers registered to an entity called Alfa Bank.

The researchers had initially stumbled in their diagnosis because of the odd configuration of Trump’s server.

“I’ve never seen a server set up like that,” says Christopher Davis, who runs the cybersecurity firm HYAS InfoSec Inc. and won a FBI Director Award for Excellence for his work tracking down the authors of one of the world’s nastiest botnet attacks.

“It looked weird, and it didn’t pass the sniff test.”

The server was first registered to Trump’s business in 2009 and was set up to run consumer marketing campaigns. It had a history of sending mass emails on behalf of Trump-branded properties and products. Researchers were ultimately convinced that the server indeed belonged to Trump… but now this capacious server handled a strangely small load of traffic, such a small load that it would be hard for a company to justify the expense and trouble it would take to maintain it. “I get more mail in a day than the server handled,” Davis says.

That wasn’t the only oddity.

When the researchers pinged the server, they received error messages. They concluded that the server was set to accept only incoming communication from a very small handful of IP addresses. A small portion of the logs showed communication with a server belonging to Michigan-based Spectrum Health. (The company said in a statement: “Spectrum Health does not have a relationship with Alfa Bank or any of the Trump organizations. We have concluded a rigorous investigation with both our internal IT security specialists and expert cyber security firms. Our experts have conducted a detailed analysis of the alleged internet traffic and did not find any evidence that it included any actual communications (no emails, chat, text, etc.) between Spectrum Health and Alfa Bank or any of the Trump organizations. While we did find a small number of incoming spam marketing emails, they originated from a digital marketing company, Cendyn, advertising Trump Hotels.”)

ighty-seven percent of the DNS lookups involved the two Alfa Bank servers. “It’s pretty clear that it’s not an open mail server,” Camp told me. “These organizations are communicating in a way designed to block other people out.”

Now what was that about Clinton’s e-mail? Go read the whole thing here.

[su_rcveontent]

By: dave-dr-gonzo

David Hirsch, a.k.a. Dave "Doctor" Gonzo*, is a renegade record producer, video producer, writer, reformed corporate shill, and still-registered lobbyist for non-one-percenter performing artists and musicians. He lives in a heavily fortified compound in one of Manhattan's less trendy neighborhoods.

* Hirsch is the third person to use the pseudonym, a not-so-veiled tribute to journalist and author Hunter S. Thompson, with the permission of his predecessors Gene Gaudette of American Politics Journal (currently webmaster and chief bottlewasher at Liberaland) and Stephen Meese at Smashmouth Politics.