Taro Aikuchi

John Ruff

alias IT Worker Fraud RESEARCHER POST

First seen 2026-04-14 · last seen 2026-04-14

Source

• Applicant who approached the researcher for a remote engineering role and was assessed by them as a DPRK IT worker. The researcher reports a LinkedIn account created in 2025 with no photograph, an AI-generated CV listing a degree that does not exist and an email address different from the one the application came from, a Telegram account posting to recruit facilitators willing to supply Upwork accounts and stand in for KYC, a GitHub account created in 2025 whose commits carry a third address and among whose repository contributors are accounts the researcher had previously encountered, a connection to the interview from an AstrillVPN address, and a Japanese My Number card the researcher and a consulted specialist assessed as a forgery. Running the three addresses through an OSINT service returned accounts registered under four further names and locations inconsistent with a Japanese national. Both the LinkedIn and the GitHub account were deleted after the interview. The post that carries that OSINT result was itself never cited here until 16 September 2026, and two of the accounts it shows are typeable. The LinkedIn card for Pavlo Polishichuk gives the account name pavlo-polishichuk-b68920364 and a biography in Ukrainian reading Posada Full-stack Developer u Freelancer; the post's own summary places that identity in Poland while the card places it in Shpola, Cherkasy, in Ukraine, and the card is what is recorded. The John Ruff identity is a resume hosted on bubble.io whose indexed preview carries a United States telephone number beside the highgoal215 address already held here, which is what ties the number to this persona rather than to a separate one. The Master Dev identity is a Microsoft account created on 3 November 2025 and registered to France, with only a masked telephone number shown.

  x.com/tanuki42_/status/2044106347017539686 — tanuki42 (@tanuki42_) · under “Taro Aikuchi / Tony Sam / John Ruff / Pavlo Polishichuk / Master Dev” · published 2026-04-14 · pulled 2026-08-30

Master Dev

alias IT Worker Fraud RESEARCHER POST

First seen 2026-04-14 · last seen 2026-04-14

Source

• Applicant who approached the researcher for a remote engineering role and was assessed by them as a DPRK IT worker. The researcher reports a LinkedIn account created in 2025 with no photograph, an AI-generated CV listing a degree that does not exist and an email address different from the one the application came from, a Telegram account posting to recruit facilitators willing to supply Upwork accounts and stand in for KYC, a GitHub account created in 2025 whose commits carry a third address and among whose repository contributors are accounts the researcher had previously encountered, a connection to the interview from an AstrillVPN address, and a Japanese My Number card the researcher and a consulted specialist assessed as a forgery. Running the three addresses through an OSINT service returned accounts registered under four further names and locations inconsistent with a Japanese national. Both the LinkedIn and the GitHub account were deleted after the interview. The post that carries that OSINT result was itself never cited here until 16 September 2026, and two of the accounts it shows are typeable. The LinkedIn card for Pavlo Polishichuk gives the account name pavlo-polishichuk-b68920364 and a biography in Ukrainian reading Posada Full-stack Developer u Freelancer; the post's own summary places that identity in Poland while the card places it in Shpola, Cherkasy, in Ukraine, and the card is what is recorded. The John Ruff identity is a resume hosted on bubble.io whose indexed preview carries a United States telephone number beside the highgoal215 address already held here, which is what ties the number to this persona rather than to a separate one. The Master Dev identity is a Microsoft account created on 3 November 2025 and registered to France, with only a masked telephone number shown.

  x.com/tanuki42_/status/2044106347017539686 — tanuki42 (@tanuki42_) · under “Taro Aikuchi / Tony Sam / John Ruff / Pavlo Polishichuk / Master Dev” · published 2026-04-14 · pulled 2026-08-30

Pavlo Polishichuk

alias IT Worker Fraud RESEARCHER POST

First seen 2026-04-14 · last seen 2026-04-14

Source

• Applicant who approached the researcher for a remote engineering role and was assessed by them as a DPRK IT worker. The researcher reports a LinkedIn account created in 2025 with no photograph, an AI-generated CV listing a degree that does not exist and an email address different from the one the application came from, a Telegram account posting to recruit facilitators willing to supply Upwork accounts and stand in for KYC, a GitHub account created in 2025 whose commits carry a third address and among whose repository contributors are accounts the researcher had previously encountered, a connection to the interview from an AstrillVPN address, and a Japanese My Number card the researcher and a consulted specialist assessed as a forgery. Running the three addresses through an OSINT service returned accounts registered under four further names and locations inconsistent with a Japanese national. Both the LinkedIn and the GitHub account were deleted after the interview. The post that carries that OSINT result was itself never cited here until 16 September 2026, and two of the accounts it shows are typeable. The LinkedIn card for Pavlo Polishichuk gives the account name pavlo-polishichuk-b68920364 and a biography in Ukrainian reading Posada Full-stack Developer u Freelancer; the post's own summary places that identity in Poland while the card places it in Shpola, Cherkasy, in Ukraine, and the card is what is recorded. The John Ruff identity is a resume hosted on bubble.io whose indexed preview carries a United States telephone number beside the highgoal215 address already held here, which is what ties the number to this persona rather than to a separate one. The Master Dev identity is a Microsoft account created on 3 November 2025 and registered to France, with only a masked telephone number shown.

