[[important update: It appears there is a critical error in my previous analysis. The email address returned by Constella for that 12 digit was actually sergio-gor@gmail.com, not sergio.gor@gmail.com (the latter being the address that registered steveking.com back in the day). Please accept my apologies for this horrible oversight on my part.]]

So I've been looking at this guy Sergio Gor, who's been described as one of the most powerful figures in the Trump administration: Director of the White House Office of Presidential Personnel.

Per The Times of Malta:

"While not the most glamourous sounding position, Gor’s role will see him wield considerable influence in the Trump government, responsible for vetting the appointment of thousands of employees.

https://timesofmalta.com/article/meet-sergio-gor-the-maltese-man-heart-trump-administration.1104244

Meanwhile, The New York Post wrote on June 17 that Gor still hasn't been vetted himself:

"...three administration insiders told The Post that the vetter-in-chief has not turned in his Standard Form 86, or SF-86 — a more than 100-page set of questions required for officials who need security clearances."

"Among the questions applicants must answer under threat of criminal penalties is where they were born and whether they have any foreign connections."

"Gor claims to be from the island country of Malta, though an official there could not confirm his birthplace when provided his exact birthday, saying: “No acts are registered with the provided details.”

"Gor declined to divulge his birthplace to The Post, other than to say it was not Russia."

His Wikipedia page says he was born in 1986 in Malta, and later moved w/ family to Los Angeles. But there indications he was born in Russia in 1980.

https://en.m.wikipedia.org/wiki/Sergio_Gor

Sergio Gor is known to have worked on the campaign of the conservative former Rep. Steve King, and a search in Domaintools finds Sergio Gor registered Steveking.com way back when. Domaintools says Gor used the email address sergio.gor@gmail.com, which was also used to register the vanity domain sergiogor.com.

Constella Intelligence, a threat hunting platform that indexes breached data, finds this email address used the rather unique and long password: 961649507273. Constella further finds that this password is almost exclusively tied to a bunch of email accounts for the same name, including sgoryachev999@rambler.ru, goryachev-sergey@yandex.ru, sergio-gor@yandex.ru
sergio-gor@qip.ru, goryachev-sergey@ya.ru, goryachev-sergey@list.ru and goryachev-sergey@gmail.com.

Constella also says goryachev-sergey@yandex.ru has multiple entries in Russian government databases for a Sergey Anatolyevich Goryachev, DOB, Nov. 20, 1980, phone +79689210000. This person appears to have lived in Saratov, RU, has a tax ID number, etc.

Here's a mind map I put together on these findings. The password thing is very hard to get past.

This was kind of interesting but not quite ah-hah! type info, but worth mentioning maybe:

I noticed that some of the domains registered to sergio.gor@gmail.com included the registrant "Carter Clews" in their WHOIS records. This name has a fascinating history:

https://www.sourcewatch.org/index.php/Carter_Clews

"In 1985, Clews set up his own PR firm, Clews and Co., and was hired to work on behalf of the Nicaraguan contras, organizing events such as a fundraising dinner for the Nicaraguan Refugee Fund. The dinner included a staged photograph of Ronald Reagan kissing 8-year-old Patricia Guerra, who was introduced as a "Nicaraguan refugee."

"(It was later disclosed that Patricia was born in the United States, lived in Washington, and that her parents had been in the United States for more than 15 years.)"

"The United States Council for World Freedom hired Clews' public relations agency to improve the public image of John K. Singlaub, a retired general and USCWF's leading public spokesman. Clews was recommended to USCWF by Rob Owen, a contract agent of the Nicaraguan Humanitarian Aid Organization. The Clews agency did the promotion and publicity for the 1985 WACL convention. [3] In 1986, Clews was described as an "aide" to Singlaub when it was reported that an airplane carrying weapons to the contras had been shot down inside Nicaragua. Eugene Hasenfus, a U.S. mercenary who was aboard the plane and survived the crash, later disclosed that the airplane and Singlaub were part of the Reagan administration's covert operation to supply the contras in violation of legislation passed by Congress."

