[counternotions]

> Junade Ali, a cybersecurity researcher in Britain who monitors a range of different North Korean web and email servers

How would a researcher keep tabs on NK infrastructure like this? Would it be pinging known IPs for uptime?

[YXNjaGVyZWdlbgo]

How would you do it for non NK infrastructure? The answer is the same well except scanning NK IP ranges doesn't take that long.

[counternotions]

Got it. Out of curiosity tried checking Shodan, and for the NK assigned IP range `175.45.176.0/22` it shows 35 live services: https://www.shodan.io/search?query=net%3A175.45.176.0%2F22

Apache httpd 4 Postfix smtpd 4 nginx 4 Cisco IOS http config 1 Cisco router telnetd 1 MS-SQL Server 1 Microsoft IIS httpd 1