Was Kremlin Propagandist Konstantin Rykov Hosting Pro-Trump Russian-Language Web Sites? Notes from 2016

By Catherine A. Fitzpatrick

I had meant to publish this before but set it aside when so many people discouraged me, but now that Konstantin Rykov is being discussed again for his Facebook "revelations," I'll put this out there.

There's this thread:https://www.facebook.com/konstantin.rykov/posts/10210621124674610

(THREAD) This is the most stunning revelation in the Trump/Russia investigation yet. My brother Brian @krassenstein predicted something like this was coming very soon, just days ago & here it is! Konstantin Rykov who is known as a Kremlin Propagandist with close ties to Putin (1)

— Ed Krassenstein (@EdKrassen) November 25, 2017

FWIW, I don't think it's the most stunning revelation, but a problem with all the Trump/Russia stuff is that there are such masses of stuff that it is hard to get the whole picture. Of course, I trust Mueller to get this whole picture more than I do Twitter sleuths. We'll see.

These notes are from November 2, 2016. I showed this to three different techies, they all dismissed it with varying degrees of scorn as such people always do. This was done in the course of researching this four-part series of articles in which we went through all of Trump's Russia connections -- and we were hardly the only journalists to do this. The story of his connection to the Agalarovs, although some are just discovering this on Twitter now, has been known for years.

BEGIN

Look up Trump2016.ru to see what it's IP address is in numerical terms.

So here:

http://ru.whatmyip.co/info/whois/87.242.78.131/k/3679097392/website/trump2016.ru

2. That gives you 87.242.78.131

So look up 87.242.78.131 to see what else it might host.

3. Go here: 

http://hostingcompass.com/

 

Then plug in 87.242.78.131

And you get this:

 

IP Address	87.242.78.131
IP Reverse	-
Websites	We found 2 websites attached to this IP address. ·         rykov.ru ·         http://hostingcompass.com/site/rykov.media

 

 

So if Rykov.ru has 87.242.78.131 AND Trump2016.ru turns out ALSO to be hosted on 87.242.78.131, they are likely related.

Why? Because he's likely to use the same hosting company. 

To be sure, if there were 10 or 100 things on that same server, all kinds of shopping sites and such, you could say, oh, that may only be a coincidence since all of those sites are using the same service to mask their identities.

Except read what Hosting Compass says -- rykov.ru and rykov.media are ATTACHED to 87.242.78.131 -- exactly.

The dozen shopping sites are only in the RANGE close to that number.

So let's say Rykov has gone to the trouble to contract a web host. According to this site, he could create sub-domains on his main domain. Whether or not it's a good practice it's still something he could do.

 

https://www.thesitewizard.com/domain/multiple-websites-one-domain.shtml

 

In any event, the question to ask is whether it is possible for 87.242.78.131, the Trump site, to also be the same IP address for other completely unrelated sites.

And given that Hosting Compass tells us no, it's only two Rykov sites, that suggests they are related.

Yes, I totally realize that one server could host multiple things. For example, in Second Life, where I rent servers, this is a big annoyance. They have dynamically rotating servers. So you never know if some days you are sharing a server, say, with a furry club, with a shoutcast stream and 40 avatars lagging the server then. There were even some nerds who published this information about your "secret sharers" so that you could complain to the company if you got stuck with a club. 

But in this case, if Hosting Compass repeatedly shows only 2 other sites attached to that address that we know to be the Trump2016 address, it seems likely it's Rykov.

The other site has a trail like that as well, only a bit more complicated, leading to NOD.

So the Russian-language Trump site with masked registration [link] happens to share a domain with Rykov, the Kremlin propagandist.

Probably just a coincidence [link]. Unrelated entities can share servers but needs more research.

 

"So another Russian-language Trump site registered the same day but with a different masking service happens to show okkupantu.ru and hooks up

to ultranationalist anti-American NOD [Russian Liberation Movement]. Even more likely a coincidence?"

 

It's my conviction that the 1st site ties up to Rykov as it consistently shows only his two sites attached. The 2nd site is much more of a grab bug showing hundreds of sites, and only sometimes okkupant.ru, which definitely might be a random coincidence then -- or not.

 

The billing may be standard in the services, they send them out in batches, people renew the same day who are unrelated. That is, I don't think that's the reason these two sites have the same payment date, I think it's a clue they are FSB or at least Rykov, but since it IS an explanation for why they could have a payment date I have to accept it.

Here's an email I sent to colleagues October 25, 2016:

 

Hi,

 

It seems Konstantin Rykov is hosting the Russian-language Trump site.

 

It has a masked registration:

 

domain:        TRUMP2016.RU

nserver:       ns1.goodoo.ru.

nserver:       ns2.goodoo.ru.

state:         REGISTERED, DELEGATED, VERIFIED

person:        Private Person

registrar:     REGISTRATOR-RU

admin-contact: https://cp.mastername.ru/domain_feedback/

created:       2015.08.17

paid-till:     2017.08.17

free-date:     2017.09.17

source:        TCI

 

But the IP shows this:

 

http://hostingcompass.com/whois/87.242.78.131

 

He's one of the top Kremlin propagandists on social media.

 

Cathy

 

END

 

Basically, no geek wants to make these kinds of connections, because in the rigid yes/no or 0/1 world in which they think, if you can't demonstrate something 100% or if there is even 1% possibility of error, then the entire thing becomes invalid. This is why it is so hard to move forward on stories like the Alfa servers and the Trump servers. In the world of organic law, as distinct from code-as-law, there are concepts such as "probable cause" or "beyond a reasonable doubt" which allow for common sense and logic. In their world, geeks can't afford to think in terms of 1% not throwing the entire thing off; programs stop working when a single comma is out of place. They have warped their own thinking to accommodate machines, which means that even this kind of coincidence among servers can't ever convince them. Worse, they heap scorn on you for even making this connection, or worse, ridicule for not having some bigger "data dump" to their liking that is "certified". This is why we can't have nice things...

 

But you look at all this sort of thing over time, as I did (it may not be discoverable now, I haven't checked), you combine it with ages of watching Rykov in action (as I have done) and reading his "tell-all" FB page and all, it doesn't seem outlandish that Rykov would sponsor a Russian-language pro-Trump page to ensure the Russian emigre vote in the US, which isn't trivial. Or even that NOD would even be related, it's consistent enough with the weirdness of NOD (remember when their propagandists were killed in the Donbass with one of the top pro-Kremlin war correspondents?). I've always thought NOD was made up out of whole cloth, the way Zhirinovsky once was.

 

I think there could be other explanations for Rykov seemingly getting a DM from Trump. Someone among his friends could have sent it and he didn't realize it. Trump or his aide could have seen something and in fact written to him in DM but they do that routinely with everybody. And so on. It's not like you have to be a friend of someone to send them a Messenger DM.