Replies

You might find this interesting:

Hillary Clinton’s private email is connected to a Clinton aide and part of a wider private email network used by associates of the Clinton family, Gotnews.com has learned.

In particular we can connect Justin Cooper, a former ghostwriter for Clinton Clinton and current senior aide in the Clintons’ influence peddling operation nexus.

Clinton has come under fire from the New York Times for illegally circumventing the federal records laws that require turning over emails and discourage the use of private email accounts.

Cooper traveled with Clinton extensively and helps the Clintons with their “finances, business matters, public relations, politics, the Clinton Family Foundation and the Clinton Foundation’s initiatives as well as the Clinton Global Initiative,” according to a fawning Wikipedia page. He is also on the board of the American University of Dubai.

Cooper also accompanied Clinton to North Korea when Clinton successfully secured the release of two American journalists, Laura Ling and Euna Lee, in August 2009. Did Clinton open his unsecured email in North Korea?

Another Clinton hand, Huma Abedin, was also involved with the consulting work on behalf of the Clintons while she worked for the State Department, according to the New York Times.

The revelation of personal and political intermixing suggests that the Clinton Inc. world is far more intertwined.

A tipster sent us this analysis earlier today.

Here are some basic details and the steps I took to find them about Hillary’s email server. Also some comments/thoughts.

I initially decided to look into it when I saw Anil Dash’s tweet about the MX Logic. As I mentioned on the phone, I had a client who had some issues with messages bouncing going into the MX Logic service before, so I was somewhat familiar with WHAT it was. It is a service owed and operated by McAfee that does SPAM filtering and virus/malware detection of inbound email. (I believe McAfee is now wholly owned by Intel.) In my client case, the MX Logic service front-ended a corporate Microsoft Exchange server; that got me wondering if that was in fact what was going on here (that there was an Exchange server sitting on in the internet somewhere vs using a hosted email solution like Office 365 or Google Apps). In IT circles, it is a pretty widely held belief that there are definite security downsides to running Exchange versus using a hosted solution.

So I started where Anil Dash tweeted, checking the DNS records using the dig command. It allows a user to poll the DNS zone for various records: MX (Mail eXchange), A (Address for Host), SOA (Start of Authority), etc. The initial finding showed that the zone and root record, clintonemail.com, was hosted at Network Solutions. Pretty much, you ask for hostname, any hostname, and it spits back the same IP address, 208.91.197.27…pretty common. It would NOT spit out a AXFR Zone Transfer, or the entire list of hosts.

I knew about the MX records pointing to MX Logic, so I wanted to see if there was maybe another mail server sitting out there accepting mail for the domain somewhere, similar to the setup I had seen before. So I started probing…www.clintonemail.com…ftp.clintonemail.com…remote…office…mail A HIT!

mail.clintonemail.com. 7200 IN A 64.94.172.146

It was the only host I could dream up with a different IP address. I probed that host a bit, gently, learning it was a Windows Server and that it was running Exchange, accepting connections on 80/HTTP, 443/HTTPS, and 143/IMAP. I did NOT attempt to communicate securely with the 993/IMAPSSL port, nor did I attempt a StartTLS session with 143 (to see if it kicked an IMAP connect up to an encrypted connection).

A traceroute of that IP address has it being hosted by a company called Internap Network Services. It is difficult to tell if it is a located host (a server sitting in their datacenter) or hosted (managed by them, and perhaps virtualized).

Having those two bits of info, I did some googling and found a few interesting hits:
• the Korean article about the hacked Sid Blumenthal email exchange with Hillary from March 2013 in which an email address was exposed, hdr22@clintonemail.com, that showed she pretty clearly was talking SecState stuff with the account[http://webcache.googleusercontent.com/search?q=cache:BhNHk_Xa8dgJ:m.mediatoday.co.kr/news/articleView.html?idxno=108775] and
• a WebBoar page that reflected that mail.clintonemail.com server being listed as the MX for ANOTHER interesting domain:presidentclinton.com

http://www.webboar.com/www/presidentclinton.com

Lo and behold, the IP address of mail.presidentclinton.com is the same as mail.clintonemail.com. Also, the GoDaddy SSL cert on the server lists mail.clintonemail.com as its Hostname.

That WebBoar page also mentions who is listed as a registrant on the domain, Justin Cooper. Doing a bit of google fu on that I found a Wikipedia page and learned he was a pretty senior aide with both Clintons and involved pretty deeply in their stuff. The WebBoar page also says there are 6 other domains associated with “Cooper, Justin” but none of them seem related, 3 of which are “in the past”.

It shows that “Justin Cooper” is associated with 110 sites, but again, nothing really pops out to me. http://www.webboar.com/whois-name/anVzdGluIGNvb3Blcg==<

If you use WebBoar to dig more, you definitely find some interesting things…clintonemail.com is registered using a privacy guard…they don’t want you to know who owns it. Just dumb luck, I think, that I found the record with the MX listed for presidentclinton.com.