More than 250 subdomains of domains registered to the Trump Organization redirect traffic to computers in St. Petersburg, Russia.
Mueller Justice League #ItsMuellerTime
The range of IP addresses these subdomains occupy on this server is 46.161.27.184-46.161.27.200, a block owned by HostKey.ru, also known as Mir Telematiki LTD. The odd hop to a server in what is reported as Siberia has an IP address of 91.218.245.201. An interesting note, few of the IP addresses in this large block belonging to HostKey.ru are actually hosting websites; the only ones currently known are 91.218.245.201-204.
This IP block has slightly different Whois registration information than other blocks owned by Hostkey.ru. The contact listed for this IP block is a Andrey Shevchenko, who started working at GazProm approximately a month after these subdomains were set up.
With few exceptions, these subdomains were set up in August 2013. Alienvault’s OTX service contains records of some of these subdomains being in use as recently as March, 2017. Many, but not all, are still active and the DNS records are still set to allow these subdomains to route to the Russian servers.
Take for example the subdomain dsfs.donald-trump-entrepreneurs-initative.com. As with the other subdomains, no user-visible content is present here. We ran a traceroute on this subdomain to reveal the path taken by network traffic to this address. Here is what we found:
Of particular note: the IP address 91.218.245.201 in the traceroute results is apparently located far east of Moscow, near the town of Vanavara in the desolate Russian precinct Krasnoyarsk Krai. This location is very near the site of the Tunguska event in 1908, an apparent meteor explosion that flattened nearly 800 square miles of forest. However, there seems to be no appreciable increase in latency (the time it takes to go from one server to another) while making this round trip. Instead, it shows approximately the same latency as the servers known to be located in Moscow.
This IP address along with all the IPs in the route once the traffic enters Russia, belongs to the same service provider used by one of the servers hosting Wikileaks.org. This server was established approximately one week before the Podesta emails were released, and is located in Moscow, with IP location tools showing both the Trump subdomain traffic transiting through and Wikileaks hosted in a building located near the Kremlin. Wikileaks has multiple servers, two located in Moscow, and the route for that traffic also includes the trip to Siberia, again with little difference in latency when making this long round trip.