ton11020seniordev@gmail.com

ton11020seniordev@gmail.com is an email address that one published source reports in connection with IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from meow mfer (@meow_mfer). The report is dated 2025-06-02.

email address IT Worker Fraud RESEARCHER POST

First seen 2025-06-02 · last seen 2025-06-02

Source

  • One post listing three names together with a single pool of addresses, phone numbers, accounts and portfolio sites, under the heading the researcher gives it. The post does not say which value belongs to which name, and it does not say the three are one operator, so only the values that name a person themselves are attributed. Everything else is recorded as a group. Independently, Group-IB's research on a reusable persona shell it tracks as cybersage14 names Dejan-Teofilovic as an identity that account shifted to, and the GitHub account under that name was already indexed from that report; this post is a second, separate citation for it. The two portfolio sites are the kind of reusable placeholder the same research describes these personas sharing. Both LinkedIn profiles and the GitHub account under the Teofilovic name returned a not-found page when the links in this post were followed, so the accounts are recorded as reported rather than as live.
    x.com/meow_mfer/status/1929659508428886218 — meow mfer (@meow_mfer) · under “Values shared across the Teofilovic, Gaston and Davis listing” · published 2025-06-02 · pulled 2026-08-30

Find this indicator in the index, or see every email address this site holds under Email addresses in the browse listing.

Related indicators

Cited by the same report: x.com/meow_mfer/status/1929659508428886218

meow mfer (@meow_mfer) lists 14 other indicators in this source. 12 are shown, chosen across types.

All 15 indicators from this source

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. See the sourcing methodology.