Trump’s Russian Bank Account

Trump and Russia’s largest private bank communicated via a hidden server
since at least 2016 May.   The RData for this host were served
by the Central Dynamics (CC-801) authority resolvers ns{1,2,3}.cdcservices.com:

$ORIGIN trump-email.com.

$TTL 3600

trump-email.com. IN TXT "Internet Solution from Cendyn.com."

trump-email.com. IN TXT "v=spf1 ip4:198.91.42.0/23 ip4:64.135.26.0/24 ip4:64.95.241.0/24 ip4:206.191.130.0/24 ip4:63.251.151.0/24 ip4:69.25.15.0/24 mx ~all"

trump-email.com. IN SOA ns1.cdcservices.com. postmaster.centralservices.local. (2012062509 1200 120 1209600 3600);

mail1 IN A 66.216.133.29 ;

Trump’s host mail1.trump-email.com operated a Listrak virtual mail transfer agent outside the SPF sending range, configured for outbound delivery.   Hosts receiving mail from Trump’s host would validate the forward and reverse, causing DNS lookups.

Since May of 2016 only two networks resolved the mail1.trump-email.com host, AS15632 (JSC Alfa-Bank) and AS30710 (Spectrum Health).
Alfa Bank is Russia’s largest bank and Spectrum Health is a integrated, managed care health care organization in Michigan.

These forward lookups come from Tea’s eepsite http://gdd.i2p and match the reverse resolutions.

яркий

When a reporter called Alfa Bank for comment on September 21, the zone for mail1.trump-email.com was removed from ns1 and ns3.cdcservices.com causing RCODE=2 (Server Failure), and ns2 returned empty referrals.  Since mail1 was unresolvable, Trump renamed the host to trump1.contact-client.com on October 27.  The first host iterating for this domain was Alfa Bank on 2016-09-27 at 19:48 hours:

"ts": "1475005735",
"src_ip": "217.12.97.15",
"qname": "trump1.contact-client.com",
"node_id": "ams-ix23",
"qdcount": 1,
"qtype": 1,
"rd": 0

But the hostname trump1.contact-client.com appeared in the first passive DNS database three days later, and still has not appeared in some passive collections.

В тихом омуте черти водятся

Alfa Bank knew that Trump renamed his host through ongoing email delivery and HELO/EHLO resolutions, or another channel.  Trump and Alfa Bank have since coordinated their move to an office communications channel.

• Only Trump, Spectrum and Alfa Bank used the mail server.
• All other Trump messages went through normal delivery.
• When Alfa Bank was asked, Trump immediately changed his server name…
• … and Alfa Bank knew the new hostname immediately, before anyone.

Trump has active business with a Russian bank.   More on Tea’s site.

NATO fought the Cold War and kept Europe free. Does this account explain why the US now debates whether to surrender a war it has already won?