Thread by @SlickRockWeb

New reporting by @adamgoldmanNYT on the very odd internet traffic between a Trump registered domain, Alfa Bank in Moscow, Spectrum Health and Heartland Payment processing back in mid 2016. It continues to baffle researchers and the Intel community ... 1/14

https://twitter.com/adamgoldmanNYT/status/1443685324253765632

A previously non-public intel report by Daniel J Jones has now been unredacted & publicly available as a court doc in an ongoing lawsuit. @briankrebs reported on this last week and has a link to the full document in his article ... 2/14 #infosec #infoOps krebsonsecurity.com/2021/09/lawsui…

Oddly this mysterious 2016 traffic before the election was between a Trump registered domain, Russian Alfa-Bank, Spectrum Health & Heartland Payments & was the focus of the Durham investigation touted by Trump & his supporters. Durham's findings resulted in more questions 3/14

First highly recommend re-reading this 2018 article on the event by Dexter Filkins. So in 2016 data scientists reported an odd stream of internet traffic between a Trump Org domain, Alfa Bank, a Michigan Hospital and a Payment Co. #infosec #infoOps 4/14

https://twitter.com/FranklinFoer/status/1049267910705856512

This odd traffic occurred shortly after Trump became the GOP frontrunner for President & continued up through Sept 2016. In October 2016 the New York Times & Slate Magazine both published articles revealing these strange comms between a Trump domain and Alfa-Bank in Moscow. 5/14

Over the past 5 yrs many different explanations have been floated 2 explain these odd communications by the Trump organization, Alfa-Bank & Trump supporters, things like it didnt happen, they were hacked, it was marketing email spam, anti-virus programs gone haywire, ect..6/14

None of the excuses have frankly made sense or even been touted consistently by all the parties involved. In fact many of the explanations by one party involved have conflicted with one of the other parties involved. Or more recently that the data was faked somehow 7/14

The common excuse touted was that communications were merely from marketing email spam. There r significant problems with this explanation, not withstanding, that it would have been the easiest excuse to use 4 all parties involved from the very beginning if it had been true 8/14

The CEO of Cendyn the vendor who had been hired by Trump organization 2 manage marketing emails & some online hospitality applications (Metron) said to the FBI that they stopped doing work & stopped email campaigns 4 Trump in March 2016. Two months before the strange comms 9/14

This seems to be backed up by the fact that multiple cybersecurity companies hired by Alfa-Bank and ones that have looked independently could find no example of a Trump marketing email sent to Alfa-Bank, or Spectrum Health or Heartland Payments during this period. 10/14

We also looked at RIPEstat data and various spam blocklist sites (as did Daniel Jones) and could not find any spam flag for the Trump domain IP address in question after March 2016. 11/14

The DNS lookups also did not match the typical periodicity of communications caused by marketing emails and the Trump Organization server was not configured to effectively send bulk or marketing email (spam) and there was no SPF record set for that domain 12/14 #infosec #infoOps

In the Daniel J Jones' report, which is exceptionally thorough, they did statistical analysis that indicated that the internet traffic between these entities (Trump, Alfa-Bank ect..) was human-directed events and not computer or software directed events. 13/15

At one point the FBI also tried 2 downplay the traffic & said it was most likely from marketing emails or suggested it might be encrypted Tor comms (neither are likely correct) and it just highlights the fact that the FBI either bungled the investigation and/or has no idea 14/15

The Daniel J Jones analysis entertains a number of possible explanations, malware, covert communications channel, comms from a Cendyn application like Metron and a few others. Again highly recommend reading the report which can be found here. krebsonsecurity.com/wp-content/upl…

And this really needs to be cleared up. Does this FBI official really exist (or is it another fake one like the recently botched Reuters story about clearing Alex Jones of anything to do with Jan 6th). And did the FBI ever investigate the Trump / Alfa Bank thing

https://twitter.com/stringwallapp/status/1443678351877709827