"In 1988, Clews worked for the Howard Phillips's Conservative Caucus. Later that year he became an aide to the Federal Trade Commission but was fired after sending out a letters to newspaper editorial boards and radio talk shows criticizing Democratic presidential nominee Michael Dukakis. AdWeek reported that "Clews' actions may have violated the Hatch Act, a federal statute that forbids government employees from using their office to influence an election."

"In 1989, Clews Communications declared bankruptcy, with debts of $59,190 to creditors of which it was only able to pay 22%. Clews went to work for the Blackwell Corporation, a television production company headed by Neal B. Freeman, and then went on to work for Inphomation Communications Inc., a Baltimore-based marketing company that produced the Psychic Friends Network infomercials (fronted by Dionne Warwick) for several years before eventually going bankrupt. In 1995, the National Infomercial Marketing Association gave Clews a "best infomercial writing" award for his work for Inphomation on an infomercial for a fishing product called "Helicopter Lure.""

Incidentally, when one does a reverse search on the phone number in these Carter Clews domain records -- 1.4433409848 -- it turns up 56 domains, most of them Washington DC-news themed.

Domain Name Create Date Registrar
bayislandsreport.com 2008-05-19 enom corporate inc.
bigchipsports.com 2010-12-25 godaddy.com, llc
caribbclub.com 2018-05-14 NAMESILO, LLC
caribbclub.info 2011-11-12 godaddy.com llc (r171-lrms)
caribbclub.org 2011-11-12 godaddy.com, llc (r91-lror)
caribbeanlandcompany.org 2010-02-06 godaddy.com, llc (r91-lror)
caribbeanlandconsortium.com 2011-05-28 godaddy.com, llc
caribbeanlandconsortium.info 2011-05-28 godaddy.com llc (r171-lrms)
caribbeanlandconsortium.mobi -- --
caribbeanlandconsortium.net 2011-05-28 godaddy.com, llc
caribbeanlandconsortium.org 2011-05-28 godaddy.com, llc (r91-lror)
caribbeanlandconsortium.us 2011-05-28 godaddy.com, inc.
caribbeanlifeclub.com 2013-10-31 GO DADDY SOFTWARE INC
caribbeanlifeclub.info 2011-05-28 godaddy.com llc (r171-lrms)
caribbeanlifeclub.mobi -- --
caribbeanlifeclub.net 2011-05-28 godaddy.com, llc
caribbeanlifeclub.org 2011-05-28 godaddy.com, llc (r91-lror)
caribbeanlifeclub.us 2011-05-28 godaddy.com, inc.
caribbeanlifenow.info 2010-05-17 godaddy.com inc. (r171-lrms)
caribbeanretirementpage.info 2010-05-05 godaddy.com inc. (r171-lrms)
cariblandco.com 2009-04-18 tucows.com co.
cheapcaribbeanproperty.info 2010-05-05 godaddy.com inc. (r171-lrms)
clewsviews.info 2010-05-20 godaddy.com inc. (r171-lrms)
clewsviews.org 2010-05-20 godaddy.com, inc. (r91-lror)
dominicanlifeclub.com 2010-06-26 godaddy.com, inc.
easywyn.com 2021-06-25 GoDaddy.com, LLC
ganoeasy.com 2010-11-10 godaddy.com, llc
honduraslifeclub.com 2017-09-23 TurnCommerce, Inc. DBA NameBright.com
honduraslifetoday.com 2014-07-27 GO DADDY SOFTWARE INC
inextoday.com 2019-04-29 GoDaddy.com, LLC
infomax24.info 2020-05-08 NAMECHEAP, INC
ipolnews.info 2010-05-17 godaddy.com inc. (r171-lrms)
lowcostcaribbeanproperty.info 2010-05-05 godaddy.com inc. (r171-lrms)
newsradiowashington.org 2009-12-26 godaddy.com, inc. (r91-lror)
obamanominees.org 2009-06-23 godaddy.com, inc. (r91-lror)
panamalifeclub.com 2010-06-26 godaddy.com, inc.
redskinblog.com 2015-03-03 GO DADDY SOFTWARE INC
t-roots.info 2015-07-07 GLOBAL MEDIA ONLINE INC
tea-roots.info 2010-05-05 godaddy.com inc. (r171-lrms)
thetimesnet.com 2024-09-03 Realtime Register B.V.
times-24.com 2025-02-04 GoDaddy.com, LLC
washingtonheadlinenews.org 2009-12-22 godaddy.com, inc. (r91-lror)
washingtonimpacts.net 2011-06-09 godaddy.com, llc
washingtonimpacts.org 2011-06-09 godaddy.com, llc (r91-lror)
washingtonnews-observer.mobi -- --
washingtonnews-observer.org 2009-01-29 godaddy.com, inc. (r91-lror)
washingtonnewsobserver.mobi -- --
washingtonnewsobserver.org 2009-01-29 godaddy.com, inc. (r91-lror)
washingtonnewsradio.org 2010-01-25 godaddy.com, inc. (r91-lror)
washingtonnewsreporter.org 2009-12-17 godaddy.com, inc. (r91-lror)
washingtonnewstribune.com 2014-08-19 GO DADDY SOFTWARE INC
washingtonradionews.org 2009-12-26 godaddy.com, inc. (r91-lror)
washingtontimes24.com 2011-02-02 godaddy.com, llc
washnews.org 2013-06-06 WILD WEST DOMAINS, LLC
washnewstribune.com 2010-06-17 godaddy.com, inc.
wtimes24.com 2022-08-25 NameCheap, Inc.

