In November 2024, federal prosecutors in Los Angeles unsealed an indictment naming Joel Martin Evans, then 25, of North Carolina, with "joeleoli" printed among his aliases. He pleaded guilty to conspiracy to commit wire fraud and was sentenced on August 27, 2026 to 24 months. The public record hands a practitioner two identifiers, the moniker and a Gmail address that reporter Brian Krebs traced to a 2018 forum registration, and they behave very differently under search. The username search returns 33 results, including a GitLab profile that displays a real name and a tight cluster of accounts created between late 2016 and 2018; the email lookup returns six presence hits and resolves nothing.
That contrast is the point of this post. We did no unmasking; every identity claim here belongs to the government and a journalist.
The record: an indictment, a reporter's link and a guilty plea
The Department of Justice announced the case on November 20, 2024. A federal grand jury in the Central District of California charged Evans and three other men with one count of conspiracy to commit wire fraud, one count of conspiracy, and one count of aggravated identity theft; a fifth man, a UK national, was charged by separate complaint. The release describes "Joel Martin Evans, 25, a.k.a. 'joeleoli,' of Jacksonville, North Carolina" and says the FBI arrested him in North Carolina the day before. The indictment, case 2:24-cr-00595, is posted by Krebs as a PDF. It was returned by a June 2024 grand jury, filed in October 2024, and alleges a conspiracy running from no later than September 2021 to about April 2023. The press release puts the reach of the scheme at employees of at least 45 companies, phished by text message. The indictment alleges that Evans specifically "would create software" used in the phishing attacks and "would assist in creating and managing online infrastructure", including a Telegram channel that received stolen credentials. The indictment lists his residence as Wilmington, North Carolina; the press release says Jacksonville. We leave that to the court file.
The name link came from journalism. Krebs' November 21, 2024 report explains that in August 2022 security firms reached the server behind the group's Telegram phishing bot, and that the server "on several occasions leaked the Telegram ID and handle of its developer, who used the nickname 'Joeleoli'." He continues: "That Joeleoli moniker registered on the cybercrime forum OGusers in 2018 with the email address [email protected], which also was used to register accounts at several websites for a Joel Evans from North Carolina." Prosecutors, he adds, say Joeleoli's real name is Joel Martin Evans.
The case has since resolved. The judgment entered on August 27, 2026 records that Evans pleaded guilty to Count One of the first superseding indictment, conspiracy to commit wire fraud under 18 U.S.C. 1349, and that Judge John W. Holcomb sentenced him to 24 months in prison and three years of supervised release. The remaining counts were dismissed on the government's motion, so the specific conduct charged in them was never tested and stays an allegation here. Krebs' June 23, 2026 report caught the case two months earlier, with the Justice Department saying Evans still faced charges.
The email lookup: six presence hits, no handle
We started where the reporting started, with the mailbox. An email lookup on the address checked about 175 platforms and returned six presence hits: X, a Microsoft consumer account, Battle.net, Asana, Figma and Disney+.
That is a real footprint: a games launcher, two work tools, a streaming service and a social account. But none of the six returned a username, a display name, a profile URL or a creation date. With this address alone, the lookup says the mailbox is in active consumer use and nothing about who uses it. The name link in this case, the OGusers registration and the other "Joel Evans from North Carolina" registrations Krebs describes, lives in data our lookup does not touch.
We recorded a clean negative and moved to the handle.
The username search: 33 exact matches for joeleoli
A username search on "joeleoli" checked more than 750 platforms and returned 33 results, on about 30 distinct services once duplicate checks of the same account are folded together. The rows that carry dates or names are in the table.
