> [!hm-nav]
> ** [[home|HAYDEN MCKENZIE]]** [[home|Home]] [[research|Research]] [[indicators|Indicators]] [[about|About]]
# Indicator register
Services, platforms, domains, and techniques named across the published investigations. Presence on this list means a resource was observed in use by the operations under study. Many are legitimate commercial services with substantial non-malicious use, and inclusion here is not an accusation against any provider.
Updated 19 Aug 2026 [[indicator data|CSV ↓]]
Report references: P1 [[research/dprk-it-worker-operation-part-one|How North Korea Outsources Job Fraud at Scale]] · P2 [[research/dprk-it-worker-operation-part-two|Dissecting the Identity Lifecycle]] · OL [[research/eleven-stages-five-observed-live|North Korea's Desperate Methods of Recruitment]]
## Victim selection and identity sourcing
| Indicator | Role | Report |
| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------- | ---------- |
| LinkedIn | Primary victim-sourcing pool. Searched by common American name and developer title; profiles without photographs explicitly preferred | P1, P2 |
| TruthFinder | Background report on the selected victim. Premium account sourced from a broker at $55/month | P2 |
| Intelius | Address history, relatives, employment, and court records on the selected victim | P2 |
| FastPeopleSearch | Free-tier initial confirmation of a candidate identity | P2 |
| upworksell.com | Historical marketplace for stolen identities and pre-built freelance accounts. Seized 2024-05-16 | P2 |
| Telegram | Broker contact, identity purchase, and aged-account supply | P2 |
| Discord | Bidder recruitment, persona handover, facilitator solicitation, and aged LinkedIn account supply | P1, P2, OL |
## Identity validation
| Indicator | Role | Report |
| ------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------- | ------ |
| ssn-check.org | Public SSN validation, used to confirm a purchased number is structurally valid and issued | P2 |
| State DMV self-service portals | Confirming a purchased driver's licence number is live before spending on documents. Ten states listed: TX, MI, SC, AL, NY, KS, MD, AZ, PA, NJ | P2 |
## Document fabrication and photo manipulation
| Indicator | Role | Report |
| -------------------- | --------------------------------------------------------------------------------------------------------------- | ------ |
| oldie.veriftools.ru | Russian-hosted generator for passports, driver's licences, ID cards, and bank statements. Domain seized 2025-08 | P2 |
| trustidcard.com | Broker producing identity documents to order; described in the manual as the expensive option | P2 |
| faceswapper.ai | Matching a document photograph to whoever will appear on camera | P2 |
| instant-portrait.com | Same role; also used to defeat reverse image search on persona photographs | P2 |
## Network infrastructure
| Indicator | Role | Report |
| ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- | ------ |
| cloudzy.com | Hourly-billed US-region VPS, allowing instances to be created and destroyed at will. New York region specifically recommended | P2 |
| ishosting.com | US and Canada VPS, preferred where a stable long-lived IP is needed | P2 |
| IPRoyal | Residential proxy layer. Ledger shows a $47 broker fee for passing identity verification and $20 to restore a suspended account | P2 |
| CCProxy | Windows HTTP/SOCKS5 proxy run on a US VPS or supporter machine, presenting a distributed team as one American user | P2 |
| Astrill VPN | VPN provider. Explicitly rejected for job applications because ATS platforms flag it | P1, P2 |
| Windscribe VPN | Secondary VPN provider | P2 |
| Hostinger | Domain registration, hosting, and mailbox infrastructure | P2 |
| Vercel | Free subdomain hosting for bidding-service storefronts | P2 |
## Accounts, phone numbers, and verification
| Indicator | Role | Report |
| --------------------------------- | ---------------------------------------------------------------------------------------------------------------- | ------ |
| mailforspam.com | Disposable secondary address used during Gmail account creation | P2 |
| sms-man.com | SMS verification numbers at scale | P2 |
| sms-activate.org | SMS verification numbers at scale | P2 |
| 2fa.live | Browser-based TOTP generation, meaning MFA secrets are shared across a team rather than bound to a device | P2 |
| slynumber.com | Current persona phone numbers, replacing Skype | P2 |
| hushed.com | Current persona phone numbers, replacing Skype | P2 |
| Skype | Historical persona numbers, assessed as drawing less suspicion than Google Voice. Now defunct | P2 |
| Google Voice | Explicitly rejected — recruiters recognise it as virtual immediately | P2 |
| CoinGate | Crypto-to-gift-card gateway used to fund phone and service accounts | P2 |