  x.com/tanuki42_/status/2044106347017539686 — tanuki42 (@tanuki42_) · under “Taro Aikuchi / Tony Sam / John Ruff / Pavlo Polishichuk / Master Dev” · published 2026-04-14 · pulled 2026-08-30

Taro Aikuchi

alias IT Worker Fraud CURATED

First seen 2026-04-14 · last seen 2026-09-20

Sources

• Applicant who approached the researcher for a remote engineering role and was assessed by them as a DPRK IT worker. The researcher reports a LinkedIn account created in 2025 with no photograph, an AI-generated CV listing a degree that does not exist and an email address different from the one the application came from, a Telegram account posting to recruit facilitators willing to supply Upwork accounts and stand in for KYC, a GitHub account created in 2025 whose commits carry a third address and among whose repository contributors are accounts the researcher had previously encountered, a connection to the interview from an AstrillVPN address, and a Japanese My Number card the researcher and a consulted specialist assessed as a forgery. Running the three addresses through an OSINT service returned accounts registered under four further names and locations inconsistent with a Japanese national. Both the LinkedIn and the GitHub account were deleted after the interview. The post that carries that OSINT result was itself never cited here until 16 September 2026, and two of the accounts it shows are typeable. The LinkedIn card for Pavlo Polishichuk gives the account name pavlo-polishichuk-b68920364 and a biography in Ukrainian reading Posada Full-stack Developer u Freelancer; the post's own summary places that identity in Poland while the card places it in Shpola, Cherkasy, in Ukraine, and the card is what is recorded. The John Ruff identity is a resume hosted on bubble.io whose indexed preview carries a United States telephone number beside the highgoal215 address already held here, which is what ties the number to this persona rather than to a separate one. The Master Dev identity is a Microsoft account created on 3 November 2025 and registered to France, with only a masked telephone number shown.

  x.com/tanuki42_/status/2044106347017539686 — tanuki42 (@tanuki42_) · under “Taro Aikuchi / Tony Sam / John Ruff / Pavlo Polishichuk / Master Dev” · published 2026-04-14 · pulled 2026-08-30

• A ten-part thread responding to tanuki42's work on this persona, of which parts two, four and nine carry the indicators. It corroborates six values this site already held from tanuki42 independently, including the address, the telephone number, the cryptotrading2150 Telegram account and the deleted 0xbomb215 GitHub account, and adds the six recorded here. The link the thread rests on is a commit trailer in the repository miracle709/Robo-Apply, where a commit authored by 0xbomb215 carries a co-author line naming xsen215 at narutodev215@outlook.com; that is a checkable artefact rather than an assertion, and it is why these identifiers are recorded while the thread's database-only claims are not. The thread also states that 0xbomb215 has since been deleted. Parts three, five, seven and nine continue past the text this pass was able to capture before X throttled the session, so this entry is what those posts state up to that point rather than the whole of them. The address miracle7091@outlook.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.

  x.com/meow_mfer/status/2044585689292169292 — meow mfer (@meow_mfer) · under “Taro Aikuchi / 0xbomb215 / xsen215” · published 2026-04-16 · pulled 2026-08-30

• Found on 17 September 2026 by asking Docker Hub whether an account exists under highgoal215, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 15 August 2025 and a display name of High Goal. The display name is kept here rather than as an alias, because it restates the handle, describes the work, or repeats what this operator is already called. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.

  hub.docker.com/u/highgoal215 — Chollima Hunter · under “Taro Aikuchi” · pulled 2026-09-17

• Read on 20 September 2026 by walking the commit history of every repository on the GitHub account github.com/HighGoal1991, already held under this persona, and tallying the author line on every commit. A commit's author line is what the holder configured their git client with rather than anything the profile page chooses to display, so it recovers addresses the account never states. The address recorded here was not already in this index: iuri39493@gmail.com authored 488 commits across 7 of its repositories, commits as "HighGoal1991". Each is admitted because it commits under a name the account itself uses, which is the test that separates the holder's own address from the original author of a repository copied in. Addresses belonging to unrelated developers whose work appears in these repositories are deliberately not recorded, and an address is evidence that whoever held it wrote those commits rather than proof of who holds the account.

  github.com/HighGoal1991 — Chollima Hunter · under “Taro Aikuchi” · pulled 2026-09-20

