upworkchris0@outlook.com
upworkchris0@outlook.com is an email address
that one published source reports
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Chollima Hunter.
The report is dated 2026-09-20.
email address IT Worker Fraud CURATED
Source
-
Read on 20 September 2026 by searching GitHub for accounts whose display-name field carries a name this index already holds, and then walking the account’s commit history. The account coindev219 was registered on 25 January 2024, displays the name Alexander Simmons, holds fifty-eight public repositories and none of them forks, has two followers and follows nobody, and states a bio offering "10 years of experience" as a full-stack and blockchain developer. Two links reach this entry and they are not of equal weight, so the entry says which is which. The weaker one is the display name, which is the only thing tying this account to the name at the head of this page; a name in that field is a name an account presents and nothing more, and the account’s own commits are signed coindev219 <upworkchris0@outlook.com>, a different given name from the one it displays. The stronger one is a value. Ten commits in these repositories are authored Kryptify <xinzhe1219@outlook.com>, and both that login and that address are already held in this index on the account github.com/Kryptify; eight more are authored Air128731 <henry.scott0x8080@gmail.com>, and github.com/Air128731 is held here as well. A commit address inside a repository is a value rather than a shared handle, which is what makes it worth recording, and it establishes that whoever held those addresses wrote those commits rather than that one person holds all three accounts. Two further logins commit here, FullStackDev0331 under kaimarsh057@gmail.com and Lai-Star under tsangyu.lai0920@gmail.com. Neither is recorded, because a repository copied in rather than written carries its original authors’ addresses and nothing here separates those two from that case. This account was left in the candidate queue on 18 September for exactly that ambiguity; the name search is what resolved which of its commit addresses belong to accounts this site already tracks. Filed on its own rather than under the Alexander Simmons persona: that name is the one printed on a pipu.cc CV (listing 4064), and a name taken from a CV can be a real person's stolen identity, so a display name matching it is not a link to the persona. The commit addresses above are what tie this account to the operators this index tracks.
github.com/coindev219 — Chollima Hunter
Find this indicator in the index, or see every email address this site holds under Email addresses in the browse listing.