North Korea does not have an internet of things. It has a publishing farm.
The country's only globally routed IPv4 space is still 175.45.176.0/22 — 1,024 addresses, announced as four /24s by AS131279 (STAR-KP, Ryugyong-dong). Everything that is supposed to exist on the public internet for the DPRK lives in that block or it lives in China or Japan. On 11 September 2026 we walked the prefix: RIPEstat for the routing, Shodan InternetDB for every host, then TCP connect, HTTP GET /, SMTP/FTP banners, and TLS subjects on anything that still answered. We did not test credentials and we did not send exploit payloads. The question was simpler than a CVE dump. What is actually up?
A dozen functions. Two of them still print the hypervisor's name on the certificate.
The Path In
RIPEstat's looking glass, 328 peers on 175.45.176.0/24 at 17:54 UTC, all agreed on the same last hop. The prefix leaves the peninsula through AS134544 (Star JV) into AS4837 (China Unicom), with AS131279 prepended four times. Typical path:
… 4837 134544 131279 131279 131279 131279
There is no second transit. There is no anycast. The March 2025 RPKI incident — a /22 ROA with maxLength 22 that invalidated the /24 announcements and briefly black-holed the country — is closed. Both the /22 and the four /24s now have valid ROAs. The edge is reachable. It is just small.
Twenty-Two Records, Mostly Ghosts
InternetDB has a current record for 22 of the 1,022 host addresses. Zero errors walking the prefix. That number is the Shodan recap. It is not the live set.
Two of the records are the kind of thing that makes a scan look exciting until you touch the address. 175.45.176.24 is indexed as MariaDB 5.5, VMware 902, RDP 3389, WinRM 5985, tag eol-os. 175.45.177.73 is indexed as Redis plus 902/9001/9383. From this path every one of those ports is closed or silent. They are historical index entries. Treat them that way.
Cisco telnet on 175.45.177.65 (ports 22/23) returns RST. The host is alive enough to refuse us. It is not the open console InternetDB remembers. Kudelski's previously cited IT-worker exits in the same /22 (176.27, .40, .144, .160, .180, 178.222) timed out on HTTP. We did not re-engage them as C2. That work is a different dispatch.
The Farm
What answers is a handful of guests and a leftover mail closet.
| Address | What we got | Stack | |
|---|---|---|---|
175.45.176.71 / 177.1 | KCNA homepage — 조선중앙통신 | Apache 2.4.25 (RedStar4.0) / OpenSSL 1.0.1e / PHP 5.6.2 | |
175.45.176.69 | Air Koryo | same Red Star banner | |
175.45.176.68 | Rodong Sinmun, 302 to /ko | same Red Star banner | |
175.45.176.91 | Naenara on :80; **Home \ | Central Zoo** on :443 | nginx 1.18.0 / PHP 5.6.2 |
175.45.176.80 | 302 to www.ryongnamsan.edu.kp/univ/ | nginx 1.18.0 | |
175.45.177.10 | Default "Welcome to nginx!"; Host knic.com.kp → K N I C; koredufund.org.kp → 조선교육후원기금; kut.edu.kp → Kim Chaek University of Technology | nginx 1.18.0, cert CN=5-XEN | |
175.45.177.11 | Host korfilm.com.kp → Korean Film; manmulsang.com.kp → 만물상; kass.org.kp 302 to /index.php/home; kiyctc.com.kp → 500 | nginx 1.18.0, cert CN=192.168.245.6 / SAN Xen-6 | |
175.45.176.29 / .30 | 220 Welcome to star ftp! | Star FTP | |
175.45.177.33 | 220 silibank.net.kp ESMTP Postfix | leftover Silibank | |
175.45.178.56 / .57 | 220 smtp[1].star-co.net.kp ESMTP Postfix on 25 and 587 | Star SMTP |
Red Star 4.0 is still the OS on the news and airline boxes. Apache 2.4.25, OpenSSL 1.0.1e-fips, PHP 5.6.2. That combination shipped in the mid-2010s. InternetDB will happily emit a page of CVEs for it. The useful fact is the banner: the public news stack has not been rebuilt.
