> [!hm-nav]
> ** [[Home|HAYDEN MCKENZIE]]** [[Home|Home]] [[Research|Research]] [[Indicators|Indicators]] [[About|About]]
# Indicator register
Services, platforms, domains, and techniques named across the published investigations. Presence on this list means a resource was observed in use by the operations under study. Many are legitimate commercial services with substantial non-malicious use, and inclusion here is not an accusation against any provider.
Updated 19 Aug 2026 · [[Indicator data|CSV]]
## Victim selection and identity sourcing
| Indicator | Role | Report |
| --- | --- | --- |
| LinkedIn | Primary victim-sourcing pool. Searched by common American name and developer title; profiles without photographs explicitly preferred | P1, P2 |
| TruthFinder | Background report on the selected victim. Premium account sourced from a broker at $55/month | P2 |
| Intelius | Address history, relatives, employment, and court records on the selected victim | P2 |
| FastPeopleSearch | Free-tier initial confirmation of a candidate identity | P2 |
| upworksell[.]com | Historical marketplace for stolen identities and pre-built freelance accounts. Seized 2024-05-16 | P2 |
| Telegram | Broker contact, identity purchase, and aged-account supply | P2 |
| Discord | Bidder recruitment, persona handover, facilitator solicitation, and aged LinkedIn account supply | P1, P2, OL |
## Identity validation
| Indicator | Role | Report |
| --- | --- | --- |
| ssn-check[.]org | Public SSN validation, used to confirm a purchased number is structurally valid and issued | P2 |
| State DMV self-service portals | Confirming a purchased driver's licence number is live before spending on documents. Ten states listed: TX, MI, SC, AL, NY, KS, MD, AZ, PA, NJ | P2 |
## Document fabrication and photo manipulation
| Indicator | Role | Report |
| --- | --- | --- |
| oldie.veriftools[.]ru | Russian-hosted generator for passports, driver's licences, ID cards, and bank statements. Domain seized 2025-08 | P2 |
| trustidcard[.]com | Broker producing identity documents to order; described in the manual as the expensive option | P2 |
| faceswapper[.]ai | Matching a document photograph to whoever will appear on camera | P2 |
| instant-portrait[.]com | Same role; also used to defeat reverse image search on persona photographs | P2 |
## Network infrastructure
| Indicator | Role | Report |
| --- | --- | --- |
| cloudzy[.]com | Hourly-billed US-region VPS, allowing instances to be created and destroyed at will. New York region specifically recommended | P2 |
| ishosting[.]com | US and Canada VPS, preferred where a stable long-lived IP is needed | P2 |
| IPRoyal | Residential proxy layer. Ledger shows a $47 broker fee for passing identity verification and $20 to restore a suspended account | P2 |
| CCProxy | Windows HTTP/SOCKS5 proxy run on a US VPS or supporter machine, presenting a distributed team as one American user | P2 |
| Astrill VPN | VPN provider. Explicitly rejected for job applications because ATS platforms flag it | P1, P2 |
| Windscribe VPN | Secondary VPN provider | P2 |
| Hostinger | Domain registration, hosting, and mailbox infrastructure | P2 |
| Vercel | Free subdomain hosting for bidding-service storefronts | P2 |
| bidpro-ochre[.]vercel[.]app | Bidding-as-a-service storefront: batch pricing, named client list, live Google Sheets application logs. Not itself assessed as DPRK-operated | P2 |
## Accounts, phone numbers, and verification
| Indicator | Role | Report |
| --- | --- | --- |
| mailforspam[.]com | Disposable secondary address used during Gmail account creation | P2 |
| sms-man[.]com | SMS verification numbers at scale | P2 |
| sms-activate[.]org | SMS verification numbers at scale | P2 |
| 2fa[.]live | Browser-based TOTP generation, meaning MFA secrets are shared across a team rather than bound to a device | P2 |
| slynumber[.]com | Current persona phone numbers, replacing Skype | P2 |
| hushed[.]com | Current persona phone numbers, replacing Skype | P2 |
| Skype | Historical persona numbers, assessed as drawing less suspicion than Google Voice. Now defunct | P2 |
| Google Voice | Explicitly rejected — recruiters recognise it as virtual immediately | P2 |
| CoinGate | Crypto-to-gift-card gateway used to fund phone and service accounts | P2 |
| Persona (inquiry.withpersona[.]com) | Identity verification vendor targeted by the emulator and screen-capture bypass | P2 |
| LDPlayer | Android emulator used to redirect ID verification challenges away from a real camera | P2 |
| ShareX | Screen capture of verification QR codes for redirection into the emulator | P2 |
| VCAM | Virtual camera presented to verification flows in place of a physical camera | P2 |
| OBS | Same role as VCAM; named in the manual under a heading instructing use instead of a camera | P2 |
| AirDroid | Remote control of a physical Android handset from a computer | P2 |
| Cookie-Editor (Chrome extension) | Importing LinkedIn session cookies so an authenticated session moves between operators without re-authenticating | P2 |
## Storage, handoff, and coordination
| Indicator | Role | Report |