| Persona (inquiry.withpersona.com) | Identity verification vendor targeted by the emulator and screen-capture bypass | P2 |
| LDPlayer | Android emulator used to redirect ID verification challenges away from a real camera | P2 |
| ShareX | Screen capture of verification QR codes for redirection into the emulator | P2 |
| VCAM | Virtual camera presented to verification flows in place of a physical camera | P2 |
| OBS | Same role as VCAM; named in the manual under a heading instructing use instead of a camera | P2 |
| AirDroid | Remote control of a physical Android handset from a computer | P2 |
## Storage, handoff, and coordination
| Indicator | Role | Report |
| ----------------- | --------------------------------------------------------------------------------------------------------- | ------ |
| protectedtext.com | Free password-protected plaintext notes used to distribute identity dossiers between operators | P2 |
| SendGB | Free file transfer with a retention window measured in days; used to hand off packaged operation archives | P2 |
| WeTransfer | Free file transfer with a retention window measured in days; used to hand off packaged operation archives | P2 |
| OneNote | Per-identity dossiers within the archive | P2 |
| Google Sheets | Shared application logs with colour-coded status columns, between buyer and bidder | P1, P2 |
| WhatsApp | Documented channel of communication, including a +234 (Nigeria) contact number | P2 |
## Persona construction and application
| Indicator | Role | Report |
| --- | --- | --- |
| FlowCV | Resume builder. $70 annual line item in the expense ledger | P2 |
| ChatGPT | Resume drafting, per-application tailoring, and interview answer generation | P1, P2 |
| Claude | Named alongside ChatGPT in the manual for the same purpose | P2 |
| ResumeKit | Per-application resume tailoring in the outsourced bidder workflow | P1 |
| LazyApply (Chrome extension) | Bulk application bot, purchased at roughly $170, claimed to support 750 applications per day across five profiles | P2 |
| Workday | ATS submission target. IP-aware, which is why commercial VPNs are rejected | P1, P2 |
| Greenhouse | ATS submission target | P1, P2 |
| Indeed, Dice, Glassdoor, SimplyHired, ZipRecruiter, CareerBuilder | Named job boards for volume application | P2 |
## Interview and presence
| Indicator | Role | Report |
| --- | --- | --- |
| Voicemeeter Banana | Virtual audio mixer routing one person's voice into a call another person appears to be attending | P2 |
| Zoom | Interviews; also abused for remote control where enterprise policy permits it. Network artifact: saveUserDisclaimer | P2 |
| Webex | Video conferencing used for remote control and screen sharing as a detection workaround | P2 |
| Google Meet | Same role as Webex | P2 |
| Excalidraw | Whiteboarding during technical interviews | P2 |
## Remote access to employer hardware
| Indicator | Role | Report |
| --- | --- | --- |
| PiKVM | Hardware KVM on the employer-issued endpoint. Photographic evidence of continued use through 2026 | P2 |
| TinyPilot | Hardware KVM named in a diagram supplied to a prospective US facilitator | OL |
| EDID emulator | Fitted so the employer machine believes a monitor is attached and never sleeps | OL |
| RustDesk | Remote access software | P2 |
| AnyDesk | Remote access software; also the mechanism offered to US-based recruits in place of bidding | P1, P2, OL |
| TeamViewer | Remote access software | P2 |
| Google Remote Desktop | Remote access software | P2 |
## Entity formation and contracting
| Indicator | Role | Report |
| ---------- | ------------------------------------------------------------------------------------------------- | ------ |
| Upwork | Freelance platform. Accounts created in a real American's identity because the platform tracks IP | P2, OL |
| Freelancer | Freelance platform. Accounts created in a real American's identity because the platform tracks IP | P2, OL |
## Payments and cash-out
| Indicator | Role | Report |
| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------- | ------ |
| HuruPay | Stablecoin-backed virtual USD/EUR/GBP accounts marketed to non-US residents. Receives payroll and off-ramps near-instantly | P2 |
| Payoneer | Withdrawal target for earnings held in a recruit's real name | P2, OL |
| PayPal | Withdrawal target for earnings held in a recruit's real name | P2, OL |
| Binance | Exchange and BSC on-ramp | P1, P2 |
| USDT (BEP20) | Primary settlement asset for bidder payments and broker fees | P1, P2 |
| USDT (TRC20) | Settlement asset for splitting and moving proceeds | P2 |
> [!hm-footer]
> **HAYDEN MCKENZIE** · Independent security researcher
>
> [[research|Research]] · [LinkedIn ↗](https://www.linkedin.com/in/haymcken/) · [Email ↗](mailto:
[email protected]) · [Substack ↗](https://substack.com/@haydenmckenzie) · [[attachments/Hayden-McKenzie-CV.pdf|CV ↗]]