Tony Sam

alias IT Worker Fraud RESEARCHER POST

First seen 2026-04-14 · last seen 2026-04-14

Source

• Applicant who approached the researcher for a remote engineering role and was assessed by them as a DPRK IT worker. The researcher reports a LinkedIn account created in 2025 with no photograph, an AI-generated CV listing a degree that does not exist and an email address different from the one the application came from, a Telegram account posting to recruit facilitators willing to supply Upwork accounts and stand in for KYC, a GitHub account created in 2025 whose commits carry a third address and among whose repository contributors are accounts the researcher had previously encountered, a connection to the interview from an AstrillVPN address, and a Japanese My Number card the researcher and a consulted specialist assessed as a forgery. Running the three addresses through an OSINT service returned accounts registered under four further names and locations inconsistent with a Japanese national. Both the LinkedIn and the GitHub account were deleted after the interview. The post that carries that OSINT result was itself never cited here until 16 September 2026, and two of the accounts it shows are typeable. The LinkedIn card for Pavlo Polishichuk gives the account name pavlo-polishichuk-b68920364 and a biography in Ukrainian reading Posada Full-stack Developer u Freelancer; the post's own summary places that identity in Poland while the card places it in Shpola, Cherkasy, in Ukraine, and the card is what is recorded. The John Ruff identity is a resume hosted on bubble.io whose indexed preview carries a United States telephone number beside the highgoal215 address already held here, which is what ties the number to this persona rather than to a separate one. The Master Dev identity is a Microsoft account created on 3 November 2025 and registered to France, with only a masked telephone number shown.

  x.com/tanuki42_/status/2044106347017539686 — tanuki42 (@tanuki42_) · under “Taro Aikuchi / Tony Sam / John Ruff / Pavlo Polishichuk / Master Dev” · published 2026-04-14 · pulled 2026-08-30

https://hub.docker.com/u/highgoal215

dockerhub account IT Worker Fraud CURATED live checked 2026-11-08

First seen unknown · last seen unknown

Source

• Found on 17 September 2026 by asking Docker Hub whether an account exists under highgoal215, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 15 August 2025 and a display name of High Goal. The display name is kept here rather than as an alias, because it restates the handle, describes the work, or repeats what this operator is already called. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.

  hub.docker.com/u/highgoal215 — Chollima Hunter · under “Taro Aikuchi” · pulled 2026-09-17

highgoal215@gmail.com

email address IT Worker Fraud RESEARCHER POST

First seen 2026-04-14 · last seen 2026-04-14

Source

• Applicant who approached the researcher for a remote engineering role and was assessed by them as a DPRK IT worker. The researcher reports a LinkedIn account created in 2025 with no photograph, an AI-generated CV listing a degree that does not exist and an email address different from the one the application came from, a Telegram account posting to recruit facilitators willing to supply Upwork accounts and stand in for KYC, a GitHub account created in 2025 whose commits carry a third address and among whose repository contributors are accounts the researcher had previously encountered, a connection to the interview from an AstrillVPN address, and a Japanese My Number card the researcher and a consulted specialist assessed as a forgery. Running the three addresses through an OSINT service returned accounts registered under four further names and locations inconsistent with a Japanese national. Both the LinkedIn and the GitHub account were deleted after the interview. The post that carries that OSINT result was itself never cited here until 16 September 2026, and two of the accounts it shows are typeable. The LinkedIn card for Pavlo Polishichuk gives the account name pavlo-polishichuk-b68920364 and a biography in Ukrainian reading Posada Full-stack Developer u Freelancer; the post's own summary places that identity in Poland while the card places it in Shpola, Cherkasy, in Ukraine, and the card is what is recorded. The John Ruff identity is a resume hosted on bubble.io whose indexed preview carries a United States telephone number beside the highgoal215 address already held here, which is what ties the number to this persona rather than to a separate one. The Master Dev identity is a Microsoft account created on 3 November 2025 and registered to France, with only a masked telephone number shown.

  x.com/tanuki42_/status/2044106359629898045 — tanuki42 (@tanuki42_) · under “Taro Aikuchi / Tony Sam / John Ruff / Pavlo Polishichuk / Master Dev” · published 2026-04-14 · pulled 2026-08-30

iuri39493@gmail.com

email address IT Worker Fraud CURATED

First seen 2026-09-20 · last seen 2026-09-20

Source

• Read on 20 September 2026 by walking the commit history of every repository on the GitHub account github.com/HighGoal1991, already held under this persona, and tallying the author line on every commit. A commit's author line is what the holder configured their git client with rather than anything the profile page chooses to display, so it recovers addresses the account never states. The address recorded here was not already in this index: iuri39493@gmail.com authored 488 commits across 7 of its repositories, commits as "HighGoal1991". Each is admitted because it commits under a name the account itself uses, which is the test that separates the holder's own address from the original author of a repository copied in. Addresses belonging to unrelated developers whose work appears in these repositories are deliberately not recorded, and an address is evidence that whoever held it wrote those commits rather than proof of who holds the account.

