Chollima Hunter

← Remote Workers

https://github.com/bigmoon202

https://github.com/bigmoon202 is a GitHub account that 2 published sources report in connection with IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from Chollima Hunter. The earliest of those reports is dated 2025-08-19 and the most recent 2026-09-28.

github profile IT Worker Fraud CURATED live checked 2026-09-30

First seen 2025-08-19 · last seen 2026-09-28

Sources

  • Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from The Raven File's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. 10terabyte holds 0supportx@gmail.com (100); devveteran holds aaroller669@gmail.com (57); cryptoveteran105 holds abirsadesta2021@gmail.com (100); acehood0126 holds acehood010126@gmail.com (100); Aceruling holds aceruling@gmail.com (100); ahura0901 holds ahura0901@gmail.com (3); Icarocom holds akimotoakira00124@gmail.com (23); dev2187 holds albert0703lin@gmail.com (10); EugeneAtHigh holds alchemist0803@mail.ru (92); AI1120 holds alinwilson1120@gmail.com (41); AlphaDev0101 holds alphadev0101@gmail.com (14); smartiguy07 holds ameslexander@gmail.com (100); AngelEyeDev holds angeleyes20525@gmail.com (22); angrybbomb holds angrybbomb@gmail.com (12); apollo-hero holds apollon71star@gmail.com (21); core116 holds applekevin10141106@gmail.com (6); artemsyvko holds artemsyvko71@gmail.com (71); maanav1647 holds asanohrsh@gmail.com (51); ADev999 holds ashleyssharper@gmail.com (7); astronicky holds astronickypower@gmail.com (38); Topdev512 holds atlassmith95@gmail.com (21); LamSiuMing holds audreybass140@gmail.com (100); devphoenix0409 holds bandwwith@gmail.com (55); BtcCaleb holds bbba00475@gmail.com (100); elite1002 holds bergeron1002@gmail.com (8); blacksaru holds bestlucky1030@gmail.com (100); BIGMOON202 holds bigmoon202@gmail.com (65); blackhoward holds blackhoward0417@gmail.com (100); pandablue0809 holds bluep0415@gmail.com (100); alpha007-dev holds bluesky02050@gmail.com (100); tingyangdevs20 holds brankovical98@gmail.com (100); pongzu313 holds breadheaddev313@gmail.com (100); WorldWideDevelop holds bridleland@gmail.com (100); akatsukione holds calvin168943@gmail.com (100); seniordeveloper101910 holds caoimhe397@gmail.com (6); compilex1 holds chaojin752@gmail.com (94); rampasa holds chidotechdev@gmail.com (15); cleverdev727 holds cleverdev727@gmail.com (100); mikyoch holds cocodev0113@gmail.com (78); nightowl0804 holds codegenerator1994@gmail.com (100); theSpaceVision holds codewaterhole@gmail.com (3); codemaster0011 holds codingmaster316@gmail.com (4); johntopdev0011 holds comantivirus250@gmail.com (100); Comma0517 holds comma0517@gmail.com (3); chibang1987 holds confidencegabriel87913@gmail.com (6); Ambitioner333 holds coryitpro@gmail.com (28); CovidHunter holds covidhunter036@gmail.com (100); pyguru-dev holds crazybrainy333@skiff.com (100); cactusming holds creative19970518@gmail.com (100); creativebull holds creativebull0103@gmail.com (100); Ronnydev7 holds cristianorodriguez779@gmail.com (100); dancerking holds dancerking306@gmail.com (100); apollo-man holds daneiljhon7@gmail.com (3); darkhorse03111 holds darkhorse03111@gmail.com (100); darkhorse07232020 holds darkhorse0723@gmail.com (46); DarkHorse0725 holds darktop0112@gmail.com (100); David-Kup holds davidkup276@gmail.com (4). Where the address came from a report, the report is https://theravenfile.com/2025/08/19/unmasking-dprk-it-workers-email-address-patterns-as-hiring-red-flags/. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.
    github.com/BIGMOON202 — Chollima Hunter · under “GitHub accounts credited with commits from The Raven File addresses (IT Worker Fraud)” · pulled 2026-09-28
  • Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from The Raven File's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. 10terabyte holds 0supportx@gmail.com (100); devveteran holds aaroller669@gmail.com (57); cryptoveteran105 holds abirsadesta2021@gmail.com (100); acehood0126 holds acehood010126@gmail.com (100); Aceruling holds aceruling@gmail.com (100); ahura0901 holds ahura0901@gmail.com (3); Icarocom holds akimotoakira00124@gmail.com (23); dev2187 holds albert0703lin@gmail.com (10); EugeneAtHigh holds alchemist0803@mail.ru (92); AI1120 holds alinwilson1120@gmail.com (41); AlphaDev0101 holds alphadev0101@gmail.com (14); smartiguy07 holds ameslexander@gmail.com (100); AngelEyeDev holds angeleyes20525@gmail.com (22); angrybbomb holds angrybbomb@gmail.com (12); apollo-hero holds apollon71star@gmail.com (21); core116 holds applekevin10141106@gmail.com (6); artemsyvko holds artemsyvko71@gmail.com (71); maanav1647 holds asanohrsh@gmail.com (51); ADev999 holds ashleyssharper@gmail.com (7); astronicky holds astronickypower@gmail.com (38); Topdev512 holds atlassmith95@gmail.com (21); LamSiuMing holds audreybass140@gmail.com (100); devphoenix0409 holds bandwwith@gmail.com (55); BtcCaleb holds bbba00475@gmail.com (100); elite1002 holds bergeron1002@gmail.com (8); blacksaru holds bestlucky1030@gmail.com (100); BIGMOON202 holds bigmoon202@gmail.com (65); blackhoward holds blackhoward0417@gmail.com (100); pandablue0809 holds bluep0415@gmail.com (100); alpha007-dev holds bluesky02050@gmail.com (100); tingyangdevs20 holds brankovical98@gmail.com (100); pongzu313 holds breadheaddev313@gmail.com (100); WorldWideDevelop holds bridleland@gmail.com (100); akatsukione holds calvin168943@gmail.com (100); seniordeveloper101910 holds caoimhe397@gmail.com (6); compilex1 holds chaojin752@gmail.com (94); rampasa holds chidotechdev@gmail.com (15); cleverdev727 holds cleverdev727@gmail.com (100); mikyoch holds cocodev0113@gmail.com (78); nightowl0804 holds codegenerator1994@gmail.com (100); theSpaceVision holds codewaterhole@gmail.com (3); codemaster0011 holds codingmaster316@gmail.com (4); johntopdev0011 holds comantivirus250@gmail.com (100); Comma0517 holds comma0517@gmail.com (3); chibang1987 holds confidencegabriel87913@gmail.com (6); Ambitioner333 holds coryitpro@gmail.com (28); CovidHunter holds covidhunter036@gmail.com (100); pyguru-dev holds crazybrainy333@skiff.com (100); cactusming holds creative19970518@gmail.com (100); creativebull holds creativebull0103@gmail.com (100); Ronnydev7 holds cristianorodriguez779@gmail.com (100); dancerking holds dancerking306@gmail.com (100); apollo-man holds daneiljhon7@gmail.com (3); darkhorse03111 holds darkhorse03111@gmail.com (100); darkhorse07232020 holds darkhorse0723@gmail.com (46); DarkHorse0725 holds darktop0112@gmail.com (100); David-Kup holds davidkup276@gmail.com (4). Where the address came from a report, the report is https://theravenfile.com/2025/08/19/unmasking-dprk-it-workers-email-address-patterns-as-hiring-red-flags/. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.
    theravenfile.com/2025/08/19/unmasking-dprk-it-workers-email-address-patterns-as-hiring-red-flags/ — Chollima Hunter · under “GitHub accounts credited with commits from The Raven File addresses (IT Worker Fraud)” · published 2025-08-19 · pulled 2026-09-28

Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.

Account analysis

Account created2023-07-01
Repositories18 original, 0 forked
History older than the account0 repositories
Commits copied into others' repositories0
Commit identities1 address, 4 names; up to 4 names on one address; up to 2 addresses under one name

Commit addresses this index holds

From gh-fake-analyzer 1.0.2, the Ketman Project's GitHub analysis tool, run on 2026-10-28. These are signals: backdated history and several commit identities are common among ordinary developers too, and an account that shows none of them is not thereby cleared.

Related indicators

Cited by the same report: theravenfile.com/2025/08/19/unmasking-dprk-it-workers-email-address-patterns-as-hiring-red-flags/

Chollima Hunter lists 1,741 other indicators in this source. 12 are shown, chosen across types.

All 1,742 indicators from this source

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. See the sourcing methodology.