157616488+devsworld36428@users.noreply.github.com
157616488+devsworld36428@users.noreply.github.com is an email address
that one published source reports
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Chollima Hunter.
The report is dated 2026-09-20.
email address IT Worker Fraud CURATED
Source
-
github.com/SrDev36428 is GitHub account id 157616488 and was previously named DevsWorld36428; the old handle now returns 404. The account commits under both 157616488+SrDev36428@users.noreply.github.com and 157616488+DevsWorld36428@users.noreply.github.com, and GitHub mints those addresses from the account's immutable numeric id, so the two names are the same account as a matter of how the address is constructed rather than as an inference. That noreply address already appears in the commit history of two accounts this index holds under "Saja network portfolio accounts (Nisos)": three commits on eros1006 and one on TopRatedDev36428, both under the display name Beautiful Devsworld. A third account in the same group, blockbusterdev, carries 544 commits from beautifuldevsworld@gmail.com under the names softvoyager, DenysOstroverkh and TalentedDev36428, and TopRatedDev36428 carries the same address under the name DevsWorld36428. The addresses are admitted as one holder's because they commit under names the group's own accounts use, including two carrying its 36428 suffix. The account was created on 24 January 2024, four weeks after TopRatedDev36428, whose numeric handle suffix it repeats exactly, and it follows eight accounts this index holds: eros1006, TopRatedDev36428, GoodWork0903, Talented0Dev, nulidev, CleverSofter, SoftwarePassioner and blockbusterdev. Seven of those are in this group. The limit is worth stating plainly. The direct evidence from account 157616488 into the group's repositories is four commits, which is not much on its own. The weight here is cumulative rather than from any single value: the rename recovered from the numeric id, the shared handle suffix, the creation date four weeks apart, the eight follow edges and the address reuse across three of the group's accounts. A reader who wants to discount it should discount it on that basis. The account was live when read on 20 September 2026, and no persona is attached because the group it joins carries none.
github.com/SrDev36428 — Chollima Hunter
Find this indicator in the index, or see every email address this site holds under Email addresses in the browse listing.