  github.com/HighGoal1991 — Chollima Hunter · under “Taro Aikuchi” · pulled 2026-09-20

miracle7091@outlook.com

email address IT Worker Fraud RESEARCHER POST

First seen 2026-04-16 · last seen 2026-04-16

Source

• A ten-part thread responding to tanuki42's work on this persona, of which parts two, four and nine carry the indicators. It corroborates six values this site already held from tanuki42 independently, including the address, the telephone number, the cryptotrading2150 Telegram account and the deleted 0xbomb215 GitHub account, and adds the six recorded here. The link the thread rests on is a commit trailer in the repository miracle709/Robo-Apply, where a commit authored by 0xbomb215 carries a co-author line naming xsen215 at narutodev215@outlook.com; that is a checkable artefact rather than an assertion, and it is why these identifiers are recorded while the thread's database-only claims are not. The thread also states that 0xbomb215 has since been deleted. Parts three, five, seven and nine continue past the text this pass was able to capture before X throttled the session, so this entry is what those posts state up to that point rather than the whole of them. The address miracle7091@outlook.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.

  x.com/meow_mfer/status/2044588839491248390 — meow mfer (@meow_mfer) · under “Taro Aikuchi / 0xbomb215 / xsen215” · published 2026-04-16 · pulled 2026-08-30

narutodev215@outlook.com

email address IT Worker Fraud RESEARCHER POST

First seen 2026-04-16 · last seen 2026-04-16

Source

• A ten-part thread responding to tanuki42's work on this persona, of which parts two, four and nine carry the indicators. It corroborates six values this site already held from tanuki42 independently, including the address, the telephone number, the cryptotrading2150 Telegram account and the deleted 0xbomb215 GitHub account, and adds the six recorded here. The link the thread rests on is a commit trailer in the repository miracle709/Robo-Apply, where a commit authored by 0xbomb215 carries a co-author line naming xsen215 at narutodev215@outlook.com; that is a checkable artefact rather than an assertion, and it is why these identifiers are recorded while the thread's database-only claims are not. The thread also states that 0xbomb215 has since been deleted. Parts three, five, seven and nine continue past the text this pass was able to capture before X throttled the session, so this entry is what those posts state up to that point rather than the whole of them. The address miracle7091@outlook.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.

  x.com/meow_mfer/status/2044585896637567359 — meow mfer (@meow_mfer) · under “Taro Aikuchi / 0xbomb215 / xsen215” · published 2026-04-16 · pulled 2026-08-30

narutohiro098@gmail.com

email address IT Worker Fraud RESEARCHER POST

First seen 2026-04-14 · last seen 2026-04-14

Source

• Applicant who approached the researcher for a remote engineering role and was assessed by them as a DPRK IT worker. The researcher reports a LinkedIn account created in 2025 with no photograph, an AI-generated CV listing a degree that does not exist and an email address different from the one the application came from, a Telegram account posting to recruit facilitators willing to supply Upwork accounts and stand in for KYC, a GitHub account created in 2025 whose commits carry a third address and among whose repository contributors are accounts the researcher had previously encountered, a connection to the interview from an AstrillVPN address, and a Japanese My Number card the researcher and a consulted specialist assessed as a forgery. Running the three addresses through an OSINT service returned accounts registered under four further names and locations inconsistent with a Japanese national. Both the LinkedIn and the GitHub account were deleted after the interview. The post that carries that OSINT result was itself never cited here until 16 September 2026, and two of the accounts it shows are typeable. The LinkedIn card for Pavlo Polishichuk gives the account name pavlo-polishichuk-b68920364 and a biography in Ukrainian reading Posada Full-stack Developer u Freelancer; the post's own summary places that identity in Poland while the card places it in Shpola, Cherkasy, in Ukraine, and the card is what is recorded. The John Ruff identity is a resume hosted on bubble.io whose indexed preview carries a United States telephone number beside the highgoal215 address already held here, which is what ties the number to this persona rather than to a separate one. The Master Dev identity is a Microsoft account created on 3 November 2025 and registered to France, with only a masked telephone number shown.

  x.com/tanuki42_/status/2044106367028605422 — tanuki42 (@tanuki42_) · under “Taro Aikuchi / Tony Sam / John Ruff / Pavlo Polishichuk / Master Dev” · published 2026-04-14 · pulled 2026-08-30

snowwind0215@gmail.com

email address IT Worker Fraud RESEARCHER POST

First seen 2026-04-14 · last seen 2026-04-14

Source

• Applicant who approached the researcher for a remote engineering role and was assessed by them as a DPRK IT worker. The researcher reports a LinkedIn account created in 2025 with no photograph, an AI-generated CV listing a degree that does not exist and an email address different from the one the application came from, a Telegram account posting to recruit facilitators willing to supply Upwork accounts and stand in for KYC, a GitHub account created in 2025 whose commits carry a third address and among whose repository contributors are accounts the researcher had previously encountered, a connection to the interview from an AstrillVPN address, and a Japanese My Number card the researcher and a consulted specialist assessed as a forgery. Running the three addresses through an OSINT service returned accounts registered under four further names and locations inconsistent with a Japanese national. Both the LinkedIn and the GitHub account were deleted after the interview. The post that carries that OSINT result was itself never cited here until 16 September 2026, and two of the accounts it shows are typeable. The LinkedIn card for Pavlo Polishichuk gives the account name pavlo-polishichuk-b68920364 and a biography in Ukrainian reading Posada Full-stack Developer u Freelancer; the post's own summary places that identity in Poland while the card places it in Shpola, Cherkasy, in Ukraine, and the card is what is recorded. The John Ruff identity is a resume hosted on bubble.io whose indexed preview carries a United States telephone number beside the highgoal215 address already held here, which is what ties the number to this persona rather than to a separate one. The Master Dev identity is a Microsoft account created on 3 November 2025 and registered to France, with only a masked telephone number shown.