| Platform | What came back | Account created |
|---|---|---|
| Twitch | "joeleoli", 17 followers, English | 22 Dec 2016 |
| MyFitnessPal | "joeleoli" | 4 Jan 2017 |
| GOG | display name "Joeleoli" | 15 Jan 2017 |
| GitLab | display name "Joel Evans" | 22 Sep 2017 |
| TypeRacer | display name "Joel", one race, 109 wpm | 22 Oct 2017 |
| Chess.com | location "US" | 1 Nov 2017 |
| Keybase | avatar, no name | 18 Sep 2018 |
| GitHub | 11 followers, profile links to an X account whose handle is the same with one extra character | not shown |
| Snapchat | display name "Joel" | not shown |
| Telegram | "@joeleoli" exists | not shown |
| X | "@joeleoli" taken, profile not public | not shown |
| Hypixel forum | "joeleoli", last activity May 2021 | not shown |
| MyAnimeList | display name "Joeleoli" | 12 Aug 2026 |
The rest are bare registrations under the same handle, mostly gaming and hobby sites: Minecraft, Xbox, a Warframe trading site, Nexus Mods, a FiveM forum, Kick, Streamlabs, Pinterest, Geocaching, Codecademy and a few more. A small number of results are not listed because they add nothing to the chain.
Two results need a flag. An account under the same handle on another platform shows a different surname, a different country and a 2015 creation date, so we exclude it as a different person and leave it out of the table. The MyAnimeList account was created in August 2026, roughly 21 months after the arrest. An account created after someone is publicly named could be a squatter, an impersonator or a coincidence, and it says nothing about the defendant.
The chain
The public chain runs handle to email to name, and other people made all three links. The phishing server exposed the handle. Krebs matched the handle to a 2018 forum registration and its email. Prosecutors matched the person. Our searches sit on top of that chain as corroboration:
- The handle, searched alone, returns a GitLab profile whose display name is "Joel Evans", created in September 2017, before the conspiracy period the indictment describes and before the 2018 forum registration in the reporting.
- The same handle returns TypeRacer and Snapchat profiles that both display "Joel".
- The GitHub profile links out to an X account whose handle is the same with one extra character, a linked-account signal rather than a name.
- The email, searched alone, returns six registrations and no handle, so it cannot be used to walk back to the username.
Read the arrows carefully. Our search did not connect the email to the handle; the reporter did, from forum registration data. Our search shows that the handle alone carried a first name and a full name on ordinary consumer platforms years before anyone wrote about it.
What the dates say
Seven of the dated accounts were created in a 21-month window, December 2016 to September 2018. That is consistent with one person adopting a handle and carrying it across gaming, fitness, coding, typing and chess the way a teenager does. The Hypixel forum account, a Minecraft community, was last active in May 2021.
The GitLab date matters most. September 2017 is a year before the forum registration in the reporting and four years before the conspiracy he admitted began. A display name entered on a developer platform then is the kind of low-stakes registration people forget, and it later becomes the strongest artifact in a footprint.
The single 2026 registration sits eight years outside the cohort, which is why the squatter hedge applies.
What it teaches
The two identifiers are different kinds of key. An email lookup asks a platform whether an account exists, and the answer is usually yes or no. A username search loads a profile page, which carries names, avatars, bios, creation dates and outbound links. A distinctive, reused handle becomes the richer key even when the mailbox is the one printed in the record.
Coined handles reward this. "joeleoli" is not a dictionary word, so all 33 results were exact matches with no noise to discard. Search a handle like "express" or "defender" and hundreds of results arrive, almost none of them your subject.
Presence on a platform is never proof of ownership. The GitLab display name is consistent with the identification the government and the reporting made. It is not evidence of it; our search cannot say who typed that name in 2017.
How to run this yourself
Start with whichever identifier the record gives you. If it is an email, run the email lookup, export the result, and note which platforms returned a handle or display name rather than a bare registration; then run any handles through the username search. If it is a handle, run the username search first, sort by creation date, and look for the tight cohort that marks a single owner. On paid plans the cross search pivots from a recovered handle or linked account, and the investigation view stacks each pivot under the last so the chain stays readable in the export. See current plans for what each tier includes.
Write your negatives down with the same care as your positives. "Email returned six presences and no handle" is a finding.
Limits
Every name in this post came from the Department of Justice and from Brian Krebs' reporting, and we are grateful for the open record both maintain. Our searches read public profile pages and registration signals, not forum databases, breach data or private messages, which is where the attribution in this case was made. We left out a small number of results, the co-defendants' details and recent activity on the accounts, because none of it changes the chain and some of it belongs to people outside this story. Evans admitted the conspiracy count and has been sentenced; the counts dismissed at judgment were never tested, and nothing here treats them as proven. This post shows how two public identifiers behave under search, and claims nothing more.
