NK Internet observed 175.45.176.97 in the DPRK IP range returning a 302 redirect to recoshield.com between May 14 and May 17, 2026, with headers showing Apache on Rocky Linux and PHP. Further probing exposed a captive portal-style framework that checked Google favicon loading, redirected users based on connectivity, and used Korean code comments describing mobile-network timeout behavior and a CORS-avoidance technique. The visible lure was a mobile Huawei-themed WiFi error page that sent a POST request containing a sectoken before redirecting users to the legitimate WiFi Analyzer Pro Android app. Commented package-name values for YouTube, Instagram, and Netflix suggest the Play Store redirect target may have been a placeholder while a rogue access point workflow was being tested.