`+13477321116`

+13477321116 is a telephone number that 2 published sources report in connection with IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from Hayden McKenzie. The reports are dated 2026-09-23.

phone number IT Worker Fraud RESEARCHER POST

Listed under Conner Johnson, Marcos Fermin.

First seen 2026-09-23 · last seen 2026-09-23

Line type

Line type	VoIP
Carrier	SKYPE COMMUNICATIONS
Rate centre	NEW YORK CITY, NY

phonevalidator.com labels the line LANDLINE while naming Skype Communications as the carrier in the same row. The carrier is an interconnected VoIP provider, which is what the classification here follows.

Looked up 2026-09-30 at phonevalidator.com. This is a lookup of the line itself. A VoIP line is not evidence on its own.

Sources

Hayden McKenzie publishes this as one of the aliases recovered from a DPRK IT worker cell's own files, on a per-alias record that gives its location as Far Rockaway, New York and the role it presents as Senior .NET Full Stack Engineer, and the contact details above. Across the site's records, +13477321116 also appears on the record for Conner Johnson. The record was not on the site when this one first read it on 22 September 2026 and appeared alongside the report The Women Behind North Korea's IT Worker Operations, published on 23 September, so that is the date cited. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.
haydenmckenzie.com/aliases/marcos+fermin — Hayden McKenzie · under “Marcos Fermin” · pulled 2026-09-23
Hayden McKenzie publishes this as one of the aliases recovered from a DPRK IT worker cell's own files, on a per-alias record that gives its location as Louisville, Kentucky and the role it presents as Senior .NET Software Engineer, and the contact details above. Across the site's records, +13477321116 also appears on the record for Marcos Fermin. The record was not on the site when this one first read it on 22 September 2026 and appeared alongside the report The Women Behind North Korea's IT Worker Operations, published on 23 September, so that is the date cited. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.
haydenmckenzie.com/aliases/conner+johnson — Hayden McKenzie · under “Conner Johnson” · pulled 2026-09-23

Find this indicator in the index, or see every telephone number this site holds under Telephone numbers in the browse listing.

Related indicators

Same persona record: Conner Johnson

Other identifiers the reporting files under the same persona.

Same persona record: Marcos Fermin

Other identifiers the reporting files under the same persona; 1 of 2 are shown.

All 2 on the Marcos Fermin page

Cited by the same report: haydenmckenzie.com/aliases/marcos+fermin

Hayden McKenzie lists 2 other indicators in this source. 1 are shown, chosen across types.

All 3 indicators from this source