shinyhenryhan@gmail.com

shinyhenryhan@gmail.com is an email address that one published source reports in connection with IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from Chollima Hunter. The report is dated 2026-09-20.

email address IT Worker Fraud CURATED

First seen 2026-09-20 · last seen 2026-09-20

Source

  • Read on 20 September 2026 by walking the commit history of every repository on github.com/mastercodercat, which this index already holds under the heading "Further GitHub accounts named in the open Google Drive thread". Tallying the author line on every commit recovers the address the holder configured their git client with, which an account never has to state anywhere. smartgeek.taylor@gmail.com authored 94 commits on mastercodercat, commits as "mastercodercat"; shinyhenryhan@gmail.com authored 15 commits on mastercodercat, commits as "mastercodercat"; shanelewix@gmail.com authored 9 commits on mastercodercat, commits as "mastercodercat"; mastercoderoy1007@gmail.com authored 9 commits on mastercodercat, commits as "mastercodercat"; bytebloomweb@outlook.com authored 2 commits on mastercodercat, commits as "mastercodercat". Each is admitted because it commits under a name the account itself uses, the test that separates the holder's own address from the original author of a repository copied in. No persona is attached, because the accounts these were read from carry none: the reporting grouped them without naming an operator, and recovering an address does not supply the name it declined to give.
    github.com/mastercodercat — Chollima Hunter · under “Addresses recovered from the commit history of the accounts filed under "Further GitHub accounts named in the open Google Drive thread"” · pulled 2026-09-20

Find this indicator in the index, or see every email address this site holds under Email addresses in the browse listing.

Related indicators

Cited by the same report: github.com/mastercodercat

Chollima Hunter lists 4 other indicators in this source.

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. See the sourcing methodology.