Looks like a new domain ftpsek.star.net.kp resolving to 175.45.177.16

I’m not sure when this changed, or if it’s legitimate but it looks like https://ipinfo.io/194.50.111.122 is now showing as located in North Korea.

Seems to be a number of websites reporting the same thing. Whois data from Domain Tools give a little more information. Seems to be used for routing purposes with anycast

% Abuse contact for ‘194.50.111.122 – 194.50.111.122’ is ”

inetnum: 194.50.111.122 – 194.50.111.122
netname: KP-SECUREBIT-20200202
descr: Securebit Anycast Network Democratic People’s Republic of Korea
country: KP
admin-c: SBAC-RIPE
tech-c: SBTC-RIPE
status: ASSIGNED PA
mnt-by: SBMT
created: 2020-02-02T02:03:44Z
last-modified: 2020-02-02T02:03:44Z
source: RIPE

STS Tech Service/Magnolia appears to be a North Korean software developer from the early 2000’s that published some software commercially. I’ve been working on tracking down a list of the software and any information that I can find. Will be adding more here as I find it

Rescue File Restoration: http://www.sourcenext.info/sp/press/04027_kyushutsu.html

I’m really not sure what this is but found some interesting software from North Korea: https://www.advanceduninstaller.com/NetKey-c5b03c7e2301df6790bd8d91a079b60b-application.htm

Trying to find a copy. Also interesting to look at the page stats and see that it was installed in North Korea

It’s pretty well known that North Korean students write some decent code and have won some competitions against other colleges: https://www.mic.com/articles/186412/north-korean-college-coders-beat-stanford-university-in-a-2016-competition-heres-why-that-matters

The other day some North Korean social media accounts started tweeting out the following link showing their standings online: https://www.codechef.com/ratings/long-challenge

I started looking into it more and it looks like at least the for some of the online competitions it’s pretty well known that users are cheating on their submissions:

1. https://codeforces.com/blog/entry/43880

2. https://codeforces.com/blog/entry/14150

3. https://www.quora.com/Why-are-some-North-Koreans-doing-so-well-on-CodeChef-Do-they-even-have-proper-access-to-the-Internet

It’s been a while since something new has appeared in North Korea’s IP space. I have no idea what this is but I’m glad there’s something new finally. Googling the error does produce some interesting results but no real clues as far as I can tell.

One thing that I’ve been researching lately is the link between STS Tech Service and Silverstar Japan/Magnolia. I’ve found some listings for different computer games and PS2 games

https://translate.google.com/translate?hl=en&sl=ja&u=http://tk-nz.game.coocan.jp/gamedatabase/software/DB_SNC2_PS22005.html&prev=search

https://translate.google.com/translate?hl=en&sl=ja&u=https://nlab.itmedia.co.jp/games/gsnews/0202/04/news06.html&prev=search

I was searching leaked DB’s the other day and found the following entry that was interesting:

CsnuggleB:175.45.176.138

Looks like a login to a Minecraft server from a North Korean IP. At first I thought I found a second example of North Korea playing Minecraft but then I found the following forum post:

https://phanaticmc.com/threads/ban-appeal.2958/

Looks like the user CsnuggleB is claiming their account was hacked.

It times out when trying to load but https://175.45.176.91 is resolving to https://www.gpsh.edu.kp:8443/

Good to see the KCC contributing to open source projects

https://github.com/idtunnel/neofetch/commit/85eef19406a33b89841fc45a291c498ef100ad5c