Contacted by a recruiter who might be fake? Check the Catfish List →
Curated by Tenfold · Free, Public, Always Sourced

Might Be Fake.

Spotting the signs of candidate fraud and hiring scams is getting harder every day. Might Be Fake brings together real-life examples and verified fraud signals in one searchable place, so you can spot patterns and stay up to date in this constantly evolving space.

1100+email addresses 125+profiles 2400+IP addresses 170+recruiter impersonators
Firsthand Fraud / Then vs. Now / Fraud Indicators / IP Addresses / Catfish List / Sources / Fraud Squad
Spot the Patterns
Firsthand Fraud
Videos, photos, investigations, and firsthand accounts from people who caught it, documented it, or were targeted by it. Look for common signs of fraud and patterns of deception.
"Bratislav" and Dawid Moczadło hand wave test catches deepfake live on video call
Video
"Bratislav Rakočević" - Hand Wave Test Breaks the Deepfake Live
Dawid Moczadło - LinkedIn
Bettina Liporazzi deepfake interview catch
Video
Recruiter Spots AI Filter in 30 Seconds
Bettina Liporazzi - LinkedIn
NBC News Nisos investigation North Korean IT worker Jo monitored with FBI
Video
"Jo" - Inside an Active North Korean IT Worker Cell
NBC News Investigations
Crypto CEO accidentally interviews North Korean operatives Joseph Scott and Michael Lee DPRK IT workers
Video
"Joseph Scott" and "Michael Lee" - CEO Accidentally Interviews Two DPRK Operatives
YouTube
Thomas Muller deepfake filter video interview screenshot
Video
"Thomas Muller" - Deepfake Filter Caught Mid-Interview
Daniel Grek Sanchez Castellanos - LinkedIn
KnowBe4 real vs fake employee photo side by side
Photos
"Kyle" - KnowBe4 Hired a North Korean IT Worker, Then Caught Him Installing Malware
KnowBe4 Blog
Chollima I - Bitso team member holding target stickers
Video
Lazarus Group Tried to Infiltrate, Got Hacked Back
Bitso Quetzal - Substack
Mateo Chollima III AI facial reconstruction interview
Video
"Mateo Jimenez" - AI Face Filter, Refused to Turn Camera Off
Bitso Quetzal - Substack
Alfredo Chollima III lighter AI filter same day
Video
"Alfredo Solares" - Lighter Filter, Same Day, Second Attempt
Bitso Quetzal - Substack
Arthur Burrus Julian Chollima IV senior operative
Video
"Julian" - Operative Joined Call Posing as Someone Else
Bitso Quetzal - Substack
Sebastian Tamayo Chollima V
Video
"Sebastian Tamayo" - Claims Colombian, Can't Speak Spanish, LinkedIn Gone Mid-Call
Bitso Quetzal - Substack
Sebastian Peralta Chollima VI blurry face filter
Video
"Sebastian Peralta" - Claims Barranquilla, IP Bouncing Through Asia
Bitso Quetzal - Substack
Sofia Grimaldo after Lucas Gabriel left the meeting - Chollima VII
Video
"Lucas Gabriel" - Set a Trap, Caught Them, Traced It Back to North Korea
Bitso Quetzal - Substack
Radio Free Asia video North Korean recruiter Benjamin approaches cybersecurity engineer Toufik Airane
Video
"Benjamin" Offers $70K/Month to Borrow a Security Engineer's Identity
Radio Free Asia
Chollima II stolen Mexican identity sombrero photo
Photos
"Jose" - Stolen Mexican Identity, 3-Month-Old LinkedIn Profile
Bitso Quetzal - Substack
Two fake IDs used by same DPRK IT worker actor
Photos
"Alex Lu" aka "Devid Park" aka "David Park" - One Actor, Multiple Fake IDs, Tracked Across Financial Fraud
lilbagscientist - X
Lucas Lee DPRK worker interviewing at biomedical tech firm
Photos
"Lucas Lee" - Interviewed at Biomedical Firm, Suspected Defense Org Target
@aptwhatnow - X
Jacob Haigis North Korean IT worker
Photos
"Jacob Haigis" - ID'd as North Korean IT Worker
@aptwhatnow - X
David Ye aka David Rose North Korean IT worker Minnesota laptop facilitator
Photos
"David Ye" aka "David Rose" - North Korean IT Worker, US Facilitator Hosting His Laptops
@browsercookies - X
Taku Yamamoto aka Hiroto Iwaki North Korean IT worker pink suit headshot
Photos
"Taku Yamamoto" aka "Hiroto Iwaki" - Same Person, Two Identities
@blackbigswan - X
Patrick New North Korean IT worker successfully hired at AI org
Photos
"Patrick New" - Successfully Hired at AI Org, Staffing Agent in West Palm Beach
@aptwhatnow - X
Benjamin aka Michael Brown North Korean IT worker successfully hired at AI org
Photos
"Benjamin" aka "Michael Brown" - Successfully Hired at AI Org, Same Staffing Agent
@aptwhatnow - X
Rami North Korean IT worker waving at camera
