oleksandrshkabura811@gmail.com

oleksandrshkabura811@gmail.com is an email address that one published source reports in connection with IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from Chollima Hunter. The report is dated 2026-10-03.

The reporting files it under the persona webgently, alongside 2 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.

email address IT Worker Fraud CURATED

First seen 2026-10-03 · last seen 2026-10-03

Source

  • Read on 3 October 2026, after the site's operator flagged the account. The GitHub account webgently (id 105727142) was created on 17 May 2022, displays the name Legend Dev, states gently039@gmail.com as its public address, and on the day it was read had 312 followers, 23 followed and 29 repositories: casino games (diamonds, mines, plinko, limbo), an arbitrage bot, an NFT marketplace, ChatGPT applications, and a run of Laravel and Vue repositories named as hiring challenges. Its own repositories carry about 500 commits, from November 2022 to August 2024, authored webgently <oleksandrshkabura811@gmail.com>, and from October 2023 commits under gently039@gmail.com. The value that ties it to this index is in someone else's repository. newstable/chatgpt-4-web, created on 4 May 2023 on the GitHub account newstable, which this site already holds from the DPRK IT-worker list in tayvano's lazarus-bluenoroff-research and from Chollima Group's Moonstone Sleet write-up, carries fifteen commits authored webgently <oleksandrshkabura811@gmail.com> between 11 and 16 May 2023, interleaved with commits authored Anime1026 <sasuke031026@gmail.com>, an address on the same published list. That is the same author name and the same address webgently uses in its own repositories, working in a listed account's repository beside a listed address over the same week, which is why the account is filed here rather than queued as a lead. Only the account's own addresses are carried. Recorded but not carried: commits in three 2022 challenge repositories are authored galaxy-comet, one of them through a GitHub noreply address carrying webgently's own account id, which suggests galaxy-comet was an earlier login of this account; the address oleksandrshkabura811@gmail.com also appears in mirrors on the account Zhao39 and in several trading-bot and NFT-minting repositories under other owners; casino repositories carry commits by the account timewn1, created four hours before webgently on the same day; and one 2026 commit is authored webgently from an address at looter.ai that also appears on another account under other names. None of those is this account's own value, so none is filed.
    github.com/newstable/chatgpt-4-web — Chollima Hunter · under “webgently” · pulled 2026-10-03

Find this indicator in the index, or see every email address this site holds under Email addresses in the browse listing.

Related indicators

Same persona record: webgently

Other identifiers the reporting files under the same persona.

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. See the sourcing methodology.