From notsafety to Daniel Herrera: Unmasking the Real Identity Behind neo_net’s Smishing-as-a-Service Operation

**OSINT attribution of Ankarex operator:** This investigation traces an anonymous GitHub user (notsafety / neo_net) to a real person in Monterrey, Mexico, using commit metadata, a Facebook Messenger link, multiple breach records, IP geolocation, forum activity, Telegram channels, and linked payment infrastructure; it also documents the Ankarex smishing-as-a-service platform, associated domains, APK hashes, IOCs, and observed TTPs targeting the financial sector.