Another critical bit of evidence was the use of a specific Command and Control server in the attack. It was traced back to the IP address of 176.31.112.10 and it had been seen before. This same IP came up during the investigation on the German Bundestag spear-phishing. That attempt was believed to have been carried out by Russian intelligence.9
By May 18, 2016, The Director of National Intelligence, James R. Clapper Jr. spoke at the Bipartisan-Policy Center in Washington and said there were “indications” of attempted cyberattacks in the 2016 presidential campaign without specifying either attempted intrusions or on suspected foreign or domestic hackers.10 Brian P. Hale, director of public affairs for the Office of the Director of National Intelligence, backed Clapper up stating, “we’re aware that campaigns and related organizations and individuals are targeted by actors with a variety of motivations, from philosophical differences to espionage, and capabilities, from defacements to intrusions,” and, “we defer to FBI for specific incidents.”11
On June 15, 2016 a Wordpress page appeared with links to the stolen DNC Documents. It was posted by Guccifer 2.0 and came with a list of Frequently Asked Questions.