The nginx side is the same decade. 1.18.0, PHP 5.6.2 again, self-signed certificates dated 2022 and valid for ten years.
5-XEN and 192.168.245.6
This is the part that is not a news-site recap.
175.45.177.10 presents a self-signed certificate issued 26 September 2022, expiring 23 September 2032:
subject=CN=5-XEN
issuer=CN=5-XEN
X509v3 Subject Alternative Name: DNS:5-XENHit it without a Host header and you get the stock nginx welcome page. Send Host: kut.edu.kp and Kim Chaek University of Technology comes back. Same box, same cert, three ministries-or-universities as name-based vhosts.
175.45.177.11 is louder. Same vintage, issued 19 October 2022:
subject=CN=192.168.245.6
issuer=CN=192.168.245.6
X509v3 Subject Alternative Name: DNS:Xen-6The common name is an RFC1918 address. The SAN is the guest hostname. Korean Film, Manmulsang, KASS, and a 500 from Kiyctc all share that guest. The public edge of the country's org and education sites is two Xen virtual machines that never had their certificates rewritten after install.
DNS puts a second A on several of those names at 175.45.176.80 / 176.81. Those addresses were flaky from this path — Ryongnamsan 302'd once, then the pair started timing out. 177.10 and 177.11 stayed up. If you are drawing the farm, draw Xen first.
The Ministry and the Zoo
naenara.com.kp resolves to 175.45.176.91 along with Korean Books, Youth, the Pyongyang Times, mfa.gov.kp, tourismdprk.gov.kp, sdprk.org.kp, and minju.rep.kp. On port 80, with Host: naenara.com.kp, we got 내나라 — 조선민주주의인민공화국 and nginx/1.18.0. That is the portal.
On port 443 the same address does not care which Host you send. naenara.com.kp, www.naenara.com.kp, mfa.gov.kp, pyongyangtimes.com.kp, and even centralzoo.com.kp (which does not resolve) all returned Home | Central Zoo — "Democratic People's Republic of Korea Central Zoo." HTTPS on the Naenara address is one vhost. The Foreign Ministry's name is on the A record. The page is the zoo.
KCNA's TLS is a different failure mode: TCP 443 accepts, then the handshake dies with a record-layer error. OpenSSL 1.0.1e is still in the HTTP banner. The site itself is up on 80 from both 176.71 and 177.1.
What Left and What Didn't
cloud.star.net.kp still has an A at 175.45.176.31. HTTP and HTTPS time out. The ownCloud instance nkinternet.com documented in 2025, taken down that May, has not come back. The name was never removed.
Hangro is gone from DNS. hangro.net.kp, hani.star-co.net.kp, mail1.silibank.net.kp, and mail1.futurere.com.kp are NXDOMAIN. The ports those boxes were known for — 6006, 8888, 995 — still accept TCP on 175.45.176.21, .22, and .32. TLS comes back BAD_SIGNATURE or record-layer failure. 8888 RSTs after connect. The VPN/mail names died. The sockets did not.
Silibank's SMTP banner did not die. 175.45.177.33 still greets with 220 silibank.net.kp ESMTP Postfix. Star's own mail is cleaner and live: smtp.star-co.net.kp and smtp1.star-co.net.kp on 178.56 / 178.57, ports 25 and 587, same Postfix greeting, names also published under star-di.net.kp and ryongnamsan.edu.kp. mail.star-co.net.kp still points at 178.55. Port 25 there is closed.
Star FTP still answers on 176.29 and 176.30: 220 Welcome to star ftp!. We stopped at the banner.
futurere.com.kp still has an A at 176.67. HTTP timed out. vok.rep.kp still has 176.75. Same. www.star.net.kp still dual-homes on 176.65 and 177.65. HTTP on .65 timed out; .65 on the 177 side RSTs.
