Andrew’s LinkedIn page also says he is the administrator and Web developer at a hosting company in Ukraine called ghost.ua. The same anime profile image for Andrew’s LiveJournal page is also on the LinkedIn profile for an Andrew Hodirevski from Ukraine, and the two pages share the aforementioned Twitter profile (purplexcite). In almost a dozen posts on LiveJournal, Hodirevski talks about his interest in Java programming, and even includes a few pictures of himself attending an instructional class on Java. That profile (“ ikaikki“) says Hodirevski’s email address is that his Jabber instant message address is and that his Twitter account is “ purplexcite” (that Twitter has since been deleted). I located a relatively recent Livejournal profile ( /profile) for an Andrew Hodirevski from Odessa, Ukraine that includes several profile pictures which are remarkably similar to the photos of Helkern leaked by the cihms guys. In this cached post we can see him again claiming the 261333 ICQ address, and pointing out to other members that his real nickname is Helkern.Īndrew from Odessa’s LiveJournal profile pic from the account ikaikki”Ī historic WHOIS lookup ordered from shows that was first registered in 2008 to an Andrey Hodirevski from Illichivsk, a city in the Odessa province of southwestern Ukraine. Helkern - going by his shortened username “Hel,” also was a VIP member of xakername. Helkern said his email address was his Skype address was helkern_skype, and that he lived in Odessa, the third-largest city in Ukraine. In this introductions page from a Russian language gaming forum, a user named Helkern also was active in 2008 and claimed that same ICQ address. In it, he claims ownership of the ICQ instant messenger address 261333.

So if Helkern is Rescator, who is Helkern? If we check at some of the other Russian forums that Helkern was active in at the time that Darklife was online in 2008, we can see he was a fairly frequent contributor to the now-defunct Grabberzcom in this cached post, Helkern can be seen pasting an exploit he developed for a remote SQL injection vulnerability.

Darklife admin “Helkern” brags to other members about hacking into cihms, a more elite Russian hacking forum.In a counterattack documented in the entertaining thread that is still posted as a trophy of sorts at cihms/old/epicfail, hackers from cihms hacked into the Darklife forum, and posted personal photos of Helkern and fellow Darklife leaders, including these two of Helkern:

Instore carding forums