| --- | --- | --- |
| protectedtext[.]com | Free password-protected plaintext notes used to distribute identity dossiers between operators | P2 |
| SendGB | Free file transfer with a retention window measured in days; used to hand off packaged operation archives | P2 |
| OneNote | Per-identity dossiers within the archive | P2 |
| Google Sheets | Shared application logs with colour-coded status columns, between buyer and bidder | P1, P2 |
| WhatsApp | Documented channel of communication, including a +234 (Nigeria) contact number | P2 |
## Persona construction and application
| Indicator | Role | Report |
| --- | --- | --- |
| FlowCV | Resume builder. $70 annual line item in the expense ledger | P2 |
| ChatGPT | Resume drafting, per-application tailoring, and interview answer generation | P1, P2 |
| Claude | Named alongside ChatGPT in the manual for the same purpose | P2 |
| ResumeKit | Per-application resume tailoring in the outsourced bidder workflow | P1 |
| LazyApply (Chrome extension) | Bulk application bot, purchased at roughly $170, claimed to support 750 applications per day across five profiles | P2 |
| Workday | ATS submission target. IP-aware, which is why commercial VPNs are rejected | P1, P2 |
| Greenhouse | ATS submission target | P1, P2 |
| Indeed, Dice, Glassdoor, SimplyHired, ZipRecruiter, CareerBuilder | Named job boards for volume application | P2 |
## Interview and presence
| Indicator | Role | Report |
| --- | --- | --- |
| Voicemeeter Banana | Virtual audio mixer routing one person's voice into a call another person appears to be attending | P2 |
| Zoom | Interviews; also abused for remote control where enterprise policy permits it. Network artifact: saveUserDisclaimer | P2 |
| Webex | Video conferencing used for remote control and screen sharing as a detection workaround | P2 |
| Google Meet | Same role as Webex | P2 |
| Excalidraw | Whiteboarding during technical interviews | P2 |
## Remote access to employer hardware
| Indicator | Role | Report |
| --- | --- | --- |
| PiKVM | Hardware KVM on the employer-issued endpoint. Photographic evidence of continued use through 2026 | P2 |
| TinyPilot | Hardware KVM named in a diagram supplied to a prospective US facilitator | OL |
| EDID emulator | Fitted so the employer machine believes a monitor is attached and never sleeps | OL |
| RustDesk | Remote access software | P2 |
| AnyDesk | Remote access software; also the mechanism offered to US-based recruits in place of bidding | P1, P2, OL |
| TeamViewer | Remote access software | P2 |
| Google Remote Desktop | Remote access software | P2 |
## Entity formation and contracting
| Indicator | Role | Report |
| --- | --- | --- |
| Texas SOSDirect | Online filing portal for the Certificate of Formation (Form 205). $300 filing fee | P2 |
| IRS online EIN application | Federal tax ID assigned immediately after formation, enabling a business bank account | P2 |
| Upwork | Freelance platform. Accounts created in a real American's identity because the platform tracks IP | P2, OL |
## Payments and cash-out
| Indicator | Role | Report |
| --- | --- | --- |
| HuruPay | Stablecoin-backed virtual USD/EUR/GBP accounts marketed to non-US residents. Receives payroll and off-ramps near-instantly | P2 |
| Payoneer | Withdrawal target for earnings held in a recruit's real name | P2, OL |
| PayPal | Withdrawal target for earnings held in a recruit's real name | P2, OL |
| Binance | Exchange and BSC on-ramp | P1, P2 |
| USDT (BEP20) | Primary settlement asset for bidder payments and broker fees | P1, P2 |
| USDT (TRC20) | Settlement asset for splitting and moving proceeds | P2 |
| USDC, ERC20, Polygon, Arbitrum | Additional rails visible in the ledger for splitting and moving proceeds | P2 |
## MITRE ATT&CK mapping
| ID | Technique | Observed as |
| --- | --- | --- |
| T1589.001 | Gather Victim Identity Information | Written victim selection criteria; LinkedIn name-and-role sourcing; background report acquisition |
| T1585.001 | Establish Accounts: Social Media | Purchased and laundered LinkedIn accounts; purchased Facebook accounts |
| T1586 | Compromise Accounts | Aged LinkedIn account takeover; session cookie portability |
| T1588.007 | Obtain Capabilities: Artificial Intelligence | ChatGPT for resumes and answers; AI face-swap tooling |
| T1583.003 | Acquire Infrastructure: Virtual Private Server | Cloudzy and ishosting US-region instances |
| T1583.008 | Acquire Infrastructure: Malvertising/Proxy | IPRoyal residential proxies; CCProxy chaining |
| T1199 | Trusted Relationship | Employment as the access vector; intermediary LLC contracting |
| T1078 | Valid Accounts | Employer-issued credentials retained in dossiers |
| T1219 | Remote Access Software | RustDesk, AnyDesk, Google Remote Desktop |
| T1200 | Hardware Additions | PiKVM and TinyPilot on employer-issued endpoints |
> [!hm-footer]
> **HAYDEN MCKENZIE** · Independent research. Primary sources.
>
> [[Research|Research]] · [LinkedIn ↗](https://www.linkedin.com/in/haymcken/) · [[Attachments/Hayden-McKenzie-CV.pdf|CV ↗]] · [Email ↗](mailto:
[email protected])