Photos
"Rami" - North Korean IT Worker, Multiple Photos Surfaced
@heihei5711 - X
Hiroki Hara North Korean IT worker blurry face
Photos
"Hiroki Hara" - Blurry Face, North Korean IT Worker
@eastside_nci - X
Kazune Takeda North Korean IT worker
Photos
"Kazune Takeda" - North Korean IT Worker, Crowdsourced ID
@blackbigswan - X
Joe Hisaishi North Korean IT worker face photo linked to Kazune Takeda
Photos
"Joe Hisaishi" - Real Face Behind the "Kazune Takeda" Persona
@Narcass3 - X
Joe Hisaishi alias for Kazune Takeda North Korean IT worker selfie
Photos
"Joe Hisaishi" - Alias for "Kazune Takeda", Real Face Surfaced
@Narcass3 - X
David Rose aka David Ye North Korean IT worker Texas stand-in for identity checks Minnesota laptop facilitator
Photos
"David Rose" aka "David Ye" - Facilitator Hosts Laptops in Minnesota, College Student Stand-In in Texas Completes Identity Checks for Money
@browsercookies - X
Logan Collins North Korean IT worker Webcam Effects app watermark visible
Photos
"Logan Collins" - North Korean IT Worker, Webcam Effects App Visible in Frame
@browsercookies - X
Eugene Palla North Korean IT worker ID photo
Photos
"Eugene Palla" - North Korean IT Worker
@browsercookies - X
Jason Rostro North Korean IT worker on video call
Photos
"Jason Rostro" - North Korean IT Worker
@browsercookies - X
Faraz Q North Korean IT worker on video call
Photos
"Faraz Q" - North Korean IT Worker
@browsercookies - X
Andrew Littell North Korean IT worker on video call
Photos
"Andrew Littell" - North Korean IT Worker
@browsercookies - X
Jordan Nervin aka Obrad Moldovan Tony Gonzalez Alex Schilling North Korean IT worker ID photo
Photos
"Jordan Nervin" aka "Obrad Moldovan", "Tony Gonzalez", "Alex Schilling" - Texas ID, Canadian and Finnish Passports, US Green Card, Country of Birth Listed as China
@browsercookies - X
Harry Pham North Korean IT worker uses Texas driver license
Photos
"Harry Pham" - North Korean IT Worker, Uses Texas Driver's License
@browsercookies - X
Justin Schmid North Korean IT worker uses German passport
Photos
"Justin Schmid" - North Korean IT Worker, Uses German Passport
@browsercookies - X
Ryan Hammonds aka Ryan Stringfellow North Korean IT worker
Photos
"Ryan Hammonds" aka "Ryan Stringfellow" - North Korean IT Worker, Multiple Names
@browsercookies - X
Ryan Hammonds aka Ryan Stringfellow North Korean IT worker passport photo
Photos
"Ryan Stringfellow" - Passport Photo Tied to "Ryan Hammonds" Identity
@browsercookies - X
Kevin Chang North Korean IT worker video call screenshot
Photos
"Kevin Chang" - North Korean IT Worker
@browsercookies - X
James McClung aka Ondriah Young North Korean IT worker AI-generated American profile photo
Photos
"James McClung" aka "Ondriah Young" - Connected from Same IP, Russia
@browsercookies - X
Justin Stone North Korean IT worker passport photo
Photos
"Justin Stone" - North Korean IT Worker
@browsercookies - X
Daniel Everest North Korean IT worker headshot
Photos
"Daniel Everest" - North Korean IT Worker
@browsercookies - X
Marko Nicovic aka Hua Min Fe aka Tom Callaghan North Korean IT worker
Photos
"Marko Nicovic" aka "Hua Min Fe" aka "Tom Callaghan" - North Korean IT Worker
@Narcass3 - X
Bryce Hodges North Korean IT worker same actor as Thomas Peters
Photos
"Bryce Hodges" - North Korean IT Worker, Same Actor as "Thomas Peters"
@browsercookies - X
Thomas Peters aka Bryce Hodges North Korean IT worker
Photos
"Thomas Peters" - North Korean IT Worker, Same Actor as "Bryce Hodges"
@browsercookies - X
Luis Pena North Korean IT worker Singapore virtual background
Photos
"Luis Pena" - North Korean IT Worker
@browsercookies - X
William Clark aka Salbatore Pazarella North Korean IT worker fake resume fullstack developer
Photos
"William Clark" aka "Salbatore Pazarella" - Fake Resume, North Korean IT Worker
@browsercookies - X
Douglas Li North Korean IT worker fake resume senior frontend developer
Photos
"Douglas Li" - North Korean IT Worker, Fake Senior Frontend Developer Resume
@browsercookies - X
Hiroto Iwaki fake portfolio website Full Stack Blockchain Developer
Photos
"Hiroto Iwaki" - Fake Portfolio Site, Full Stack Blockchain Developer
@blackbigswan - X
Jason Rostro personal website with cartoon avatar and jason.calls.recruiters@gmail.com email
Photos