Apex star.net.kp and star-co.net.kp have no A. The country is not advertising a corporate homepage. It is advertising the farm.
A Missing Five
korfilm.com.kp publishes two A records: 175.45.176.81 and `17.45.177.11`. The second address is in Apple's 17.0.0.0/8. www.korfilm.com.kp correctly has 175.45.177.11. Someone dropped a 5 in the zone. Queries for the apex now leave the /22 and land in a network that has nothing to do with Pyongyang. We did not follow them there.
What This Is Not
It is not a phone census. Domestic handsets — Koryolink, Kangsong, Mirae — live on a walled garden that does not announce here. NKTechLab's May 2026 catalog already did that work (10.99.0.0/16 and friends). We are not rewriting it.
It is not the IT-worker fraud map and it is not the Next.js implant. Those operations run on rented Western VPS and stolen identities. They do not need AS131279. We have written both of those up separately.
Uriminzokkiri still sits in China (61.161.232.162). kcna.co.jp still sits in Japan (153.122.205.48). The mirrors are not the /22. The /22 is the /22.
Method and Limits
Collected 11 September 2026, ~17:54–18:17 UTC. InternetDB walk of all 1,022 hosts. Live TCP/HTTP/banner/TLS from one vantage through the Unicom path. A full /22 SYN sweep with -Pn is the wrong tool here — the prefix is filtered, not empty, and host-timeouts just skip the address. Targeted connects on the InternetDB set plus DNS-live names is what produced the table.
The path is lossy. 175.45.176.91 flipped between 200 and timeout under sequential load. A timeout from this vantage is not a proof of down. A banner or an HTTP title is a proof of up. Certificate subjects are as presented; we did not validate a public PKI because there isn't one.
crt.sh %.kp timed out. We did not get a CT inventory.
Prior public work we are extending, not recapping: nkinternet.com on ownCloud and Hangro, R4yGM / NorthKoreaScans on historical port sets, Kudelski on IT-worker exits in the same prefix.
Indicators
| Type | Value | Context | First seen (this pass) |
|---|---|---|---|
| prefix | 175.45.176.0/22 | AS131279 public edge | 2026-09-11 |
| ip | 175.45.177.10 | nginx / cert CN=5-XEN / KNIC, KUT, Koredufund | 2026-09-11 |
| ip | 175.45.177.11 | nginx / cert CN=192.168.245.6 SAN=Xen-6 / Korfilm, Manmulsang, KASS | 2026-09-11 |
| ip | 175.45.176.91 | Naenara :80; Central Zoo default on :443 | 2026-09-11 |
| ip | 175.45.176.71 / 177.1 | KCNA / RedStar4.0 | 2026-09-11 |
| ip | 175.45.176.69 | Air Koryo / RedStar4.0 | 2026-09-11 |
| ip | 175.45.176.68 | Rodong / RedStar4.0 | 2026-09-11 |
| ip | 175.45.176.29 / .30 | Star FTP banner | 2026-09-11 |
| ip | 175.45.177.33 | silibank.net.kp Postfix | 2026-09-11 |
| ip | 175.45.178.56 / .57 | smtp[1].star-co.net.kp Postfix 25/587 | 2026-09-11 |
| ip | 175.45.176.21 / .22 / .32 | Hangro-era 6006/8888/995, TLS broken | 2026-09-11 |
| dns | cloud.star.net.kp → 175.45.176.31 | name live, HTTP dead | 2026-09-11 |
| dns | korfilm.com.kp → 17.45.177.11 | zone typo, Apple 17/8 | 2026-09-11 |
The connected-device story people want is a thousand cameras and phones. The connected-device story that is true on the only public prefix is two Xen guests, a Red Star news stack from 2015, a zoo on the Foreign Ministry's HTTPS, and a 5 missing from a film-site zone file. That is the country's edge. It has not gotten larger. It has gotten sloppier about what the certificates say.