Vertex and Team Cymru assessed with high confidence that U.S. residential IP 172.120.254.49 supported the DPRK IT Worker ecosystem. The host exposed HTTP and SOCKS proxy services plus SSH, received connections from Astrill VPN infrastructure including an address previously linked to UNC5267, and appeared in repeated DPRK-to-VPN-to-residential flow sequences. On May 8, 2026, telemetry showed traffic from 175.45.176.77 reaching an Astrill VPN, followed 76 seconds later by traffic from that VPN to the residential proxy. Vertex also found passive-DNS overlap with services used by IT workers, including the DPRK-linked luckyguys.site payment-system domain.