  x.com/tanuki42_/status/2044106351992025607 — tanuki42 (@tanuki42_) · under “Taro Aikuchi / Tony Sam / John Ruff / Pavlo Polishichuk / Master Dev” · published 2026-04-14 · pulled 2026-08-30

https://github.com/0xbomb215

github profile IT Worker Fraud RESEARCHER POST removed checked 2026-09-02

First seen 2026-04-14 · last seen 2026-04-14

Source

• Applicant who approached the researcher for a remote engineering role and was assessed by them as a DPRK IT worker. The researcher reports a LinkedIn account created in 2025 with no photograph, an AI-generated CV listing a degree that does not exist and an email address different from the one the application came from, a Telegram account posting to recruit facilitators willing to supply Upwork accounts and stand in for KYC, a GitHub account created in 2025 whose commits carry a third address and among whose repository contributors are accounts the researcher had previously encountered, a connection to the interview from an AstrillVPN address, and a Japanese My Number card the researcher and a consulted specialist assessed as a forgery. Running the three addresses through an OSINT service returned accounts registered under four further names and locations inconsistent with a Japanese national. Both the LinkedIn and the GitHub account were deleted after the interview. The post that carries that OSINT result was itself never cited here until 16 September 2026, and two of the accounts it shows are typeable. The LinkedIn card for Pavlo Polishichuk gives the account name pavlo-polishichuk-b68920364 and a biography in Ukrainian reading Posada Full-stack Developer u Freelancer; the post's own summary places that identity in Poland while the card places it in Shpola, Cherkasy, in Ukraine, and the card is what is recorded. The John Ruff identity is a resume hosted on bubble.io whose indexed preview carries a United States telephone number beside the highgoal215 address already held here, which is what ties the number to this persona rather than to a separate one. The Master Dev identity is a Microsoft account created on 3 November 2025 and registered to France, with only a masked telephone number shown.

  x.com/tanuki42_/status/2044106351992025607 — tanuki42 (@tanuki42_) · under “Taro Aikuchi / Tony Sam / John Ruff / Pavlo Polishichuk / Master Dev” · published 2026-04-14 · pulled 2026-08-30

https://github.com/highgoal1991

github profile IT Worker Fraud RESEARCHER POST live checked 2026-09-02

First seen 2026-04-16 · last seen 2026-04-16

Source

• A ten-part thread responding to tanuki42's work on this persona, of which parts two, four and nine carry the indicators. It corroborates six values this site already held from tanuki42 independently, including the address, the telephone number, the cryptotrading2150 Telegram account and the deleted 0xbomb215 GitHub account, and adds the six recorded here. The link the thread rests on is a commit trailer in the repository miracle709/Robo-Apply, where a commit authored by 0xbomb215 carries a co-author line naming xsen215 at narutodev215@outlook.com; that is a checkable artefact rather than an assertion, and it is why these identifiers are recorded while the thread's database-only claims are not. The thread also states that 0xbomb215 has since been deleted. Parts three, five, seven and nine continue past the text this pass was able to capture before X throttled the session, so this entry is what those posts state up to that point rather than the whole of them. The address miracle7091@outlook.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.

  x.com/meow_mfer/status/2044588839491248390 — meow mfer (@meow_mfer) · under “Taro Aikuchi / 0xbomb215 / xsen215” · published 2026-04-16 · pulled 2026-08-30

https://github.com/highgoal215

github profile IT Worker Fraud RESEARCHER POST removed checked 2026-09-02

First seen 2026-04-16 · last seen 2026-04-16

Source

• A ten-part thread responding to tanuki42's work on this persona, of which parts two, four and nine carry the indicators. It corroborates six values this site already held from tanuki42 independently, including the address, the telephone number, the cryptotrading2150 Telegram account and the deleted 0xbomb215 GitHub account, and adds the six recorded here. The link the thread rests on is a commit trailer in the repository miracle709/Robo-Apply, where a commit authored by 0xbomb215 carries a co-author line naming xsen215 at narutodev215@outlook.com; that is a checkable artefact rather than an assertion, and it is why these identifiers are recorded while the thread's database-only claims are not. The thread also states that 0xbomb215 has since been deleted. Parts three, five, seven and nine continue past the text this pass was able to capture before X throttled the session, so this entry is what those posts state up to that point rather than the whole of them. The address miracle7091@outlook.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.