"Jason Rostro" - Portfolio Site, Cartoon Avatar, Recruiter-Bait Email
@browsercookies - X
Jason Rostro LinkedIn profile showing no photo, open to work, Ex-Apple Ex-HP claims, recently created account
LinkedIn Profile
"Jason Rostro" - LinkedIn Profile, No Photo, Recently Created, Claims Ex-Apple Ex-HP
@browsercookies - X
Nerea Almiron fraudulent IT worker stolen Florida identity actually Delaram Gholampoor Sagha from Tehran Iran
LinkedIn Profile
"Nerea Almiron" - Stolen Florida Identity, Actually "Delaram Gholampoor Sagha" out of Tehran, Iran
@browsercookies - X
Paul Jones aka Joseph Jones aka Ryan Sims aka Ryan Sm North Korean IT worker multiple LinkedIn identities
LinkedIn Profile
"Paul Jones" aka "Joseph Jones" - Same Actor as "Ryan Sims", Multiple LinkedIn Identities
@browsercookies - X
Lucas Lee North Korean IT worker LinkedIn profile OpenToWork Senior Software Engineer
LinkedIn Profile
"Lucas Lee" - North Korean IT Worker, #OpenToWork LinkedIn Profile
@browsercookies - X
Ryan Sims fake DPRK LinkedIn profile claiming Wyoming
LinkedIn Profile
"Ryan Sims" aka "Ryan Sm" - 3-Month-Old Profile, Claims Wyoming, Won't Meet in Person
@browsercookies - X
Johnny Williams fake DPRK LinkedIn profile claiming New York
LinkedIn Profile
"Johnny Williams" - Decade of Experience, Brand New Account
@browsercookies - X
Steven Medina fake DPRK LinkedIn profile claiming Texas
LinkedIn Profile
"Steven Medina" - Walmart Listed, Brand New Account, Can't Meet in Person
@browsercookies - X
Lauro Jefferson fake DPRK LinkedIn profile with stock mountain climber photo
LinkedIn Profile
"Lauro Jefferson" - Brand New Account, Can't Meet in Person
@browsercookies - X
Mehmet Demir suspected fake DPRK LinkedIn profile backend developer Blocknovas
LinkedIn Profile
"Mehmet Demir" - Suspected DPRK Persona, Backend Dev at Fake Firm "Blocknovas"
Silent Push
Fake South Carolina driver's license seized from Christina Chapman laptop farm DOJ indictment evidence
Photos
"L. Shunquez" - Fake SC Driver's License from the Chapman Laptop Farm Indictment
ABC7 News
Joe Hisaishi Japanese passport linked to Kazune Takeda North Korean IT worker
Photos
"Joe Hisaishi" - Japanese Passport Tied to "Kazune Takeda" Identity
@Narcass3 - X
Fake Serbian passport used by North Korean IT worker
Photos
"Devid Park" - CEO Hired a North Korean Agent via Freelance Dev
Mickey Hardy - X
Know Your Candidate
That Was Then. This Is Now.
Then
Unit 42 Palo Alto Networks hand wave deepfake test demonstration
Deepfake Demo - Unit 42
The Hand Wave Test - May No Longer Be Reliable
Palo Alto Networks Unit 42
Unit 42 Palo Alto Networks ear to shoulder deepfake tilt test
Deepfake Demo - Unit 42
The Ear-to-Shoulder Test - May No Longer Be Reliable
Palo Alto Networks Unit 42
Unit 42 Palo Alto Networks nose show deepfake test
Deepfake Demo - Unit 42
The Nose Show - May No Longer Be Reliable
Palo Alto Networks Unit 42
Unit 42 Palo Alto Networks look up look down sky ground deepfake test
Deepfake Demo - Unit 42
The Sky or Ground Test - May No Longer Be Reliable
Palo Alto Networks Unit 42
Now
The detection techniques that used to work are no longer reliable. Deepfake tech has outpaced our ability to spot it visually. Your best defense now is your ability to spot non-visual fraud signals and stronger authentication skills.
Eduardo Pires holds three fingers in front of face - deepfake passes the fingers test
Video
Three Fingers in Front of Face - Deepfake Passes That Test Too
Eduardo Pires - LinkedIn
AI Generated label - real vs fake side by side voice cloning deepfake
Video
Real-Time Voice Cloning and Facial Deepfake - State of the Art in 2025
YouTube
Wolf of Wall Street deepfake passes hand wave test
Video
Wolf of Wall Street Deepfake - Passes the Hand Wave Test
Posted on X - widely shared, covered by mainstream news
Stranger Things deepfake real-time face replacement
Video
Stranger Things Deepfake - Real-Time Face Replacement, Undetectable
Posted on X - widely shared, covered by mainstream news
Fraud Signals
Indicators of Candidate Fraud
Emails, profiles, and domains associated with candidate fraud activity according to government advisories and security research. These are signals for further investigation, not confirmation of fraud. Always verify flags and stack your signals before making decisions.
Indicator
Loading...

