Nikos Amofa

A fabricated professional identity used in the DPRK remote IT-worker scheme. Most of what follows is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, Nikos Amofa. The attribution is theirs, not this site's.

The remainder was read by this site from the account itself and is cited to the page and date it was read.

Portfolio site the cited post publishes, nikosamofa.netlify.app, headed Nikos Amofa, Senior Software Developer, with a portrait. It is the image the identity presented as itself.

Published by Cookie Connoisseur (@browsercookies) in the cited post, 2025-04-19.

IT Worker Fraud First reported 2025-04-19 · last reported 2026-09-28

LinkedIn accounts

https://www.linkedin.com/in/nikos-amofa/

removed checked 2026-09-28

Indicator page: https://www.linkedin.com/in/nikos-amofa/

linkedin profile IT Worker Fraud CURATED removed checked 2026-09-28

First seen 2026-09-28 · last seen 2026-09-28

Source

Read on 28 September 2026 from the site's own page and the script bundles it loads. The portfolio's contact block gives a phone number beside the nikosbrightamofa address this site already holds, and its footer links a LinkedIn profile and a GitHub account, the latter since removed from GitHub.
nikosamofa.netlify.app/ https://nikosamofa.netlify.app/ not linked — Chollima Hunter · under “Nikos Amofa” · pulled 2026-09-28

Identifiers reported alongside

4 indicators the sources below record for this operator, each with its sources.

Indicator	Type	Account status
`Nikos Amofa`	alias	—
`https://github.com/nikosamofa`	github profile	removed checked 2026-09-30
`nikosamofa.netlify.app`	hosted site	—
`+12147314674`	phone number	—

`Nikos Amofa`

alias IT Worker Fraud CURATED

First seen 2025-04-19 · last seen 2026-09-28

Sources

The site address is transcribed by hand from the attached screenshot, a personal portfolio page headed Nikos Amofa, Senior Software Developer, with the host visible in the browser chrome. The post says the operator can be found on other sites as well but does not name them.
x.com/browsercookies/status/1913710927691780171 — Cookie Connoisseur (@browsercookies) · under “Nikos Amofa” · published 2025-04-19 · pulled 2026-08-30
Read on 28 September 2026 from the site's own page and the script bundles it loads. The portfolio's contact block gives a phone number beside the nikosbrightamofa address this site already holds, and its footer links a LinkedIn profile and a GitHub account, the latter since removed from GitHub.
nikosamofa.netlify.app/ https://nikosamofa.netlify.app/ not linked — Chollima Hunter · under “Nikos Amofa” · pulled 2026-09-28

`https://github.com/nikosamofa`

github profile IT Worker Fraud CURATED removed checked 2026-09-30

First seen 2026-09-28 · last seen 2026-09-28

removed checked 2026-09-30

Source

Read on 28 September 2026 from the site's own page and the script bundles it loads. The portfolio's contact block gives a phone number beside the nikosbrightamofa address this site already holds, and its footer links a LinkedIn profile and a GitHub account, the latter since removed from GitHub.
nikosamofa.netlify.app/ https://nikosamofa.netlify.app/ not linked — Chollima Hunter · under “Nikos Amofa” · pulled 2026-09-28

`nikosamofa.netlify.app`

hosted site IT Worker Fraud RESEARCHER POST

First seen 2025-04-19 · last seen 2025-04-19

Source

The site address is transcribed by hand from the attached screenshot, a personal portfolio page headed Nikos Amofa, Senior Software Developer, with the host visible in the browser chrome. The post says the operator can be found on other sites as well but does not name them.
x.com/browsercookies/status/1913710927691780171 — Cookie Connoisseur (@browsercookies) · under “Nikos Amofa” · published 2025-04-19 · pulled 2026-08-30

`+12147314674`

phone number IT Worker Fraud CURATED

First seen 2026-09-28 · last seen 2026-09-28

Line type

Line type	VoIP
Carrier	SKYPE COMMUNICATIONS
Rate centre	CARROLLTON, TX

phonevalidator.com labels the line LANDLINE while naming Skype Communications as the carrier in the same row. The carrier is an interconnected VoIP provider, which is what the classification here follows.

Looked up 2026-09-30 at phonevalidator.com. This is a lookup of the line itself. A VoIP line is not evidence on its own.

Source

Read on 28 September 2026 from the site's own page and the script bundles it loads. The portfolio's contact block gives a phone number beside the nikosbrightamofa address this site already holds, and its footer links a LinkedIn profile and a GitHub account, the latter since removed from GitHub.
nikosamofa.netlify.app/ https://nikosamofa.netlify.app/ not linked — Chollima Hunter · under “Nikos Amofa” · pulled 2026-09-28

Sources

x.com/browsercookies/status/1913710927691780171 — Cookie Connoisseur (@browsercookies) · under “Nikos Amofa” · published 2025-04-19 · pulled 2026-08-30
nikosamofa.netlify.app/ https://nikosamofa.netlify.app/ not linked — Chollima Hunter · under “Nikos Amofa” · published 2026-09-28 · pulled 2026-09-28

Back to all personas