wangtiendev@gmail.com
wangtiendev@gmail.com is an email address
that one published source reports
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from ZachXBT (@zachxbt).
The report is dated 2026-04-08.
The reporting files it under the persona Rascal, alongside 1 other identifier attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.
email address IT Worker Fraud RESEARCHER POST
Source
-
Rascal is not a public persona but the display name of one account on luckyguys.site, the internal North Korean remittance platform whose data the researcher obtained; the entry exists because that display name and the address below are facts about an account rather than a claim about a person. The thread shows the account's private messages with the server administrator PC-1234, running from December 2025 to April 2026 and covering payment transfers and the use of fraudulent identities, and in one of them the account writes "This is Mexc account details" and gives this address. What it sends in the same line -- the credential and the recovery string for that exchange account -- is deliberately not recorded here or anywhere else in this repository. Another screenshot in the thread shows the account submitting a photograph of an Irish passport cover to the administrator to pass an identity check; no name on it is legible.
x.com/zachxbt/status/2041873521601868112 — ZachXBT (@zachxbt)
Find this indicator in the index, or see every email address this site holds under Email addresses in the browse listing.