@briankrebs don't forget that at least on Gmail periods in the name don't matter. Is the unpunctuated address used anywhere? And do any of the other providers have similar 'features'?
@fencepost @briankrebs ya.ru is just an alternative domain for yandex.ru, so goryachev-sergey@yandex.ru and goryachev-sergey@ya.ru are the same account, might want to check if goryachev-sergey@yandex.com is used somewhere.

Gor previously worked for Sen. Rand Paul. In August 2018, Sen. Paul reportedly hand-delivered a letter from Trump to Putin. Here's the photo from that story (Gor is on the right).

https://mynbc15.com/news/nation-world/us-senator-presents-letter-from-trump-for-putin

edited: mixed up the direction of the letter (it was from Trump TO Putin)

@briankrebs

Interesting that a Putin-connected staffer to anti-Iran-war Rand Paul, combined with this insight from Jared Yates Sexton:

"Tucker Carlson and those of his ilk are against war with Iran because they're aligned with the Putinist / Alexander Dugin ideology that wants to create ethno/religious states that dominate their spheres of influence."

means the Putinists appear to NOT want war for Putinist reasons.

https://bsky.app/profile/jysexton.bsky.social/post/3lrxsjgm3ps2a

Jared Yates Sexton (@jysexton.bsky.social)

Tucker Carlson and those of his ilk are against war with Iran because they're aligned with the Putinist / Alexander Dugin ideology that wants to create ethno/religious states that dominate their spheres of influence. That's it. And it would help if this kind of obvious context was made available.

Bluesky Social

@briankrebs

FTR *I* don't want war with Iran, but not for Putinist reasons. 😀 🙃

@danmcd @briankrebs

In the run up to the Brexit vote, Goldman Sachs published an analysis saying it would be a disaster for the economy. A bunch of idiots said ‘look, Goldman Sachs says it’s bad, it must be good!’ The thing about GS is that they’re parasites: they don’t want to kill their host.

Sometimes an idea is so bad that it’s bad for pretty much everyone. The fact that fairly unambiguously evil people are also against it doesn’t mean it’s a good idea, it means that it’s really that bad an idea.

@danmcd @briankrebs

Iran is also supplying Putin with drones and other weapons for use in Ukraine, so I'm sure Putin doesn't want that interrupted.

@briankrebs He has a face of a russian officer. Source: am russian (not officer)
@briankrebs Russian mole 

@EdBruce
No, Sir, not mole. Gotta keep someone close to Krasnov, just in case.

@briankrebs

@phoenixgee yes, he's kind of an escort. Not the kind of escort the Orange Caligula likes, but he can swing a magazine too if needed.
@EdBruce @briankrebs
@briankrebs a lot of people are asking Sergio questions that are answered by his "I wasn't born in Russia!" T-shirt.

@womble @briankrebs

Was he born in Belarus or maybe at a Soviet embassy in another country?

@briankrebs

Is EVERYBODY in this administration completely #kompromat!?!??

