Just to explain, why didn’t Trump use an encrypted VPN solution to communicate with Russia.

[factfinder_77]

So, when you use VPN solution, the Ip packet, has an encrypted payload, protecting its content.
But the ip header address, has to be exposed to be routed trough the US internet backbone and delivered to a Russian end ip adress.

US intelligence can easily detect any vpn usage patterns by using of the shelf software.

VPN usage is like announcing to the world that you are communicating to a third party, but the content is typically hidden and secure.

Trump and Russian operatives set up their server to masquerade its communications as legit add traffic, making it difficult to trace its origins without analyzing the DNS lookup pattern over time.

Such analysis requires manpower, as the researchers has done, directing their observations towards normally legit ip traffic, and analyzing its patterns.

Telling, they took their dns record down when exposed.

But now this capacious server handled a strangely small load of traffic, such a small load that it would be hard for a company to justify the expense and trouble it would take to maintain it. “I get more mail in a day than the server handled,” Davis says.
That wasn’t the only oddity. When the researchers pinged the server, they received error messages. They concluded that the server was set to accept only incoming communication from a very small handful of IP addresses.

...

Earlier this month, the group of computer scientists passed the logs to Paul Vixie. In the world of DNS experts, there’s no higher authority. Vixie wrote central strands of the DNS code that makes the Internet work. After studying the logs, he concluded, “The parties were communicating in a secretive fashion. The operative word is secretive. This is more akin to what criminal syndicates do if they are putting together a project.” Put differently, the logs suggested that Trump and Alfa had configured something like a digital hotline connecting the two entities, shutting out the rest of the world, and designed to obscure its own existence. Over the summer, the scientists observed the communications trail from a distance.

[Foggyhill]

1. He could have sent the vpn through tor to hide routing

But even that can be compromised though it's harder

Another way is going through proxies in non us friendly nations like say Venezuela

[factfinder_77]

3. Tor traffic is easliy detected by automated statistical analysis using CapLoader and alike..

and vpn proxychains are exposed.

[uponit7771]

2. +1, "Telling, they took their dns record down when exposed" but that record is saved IINM...

... they'res not a lot of hidden it now.

Fuck em, that's a lot of evidence right there

[factfinder_77]

4. it looked like “the knee was hit in Moscow, the leg kicked in New York.”

The Times hadn’t yet been in touch with the Trump campaign—Lichtblau spoke with the campaign a week later—but shortly after it reached out to Alfa, the Trump domain name in question seemed to suddenly stop working. When the scientists looked up the host, the DNS server returned a fail message, evidence that it no longer functioned. Or as it is technically diagnosed, it had “SERVFAILed.” (On the timeline above, this is the moment at the end of the chronology when the traffic abruptly spikes, as servers frantically attempt to resend rejected messages.) The computer scientists believe there was one logical conclusion to be drawn: The Trump Organization shut down the server after Alfa was told that the Times might expose the connection. Weaver told me the Trump domain was “very sloppily removed.” Or as another of the researchers put it, it looked like “the knee was hit in Moscow, the leg kicked in New York.”

[Coyotl]

5. Perhaps they did. But that cannot mask the DNS metadata.

Imagine the effort required to find the Trump domain name amidst all the web traffic, quite a feat. I've had up to 2.15 million hits a month on my small domain and my log files are multiple MBs per day, hundreds of pages of simple text in MS Word. Someone has some massive computing capability to pull this off, to search out those logs. Impressive feat!

[factfinder_77]

6. Most likely they used a scripted tool like Dig

http://www.2daygeek.com/dig-command-examples-to-check-dns-records/#

[anamandujano]

7. Interesting.