  x.com/meow_mfer/status/2044588839491248390 — meow mfer (@meow_mfer) · under “Taro Aikuchi / 0xbomb215 / xsen215” · published 2026-04-16 · pulled 2026-08-30

https://github.com/miracle709

github profile IT Worker Fraud RESEARCHER POST live checked 2026-09-02

First seen 2026-04-16 · last seen 2026-04-16

Source

• A ten-part thread responding to tanuki42's work on this persona, of which parts two, four and nine carry the indicators. It corroborates six values this site already held from tanuki42 independently, including the address, the telephone number, the cryptotrading2150 Telegram account and the deleted 0xbomb215 GitHub account, and adds the six recorded here. The link the thread rests on is a commit trailer in the repository miracle709/Robo-Apply, where a commit authored by 0xbomb215 carries a co-author line naming xsen215 at narutodev215@outlook.com; that is a checkable artefact rather than an assertion, and it is why these identifiers are recorded while the thread's database-only claims are not. The thread also states that 0xbomb215 has since been deleted. Parts three, five, seven and nine continue past the text this pass was able to capture before X throttled the session, so this entry is what those posts state up to that point rather than the whole of them. The address miracle7091@outlook.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.

  x.com/meow_mfer/status/2044588839491248390 — meow mfer (@meow_mfer) · under “Taro Aikuchi / 0xbomb215 / xsen215” · published 2026-04-16 · pulled 2026-08-30

https://github.com/xsen215

github profile IT Worker Fraud RESEARCHER POST removed checked 2026-09-02

First seen 2026-04-16 · last seen 2026-04-16

Source

• A ten-part thread responding to tanuki42's work on this persona, of which parts two, four and nine carry the indicators. It corroborates six values this site already held from tanuki42 independently, including the address, the telephone number, the cryptotrading2150 Telegram account and the deleted 0xbomb215 GitHub account, and adds the six recorded here. The link the thread rests on is a commit trailer in the repository miracle709/Robo-Apply, where a commit authored by 0xbomb215 carries a co-author line naming xsen215 at narutodev215@outlook.com; that is a checkable artefact rather than an assertion, and it is why these identifiers are recorded while the thread's database-only claims are not. The thread also states that 0xbomb215 has since been deleted. Parts three, five, seven and nine continue past the text this pass was able to capture before X throttled the session, so this entry is what those posts state up to that point rather than the whole of them. The address miracle7091@outlook.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.

  x.com/meow_mfer/status/2044585896637567359 — meow mfer (@meow_mfer) · under “Taro Aikuchi / 0xbomb215 / xsen215” · published 2026-04-16 · pulled 2026-08-30

taro-aikuchi.vercel.app

hosted site IT Worker Fraud RESEARCHER POST

First seen 2026-04-14 · last seen 2026-04-14

Source

• Applicant who approached the researcher for a remote engineering role and was assessed by them as a DPRK IT worker. The researcher reports a LinkedIn account created in 2025 with no photograph, an AI-generated CV listing a degree that does not exist and an email address different from the one the application came from, a Telegram account posting to recruit facilitators willing to supply Upwork accounts and stand in for KYC, a GitHub account created in 2025 whose commits carry a third address and among whose repository contributors are accounts the researcher had previously encountered, a connection to the interview from an AstrillVPN address, and a Japanese My Number card the researcher and a consulted specialist assessed as a forgery. Running the three addresses through an OSINT service returned accounts registered under four further names and locations inconsistent with a Japanese national. Both the LinkedIn and the GitHub account were deleted after the interview. The post that carries that OSINT result was itself never cited here until 16 September 2026, and two of the accounts it shows are typeable. The LinkedIn card for Pavlo Polishichuk gives the account name pavlo-polishichuk-b68920364 and a biography in Ukrainian reading Posada Full-stack Developer u Freelancer; the post's own summary places that identity in Poland while the card places it in Shpola, Cherkasy, in Ukraine, and the card is what is recorded. The John Ruff identity is a resume hosted on bubble.io whose indexed preview carries a United States telephone number beside the highgoal215 address already held here, which is what ties the number to this persona rather than to a separate one. The Master Dev identity is a Microsoft account created on 3 November 2025 and registered to France, with only a masked telephone number shown.

  x.com/tanuki42_/status/2044106351992025607 — tanuki42 (@tanuki42_) · under “Taro Aikuchi / Tony Sam / John Ruff / Pavlo Polishichuk / Master Dev” · published 2026-04-14 · pulled 2026-08-30

51.195.140.214

ip address IT Worker FraudContagious Interview MATCHED IN SOURCE

First seen 2024-12-19 · last seen 2026-10-18

Network

Looked up 2026-09-21 at ip-api.com. This address is on Spur’s list of Astrill VPN exits. It names the VPN, not the user.