@Ehay2k @briankrebs the word is compromised. “kompromat” is the material that makes you compromised (it's a russian compound word)
Компромат — Википедия

@mawhrin @briankrebs

Oh, thanks for that. I'd seen it used (apparently inappropriately) as a synonym for compromised, but with the intention of showing Russian influence.

@briankrebs no way "Gor" is short for "Goryachev"! /s

@jt_rebelo @briankrebs From various sources it seems like he used the surname Gorokhovsky.

Also...

https://en.wikipedia.org/wiki/Gorokhovsky

> This article is about the locality in Russia. For the businessman and political operative, see Sergio Gor.

lmao

Gorokhovsky - Wikipedia

@briankrebs @timo21 damn. This is amazing work, but also… damn.

@briankrebs

A dude from Malta was part of the 1st term Russian investigation.

@briankrebs

That statement looks so vapid in print. I just can't remember the guy's name. A professor with a mysterious background who kind of disappeared?

@briankrebs I kept a very open mind about Trump then had my own dealings with his sphere of influence which led me down rabbit hole after rabbit hole. I am absolutely convinced he is on the Kremlin's hook. It's very easy to understand. He borrowed all that money from Russia when he went bankrupt. Each of his wives were warned to US authorities to be Russian assets targeting him. You have Trump towers data streams back to Alfa bank. Trump strategically removing highly capable counter intelligence officials. Russian mobsters hiding in Trump tower. The list goes on and on... It's so obvious.
@briankrebs cut him some slack. Wikipedia says he came to the USA at age 12. A lot of USA high school graduates probably mix up Malta and Russia all the time. /s
@lahosken @briankrebs Can't tell if /s...
I would like to think anyone who isn't *severely* cognitively impaired would be able to remember their country of origin if they left there at age 12. If someone moved from the USA at age 12, I would be deeply concerned if they believed they grew up in Panama.
@briankrebs Please tell me this is going to get a proper Krebs post 🙏
@securingdev sure is shaping up that way
@briankrebs That’s how Stalin built his power: as General Secretary, he was able to appoint loyalists to key Party positions.
@briankrebs Christ we are now a poorly administered vassal state
@briankrebs vetting? By what standards one wonders.
@briankrebs Jesus man. ok so at what point do you personally start looking at your personal safety for discussing this shit? Please tell me you have like, solid opsec. I'm starting to worry.
@briankrebs Trump's head of WH personnel has a mysterious personal history and indications of strong Russian links.
Putin likes to have full control of his assets.

@briankrebs

WT holy F, this is Director of White House Personnel?

How is this man even near the White House?

@rexi @briankrebs

We're so far into emperor has no clothes territory that they're wandering with their Sergio Gors dangling about and people in power aren't saying boo.

Steve King btw, if anyone doesn't recall lost his Iowa 60/40 leaning republican safe district for being too toxic & racist to hold a seat on a committee in Congress.

@briankrebs Do you have a feel for how Constella has compiled this intel? Some of the data sources floating around are not exactly stellar (eg combolists where people have scripted in bogus emails based on valid addresses just to beef up the set)
@briankrebs Does the fbi know that this guy is in there? Maybe someone should tip them off?

@briankrebs

> Those who have known him personally say that before immigrating from Malta he had been born in the Soviet Union.

Source: https://thedispatch.com/article/a-loyalists-loyalist-in-charge-of-personnel/

Also repeated here: https://malteselivingabroad.gov.mt/wp-content/uploads/2025/02/069-MALTESE-PRESENCE-FEBRUARY-2025.pdf

A Loyalist’s Loyalist in Charge of Personnel

Trump devotee Sergio Gor will head one of the most important offices in the new administration.

The Dispatch

@briankrebs About that "important update": Google does not allow registering Gmail addresses with hyphens. The only non-alphanumeric character it allows is one or more (non-initial, non-final, nonconsecutive) periods, which after registration, it considers essential when signing in, but optional when addressing email.

(It necessarily follows that no two Gmail accounts can differ only in periods, so any two Gmail addresses differing only in periods refer to the same account.)

Is there any chance the period resulted from a typo or poorly implemented word wrap?

@briankrebs
A must read.
Trump's Russian handler.