kanbei0605@gmail.com
kanbei0605@gmail.com is an email address
that 3 published sources report
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Nisos, Chollima Hunter and The Raven File.
The earliest of those reports is dated 2025-03-27 and the most recent 2026-09-24.
The reporting files it under the persona Karl Chong, alongside 11 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.
email address IT Worker Fraud CURATED
Sources
-
Nisos names this persona as one a likely DPRK IT worker used to obtain remote work in the United States, and publishes it beside three others it ties to the same contact details. The GitHub account superredstar, the address kanbei0605@gmail.com and the four freelance-platform profiles are in the report's text; the GitHub accounts kanbei0605 and code-0605 and the Telegram handle kanbei0605 are read from its network map, which draws them as direct connections to this persona. The report states that superredstar built the persona's resume website in April 2022, that the persona claims to be from Singapore and to have worked remotely for Mongrov Inc since May 2023, that its freelancer profiles place it in the United States and Turkey, that its resumes list Overflow as an employer and the Singapore University of Technology and Design as its school, and that its employment history matches that of a separate persona, Naoyuki Tanaka, which Nisos links to Enver Studio. Nisos also reports that the persona's photograph is a stock image sold on several stock-photography sites.
nisos.com/research/dprk-it-worker-scam-mitigation/ — Nisos -
Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it. github.com/kanbei65 is account id 91700749, created on 30 September 2021. 79 of its 100 own commits are signed kanbei0605@gmail.com and the other 21 with a noreply address under the handle kanbei0605, so this account was once named kanbei0605. Nisos names github.com/kanbei0605 under Karl Chong. That handle now belongs to a different account, id 116683582, created on 25 October 2022, which is not this one; which of the two Nisos read cannot be settled from the handle, but the address kanbei0605@gmail.com, which the same reporting gives for the persona, signs this account's commits.
github.com/kanbei65 — Chollima Hunter -
…n6793@gmail.com kagehiro0923@gmail.com kaitadashi114@gmail.com kakashie1004@gmail.com kalei.dillan@minofangle.org kanazawa1123ryo@gmail.com kanbei0605@gmail.com kanta.ahren@minofangle.org kari.service.1217@gmail.com katarzynaplocka34@gmail.com kato.chojiro@gmail.com kaylob.omega@minofangle.org kazuh…
Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File -
…The account is associated with the email address kanbei0605@gmail.com, which is also associated with the persona Karl Chong. Graphic 1: Network map of likely DPRK-affiliated…
DPRK IT Worker Scam: Mitigation Steps for Hiring Teams — Nisos
Find this indicator in the index, or see every email address this site holds under Email addresses in the browse listing.
Related indicators
Same persona record: Karl Chong
Cited by the same report: nisos.com/research/dprk-it-worker-scam-mitigation/
All 14 indicators from this source