:Site Navigation:
- 2010: A Discovery - I got interested - IP Range - Results: 175.45.176 - Results: 175.45.177 - Results: 175.45.178 - Results: 175.45.179 -
- 2017 #1 #2 - New Scan- Results: 175.45.176 - Results: 175.45.177 - Results: 175.45.178 - Results: 175.45.179 - Results 210.52.109 -

[2017]

A comparison of a scan97 of North Korea’s IP ranges in November 2010, just one month after
North Korea made its first direct connection to the Internet, and a series of several scans we
conducted in May 2014, shows that North Korea has made significant headway in establishing its
Internet presence.
In the November 2010 scan, 175.45.176.0 - 175.45.176.16 showed a variety of devices including
D-link, Cisco, Linksys, HP, and Nokia devices, and a Juniper networks firewall. Operating systems
detected included FreeBSD 6.x, Linux 2.6.x, and Red Hat Enterprise Linux. 175.45.176.14 returned
“Naenara” as an html-title. Most hosts in the 175.45.176.xx and 175.45.177.xx ranges were
down. As of 2014, IP addresses 175.45.176.0 - 175.45.177.255 appear to be used for websites,
nameservers, databases, email, and voice over IP (VoIP). In November 2010, the 175.45.178.xx
range showed all hosts down,
98 and the 175.45.179.xx range showed most hosts were down.99

In 2014, several webservers and nameservers were found in the 175.45.178.xx range, and
several nameservers and mail servers were found in the 175.45.179.xx range. This comparison
demonstrates that there has been some growth in DPRK Internet infrastructure over the past four
years. However, it seemingly lags behind even most third world nations. The 2014 scans detected
dated technology that is potentially susceptible to multiple vulnerabilities and consistently
showed the same open ports and active devices on scanned hosts. It is not clear whether the
regime failed to notice and react to the scanning or whether the regime allows these open ports
and devices to be detected or spoofed to serve as a distraction or possible honeypot.

PrancingPony ~ # cat /var/log/auth.log* | grep 'sshd.*Failed'
May 23 14:13:45  sshd[25912]: Failed password for invalid user root from 178.189.56.26 port 52841 ssh2
May 23 14:14:03  sshd[25915]: Failed password for invalid user goddard from 192.95.62.4 port 43862 ssh2
May 23 14:14:33  sshd[25935]: Failed password for invalid user godeardo from 139.59.16.203 port 36508 ssh2
May 23 14:16:31  sshd[26016]: Failed password for invalid user gon from 62.210.81.43 port 41695 ssh2
May 23 14:18:28  sshd[26076]: Failed password for invalid user gonzalo from 45.55.164.108 port 36818 ssh2
May 23 14:22:15  sshd[26192]: Failed password for invalid user gotardo from 191.101.228.20 port 56134 ssh2
May 23 14:22:59  sshd[26211]: Failed password for invalid user grace from 195.154.216.79 port 48678 ssh2
May 23 14:24:57  sshd[26257]: Failed password for invalid user gracjan from 69.164.198.191 port 36793 ssh2
May 23 14:27:08  sshd[26416]: Failed password for invalid user pi from 178.189.56.26 port 54329 ssh2

cat /var/log/auth.log* | grep 'sshd.*Failed' | awk '{print $13}' | uniq >> ssh_ips.txt