Sources

• Applicant who approached the researcher for a remote engineering role and was assessed by them as a DPRK IT worker. The researcher reports a LinkedIn account created in 2025 with no photograph, an AI-generated CV listing a degree that does not exist and an email address different from the one the application came from, a Telegram account posting to recruit facilitators willing to supply Upwork accounts and stand in for KYC, a GitHub account created in 2025 whose commits carry a third address and among whose repository contributors are accounts the researcher had previously encountered, a connection to the interview from an AstrillVPN address, and a Japanese My Number card the researcher and a consulted specialist assessed as a forgery. Running the three addresses through an OSINT service returned accounts registered under four further names and locations inconsistent with a Japanese national. Both the LinkedIn and the GitHub account were deleted after the interview. The post that carries that OSINT result was itself never cited here until 16 September 2026, and two of the accounts it shows are typeable. The LinkedIn card for Pavlo Polishichuk gives the account name pavlo-polishichuk-b68920364 and a biography in Ukrainian reading Posada Full-stack Developer u Freelancer; the post's own summary places that identity in Poland while the card places it in Shpola, Cherkasy, in Ukraine, and the card is what is recorded. The John Ruff identity is a resume hosted on bubble.io whose indexed preview carries a United States telephone number beside the highgoal215 address already held here, which is what ties the number to this persona rather than to a separate one. The Master Dev identity is a Microsoft account created on 3 November 2025 and registered to France, with only a masked telephone number shown.

  x.com/tanuki42_/status/2044106374054064176 — tanuki42 (@tanuki42_) · under “Taro Aikuchi / Tony Sam / John Ruff / Pavlo Polishichuk / Master Dev” · published 2026-04-14 · pulled 2026-08-30

• …– Rustdesk logs 173.205.94.156 – Rustdesk logs 83.234.227.36 – Rustdesk logs 38.170.181.10 – Rustdesk logs 209.127.228.186 – Rustdesk logs 51.195.140.214 – Rustdesk logs 207.126.86.121 – Rustdesk logs 51.161.196.51 – Rustdesk logs Mitigation Recommendations: Hand out company laptops…

  North Korean ITW IoCs and Mitigation Recommendations — Farnsworth Intelligence · under “North Korean ITW Threat Mitigations and IoC's” · published 2025-01-26 · pulled 2026-09-10

• …1.57 43.230.201.68 45.126.210.144 45.145.68.10 45.250.255.59 45.250.255.140 45.86.208.162 50.2.184.50 50.7.159.34 50.7.251.66 50.118.211.10 51.195.140.214 60.234.42.250 60.249.92.67 61.218.132.193 61.218.138.181 61.219.114.7 61.221.116.19 61.221.116.28 61.221.116.109 63.143.61.57 64.32.17.130…

  PurpleBravo’s Targeting of the IT Software Supply Chain — Recorded Future · under “Appendix C: Astrill VPN Nodes” · published 2026-01-21 · pulled 2026-09-12

• These are the exit addresses of a commercial VPN service with customers everywhere. An address on this list says that a connection came through Astrill, which DPRK IT workers are documented to favour; it does not say who was behind the connection, and the great majority of traffic through these exits is ordinary customers. Treat a match as a reason to look at the account behind it, not as evidence about the person. The list is a snapshot of the addresses active on 19 December 2024; VPN exits are reassigned over time, so an address here may since have been returned to its hosting provider and given to someone else. The list is Spur's and is carried here as published.

  Astrill VPN and DPRK Remote Worker Fraud — Spur · published 2024-12-19 · pulled 2026-10-26

+17164268176

phone number IT Worker Fraud RESEARCHER POST

First seen 2026-04-14 · last seen 2026-04-14

Line type

Looked up 2026-09-30 at phonevalidator.com. This is a lookup of the line itself.

Source

• Applicant who approached the researcher for a remote engineering role and was assessed by them as a DPRK IT worker. The researcher reports a LinkedIn account created in 2025 with no photograph, an AI-generated CV listing a degree that does not exist and an email address different from the one the application came from, a Telegram account posting to recruit facilitators willing to supply Upwork accounts and stand in for KYC, a GitHub account created in 2025 whose commits carry a third address and among whose repository contributors are accounts the researcher had previously encountered, a connection to the interview from an AstrillVPN address, and a Japanese My Number card the researcher and a consulted specialist assessed as a forgery. Running the three addresses through an OSINT service returned accounts registered under four further names and locations inconsistent with a Japanese national. Both the LinkedIn and the GitHub account were deleted after the interview. The post that carries that OSINT result was itself never cited here until 16 September 2026, and two of the accounts it shows are typeable. The LinkedIn card for Pavlo Polishichuk gives the account name pavlo-polishichuk-b68920364 and a biography in Ukrainian reading Posada Full-stack Developer u Freelancer; the post's own summary places that identity in Poland while the card places it in Shpola, Cherkasy, in Ukraine, and the card is what is recorded. The John Ruff identity is a resume hosted on bubble.io whose indexed preview carries a United States telephone number beside the highgoal215 address already held here, which is what ties the number to this persona rather than to a separate one. The Master Dev identity is a Microsoft account created on 3 November 2025 and registered to France, with only a masked telephone number shown.

  x.com/tanuki42_/status/2044106371097149569 — tanuki42 (@tanuki42_) · under “Taro Aikuchi / Tony Sam / John Ruff / Pavlo Polishichuk / Master Dev” · published 2026-04-14 · pulled 2026-08-30

+818027828640

phone number IT Worker Fraud RESEARCHER POST

First seen 2026-04-14 · last seen 2026-04-14

Line type

Looked up 2026-09-13 at phonevalidator.com. This is a lookup of the line itself.

