tysonstar912913@gmail.com
tysonstar912913@gmail.com is an email address
that 3 published sources report
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from meow mfer (@meow_mfer) and The Raven File.
The earliest of those reports is dated 2025-06-08 and the most recent 2026-04-17.
email address IT Worker Fraud MATCHED IN SOURCE
Listed as tyson.star.912913@gmail.com
Listed under Adam Lee, tysonstar912913.
Sources
-
A reply to browsercookies giving the identity as a single block of addresses, a telephone number and four links. Two separate LinkedIn accounts are listed under the one name. The post text is complete rather than truncated, so the indicator list here is the whole of what it states. The address tyson.star.912.913@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author. The persona tysonstar912913, captured separately in this file from a later thread, is the same holder. Its address tyson.star.912913@gmail.com and the tyson.star.912.913@gmail.com recorded here differ only in the placement of a full stop, which Gmail ignores, so the normalizer already collapses both to one value and both personas already appear on that indicator. The commit walk of 2026-09-19 puts the resemblance beyond a shared mailbox: the repositories of both accounts carry commits from the same two author lines, tysonstar912913 <tyson.star.912913@gmail.com> 41 times here and 88 there, and adam719912 <tyson.star.912.913@gmail.com> 13 times here and 7 there. The profile README of adam912913 also still carries the template comment naming tysonstar912913/tysonstar912913, which records the account it was copied from. The two entries are kept apart because each is the record of a different researcher post, not because the site reads them as two people.
x.com/meow_mfer/status/1931534566155751856 — meow mfer (@meow_mfer) -
A fourteen-post thread on the accounts that worked on Tokamak Network's bridge front end, marketplace and subgraph between November 2023 and February 2025, read as a single cell from the primary account's following list, commit-email forensics, renamed and deleted handles, and account-creation dates clustered within days of each other. Every value here is stated in the thread; post thirteen is the researcher's own address map for the cell. Listed in the primary account's following list and in the address map. The persona Adam Lee, captured in this file from a June 2025 reply, is the same holder; the reasoning is recorded in that entry. Its address tyson.star.912.913@gmail.com and the tyson.star.912913@gmail.com recorded here are one Gmail mailbox, and the commit walk of 2026-09-19 found the same two author lines committing across both accounts' repositories.
x.com/meow_mfer/status/2045112535968596342 — meow mfer (@meow_mfer) -
…l.com trust.navraj@minofangle.org tryeverything0609@gmail.com tryeverything920609@gmail.com tt9846610@gmail.com tylerdennison0207@gmail.com tyson.star.912913@gmail.com ui.lee918@gmail.com unicorntoy753@proton.me univan0928@gmail.com unoyasushi0922@gmail.com uo0901576@gmail.com upmanager200@gmail.com upwork…
Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File
Find this indicator in the index, or see every email address this site holds under Email addresses in the browse listing.
Related indicators
Same persona record: Adam Lee
Same persona record: tysonstar912913
Cited by the same report: x.com/meow_mfer/status/1931534566155751856
All 8 indicators from this source
Cited by the same report: x.com/meow_mfer/status/2045112535968596342
All 7 indicators from this source