Location Masking
IP Addresses
IP address ranges used by DPRK IT workers to appear US-based during video interviews and remote work. Partner with your IT or Security department to scan for these IP addresses and VPN ranges.
Astrill VPN is the most documented VPN used by DPRK IT workers to fake a US location during interviews. Spur maintains a publicly available list of 2,400+ Astrill IP ranges updated continuously. If a candidate's IP during a video interview falls within these ranges, that is a signal worth following up on, not a disqualifier on its own.

View the Astrill VPN IP list
Real Recruiter or Impostor?
The Catfish List
Just as there are fake candidates, there are also fake recruiters (catfish) impersonating real ones. Here's how the scam works.
The real recruiters below have had their identities stolen by fraudsters to scam jobseekers. The names are legitimate but the emails are not. If you receive a catfish email, flag it as phishing, notify the real recruiter, and report to the FTC and FBI IC3.
Are you a recruiter being impersonated? Submit details here to be added to the list.
Real Recruiter Catfish Contact Info
Loading...

For the Record
Sources
Government advisories, indictments, and security research behind this page.
Government Advisories & Indictments
SourceLink
PSA: Deepfakes and Stolen PII Used to Apply for Remote Work
FBI Internet Crime Complaint Center
FBI IC3
United States v. Chapman - DPRK IT Worker Indictment
DOJ / US Attorney DC
DOJ
Four North Koreans Charged in Cryptocurrency Theft Scheme
DOJ / US Attorney NDGA
DOJ
Fourteen North Korean Nationals Indicted - Multi-Year IT Worker Fraud
DOJ
DOJ
Coordinated Nationwide Actions to Combat DPRK IT Worker Schemes
DOJ
DOJ
Responding to the Evolution and Global Expansion of the DPRK IT Worker Threat
CSIS
CSIS
Job Scammers Are Looking to Hire You
FTC Consumer Alert
FTC
Security Research
SourceLink
i3 Threat Advisory: Inside the DPRK (includes email list)
DTEX Systems
DTEX
Exposing DPRK's Cyber Syndicate and Hidden IT Workforce
DTEX Systems
DTEX
CrowdStrike 2025 Threat Hunt Report
CrowdStrike
CrowdStrike
False Face: Unit 42 Demonstrates Real-Time Deepfake Creation in 70 Minutes
Palo Alto Networks Unit 42
Unit 42
Exposing a Fraudulent DPRK Candidate - Firsthand Investigation with Laptop Farm Access
Nisos
Nisos
Jasper Sleet: North Korean Remote IT Workers' Evolving Tactics to Infiltrate Organizations
Microsoft Threat Intelligence
Microsoft

Wouldn’t it be great if there was a place for recruiters to share fraud signals like this?

Now there is. Introducing Fraud Squad, a free, verified community for recruiting professionals to come together and fight candidate fraud.

Join us

Candidate fraud does not stop at awareness.

Fraud signals like these help to educate and inform. Tenfold helps recruiting teams turn that awareness into readiness skills, clearer process, and stronger hiring decisions.

Book a call