Source

• Applicant who approached the researcher for a remote engineering role and was assessed by them as a DPRK IT worker. The researcher reports a LinkedIn account created in 2025 with no photograph, an AI-generated CV listing a degree that does not exist and an email address different from the one the application came from, a Telegram account posting to recruit facilitators willing to supply Upwork accounts and stand in for KYC, a GitHub account created in 2025 whose commits carry a third address and among whose repository contributors are accounts the researcher had previously encountered, a connection to the interview from an AstrillVPN address, and a Japanese My Number card the researcher and a consulted specialist assessed as a forgery. Running the three addresses through an OSINT service returned accounts registered under four further names and locations inconsistent with a Japanese national. Both the LinkedIn and the GitHub account were deleted after the interview. The post that carries that OSINT result was itself never cited here until 16 September 2026, and two of the accounts it shows are typeable. The LinkedIn card for Pavlo Polishichuk gives the account name pavlo-polishichuk-b68920364 and a biography in Ukrainian reading Posada Full-stack Developer u Freelancer; the post's own summary places that identity in Poland while the card places it in Shpola, Cherkasy, in Ukraine, and the card is what is recorded. The John Ruff identity is a resume hosted on bubble.io whose indexed preview carries a United States telephone number beside the highgoal215 address already held here, which is what ties the number to this persona rather than to a separate one. The Master Dev identity is a Microsoft account created on 3 November 2025 and registered to France, with only a masked telephone number shown.

  x.com/tanuki42_/status/2044106351992025607 — tanuki42 (@tanuki42_) · under “Taro Aikuchi / Tony Sam / John Ruff / Pavlo Polishichuk / Master Dev” · published 2026-04-14 · pulled 2026-08-30

https://t.me/cryptodegen202

telegram account IT Worker Fraud RESEARCHER POST live checked 2026-11-08

First seen 2026-04-16 · last seen 2026-04-16

Source

• A ten-part thread responding to tanuki42's work on this persona, of which parts two, four and nine carry the indicators. It corroborates six values this site already held from tanuki42 independently, including the address, the telephone number, the cryptotrading2150 Telegram account and the deleted 0xbomb215 GitHub account, and adds the six recorded here. The link the thread rests on is a commit trailer in the repository miracle709/Robo-Apply, where a commit authored by 0xbomb215 carries a co-author line naming xsen215 at narutodev215@outlook.com; that is a checkable artefact rather than an assertion, and it is why these identifiers are recorded while the thread's database-only claims are not. The thread also states that 0xbomb215 has since been deleted. Parts three, five, seven and nine continue past the text this pass was able to capture before X throttled the session, so this entry is what those posts state up to that point rather than the whole of them. The address miracle7091@outlook.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.

  x.com/meow_mfer/status/2044588839491248390 — meow mfer (@meow_mfer) · under “Taro Aikuchi / 0xbomb215 / xsen215” · published 2026-04-16 · pulled 2026-08-30

https://t.me/cryptotrading2150

telegram account IT Worker Fraud RESEARCHER POST live checked 2026-11-08

First seen 2026-04-14 · last seen 2026-04-14

Source

• Applicant who approached the researcher for a remote engineering role and was assessed by them as a DPRK IT worker. The researcher reports a LinkedIn account created in 2025 with no photograph, an AI-generated CV listing a degree that does not exist and an email address different from the one the application came from, a Telegram account posting to recruit facilitators willing to supply Upwork accounts and stand in for KYC, a GitHub account created in 2025 whose commits carry a third address and among whose repository contributors are accounts the researcher had previously encountered, a connection to the interview from an AstrillVPN address, and a Japanese My Number card the researcher and a consulted specialist assessed as a forgery. Running the three addresses through an OSINT service returned accounts registered under four further names and locations inconsistent with a Japanese national. Both the LinkedIn and the GitHub account were deleted after the interview. The post that carries that OSINT result was itself never cited here until 16 September 2026, and two of the accounts it shows are typeable. The LinkedIn card for Pavlo Polishichuk gives the account name pavlo-polishichuk-b68920364 and a biography in Ukrainian reading Posada Full-stack Developer u Freelancer; the post's own summary places that identity in Poland while the card places it in Shpola, Cherkasy, in Ukraine, and the card is what is recorded. The John Ruff identity is a resume hosted on bubble.io whose indexed preview carries a United States telephone number beside the highgoal215 address already held here, which is what ties the number to this persona rather than to a separate one. The Master Dev identity is a Microsoft account created on 3 November 2025 and registered to France, with only a masked telephone number shown.

  x.com/tanuki42_/status/2044106351992025607 — tanuki42 (@tanuki42_) · under “Taro Aikuchi / Tony Sam / John Ruff / Pavlo Polishichuk / Master Dev” · published 2026-04-14 · pulled 2026-08-30