If you find a match
A match is the start of an inquiry, not its conclusion. This page covers an organisation whose hire or applicant matches and a person who finds their own details listed here.
If a hire or an applicant matches
-
1
Read what the match establishes
An indicator is a value a cited source reported in connection with DPRK activity, not a finding about its holder. It may belong to a victim or be a coincidence; the labels show how strongly the source put it.
-
2
Check it against the cited source
Confirm the cited record says what the entry says about the same value. If it does not, report it by submission email.
-
3
Preserve evidence, and do not alert the person yet
- The FBI’s announcement of 16 May 2024 recommends evaluating the suspect’s network activity.
- SEAL’s guidance on mitigating DPRK IT workers advises against ending the engagement abruptly.
- The FBI’s announcement of 23 January 2025 notes that discovered workers have held stolen data for ransom.
-
4
Bring in counsel, HR and security together
The May 2022 State, Treasury and FBI guidance warns of legal consequences, including sanctions designation, for involvement in DPRK IT-worker activity.
-
5
Verify the person, not only the value
The same guidance recommends verifying employment and education history through independently found contacts. The FBI’s announcement of 13 October 2026 adds that no single indicator is reliable, recommends layered checks across the whole employment, and warns that the worker may be a recruited facilitator or a subcontractor rather than the person who was hired.
-
6
Report it
In the United States, report to the Internet Crime Complaint Center (IC3) or the local FBI field office. Elsewhere, use the national cyber security authority. The reporting list gathers these documents.
Fair treatment
Screening must rest on verifiable conduct and documents, never on nationality, ethnicity, name, accent or appearance. Many red flags are common among genuine hires.
If you are listed on this site
Why a real person’s details can appear
The operators use stolen and borrowed names, documents, photographs and accounts, so your details can appear without any involvement on your part.
What an entry does and does not say
An indicator entry says only that a cited source reported the value in connection with DPRK activity. See the disclaimer.
How to ask for a correction or removal
Use the submission email. A request that should not be public can be sent to chollimahunter@gmail.com. Include:
- the address of the page and the identifier as it appears there;
- what is wrong, such as a stolen identity or a value the source did not print;
- a link to a public record that supports the correction, if one exists.
Do not send identity documents; email is not a secure channel.
What happens to a request
A person reads every request. An entry its cited source does not support is corrected or withdrawn. Copies already taken, including search engine caches, are outside the site’s control.
Where an entry rests on an indictment, sanctions designation or wanted notice, contest the record with the issuing authority; the site corrects only its own misstatements.