Chollima Hunter

← Remote Workers

https://github.com/dolphinstar0202

https://github.com/dolphinstar0202 is a GitHub account that 2 published sources report in connection with IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from Chollima Hunter. The earliest of those reports is dated 2025-08-19 and the most recent 2026-09-28.

github profile IT Worker Fraud CURATED live checked 2026-09-30

First seen 2025-08-19 · last seen 2026-09-28

Sources

  • Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from The Raven File's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. alexjoe118 holds debrajoycel8323@gmail.com (100); demi-guy holds demi4987@skiff.com (6); devbeast0121 holds devbeast3800@gmail.com (100); Johann-0213 holds devcomposer0213@gmail.com (28); Topdeveloper0322 holds devgroup006@gmail.com (41); AI-Julia holds devguru13580@gmail.com (48); qvantax holds devmania1223@gmail.com (100); socool728 holds devope08@gmail.com (15); devscottmiller-lang holds devscottmiller@gmail.com (75); devsuperstar121 holds devsuperstar121@gmail.com (15); Dev0109 holds devtop0109@gmail.com (100); CheongRui holds devtop617@gmail.com (30); topstar920707 holds dlee59664@gmail.com (100); LuckyTycoon holds dp2genius@gmail.com (1); hiddenmyth holds dragon99steel@gmail.com (100); kevin-sse holds dragonknight0522@gmail.com (100); dragon927 holds dragonsea145@gmail.com (1); CodeWizard928 holds dragontiger928@gmail.com (9); SEV-96 holds dreamconsolestar@gmail.com (42); dreamhigh9990 holds dreamhigh9990@gmail.com (100); bitcookr holds dreamhighpassionhigh@gmail.com (35); DreamWorker777 holds dreamworktalent@gmail.com (51); CodeMonkey0301 holds dt1527699@gmail.com (2); duartejose0202 holds duartejose020202@gmail.com (1); eureka000306 holds edureka000306@outlook.com (35); Demon991108 holds edwardschwartz1108@gmail.com (23); dolphinstar0202 holds eliasforsberger@gmail.com (100); Gitplayboy holds elijahrobersone@gmail.com (11); enjoyandlove holds enjoyandlovecoding@gmail.com (65); erosgod1118 holds erosgod19921118@gmail.com (100); bluesky0209 holds feature0209@gmail.com (43); senior-dev-1019 holds fightingmonkey1@gmail.com (3); cl0ver012 holds finleybeech10@gmail.com (3); flybear5500 holds flybear5500@gmail.com (100); ct2187 holds for2187test@gmail.com (2); Phantomlancer123 holds fronzen615heart@gmail.com (22); neverVector holds fulldev0526@gmail.com (69); FuriousComet holds furiouscomet729@gmail.com (39); dagger367 holds gholmeih@gmail.com (1); Dr-GlassesPIG holds glassespiger@gmail.com (6); godDev0331 holds god880331@skiff.com (100); golddev53 holds golddev53@gmail.com (1); goldnite holds goldendevens@gmail.com (89); GoldenDragon0710 holds goldendragon0710@gmail.com (40); KingStar1001 holds goldlion0819@gmail.com (74); shinobi8894 holds goldstardev2002@gmail.com (83); GreatHub1204 holds grahasmin@gmail.com (100); Wuffle1125 holds handsomeprince1125@gmail.com (100); SuperDev0417 holds happinessman0417@gmail.com (27); kaerur holds happyday03518@gmail.com (9); happy7525 holds happydeveloper0816@gmail.com (2); onlinedev-601 holds happysuperevil601@gmail.com (100); harrychendev holds harrychendev226@gmail.com (23); light3b holds harrydev0724@gmail.com (100); kingstar1115 holds hatoyama1115@gmail.com (100); harrialeksi holds hawkpeter0324@gmail.com (100); peace00000 holds heidikalatasra20@gmail.com (100); cupidbow20000 holds helemonar2023@gmail.com (10); Henry-Baldovino holds henrybaldovino81@gmail.com (4); smartdev1102 holds hfish7789@gmail.com (50); DevMaster37 holds hidev237@gmail.com (100); happy-teddy holds hidev537@gmail.com (63); mlhiq holds hiqdevlord@gmail.com (100); SunlightLuck holds hope4wd88@gmail.com (100); dirtymalikjin9k holds hopemalik0512@gmail.com (100); MilanJelesic holds hubamykytafree@gmail.com (100); fantasticoder850 holds hy99aa@gmail.com (8); InfiniteAengus holds infiniteaengus@gmail.com (100); uchiha5555 holds innocentdev0512@gmail.com (100); AboveAndBeyondSolution holds intersting987@gmail.com (100); ITsolution1014 holds itsolution1014@gmail.com (1); appleseed010622 holds ivangrigorasuk560@gmail.com (13); crazyAI427 holds jackieliu1224@gmail.com (52); choace0427 holds jacobkevin0427@gmail.com (100). Where the address came from a report, the report is https://theravenfile.com/2025/08/19/unmasking-dprk-it-workers-email-address-patterns-as-hiring-red-flags/. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.
    github.com/dolphinstar0202 — Chollima Hunter · under “GitHub accounts credited with commits from The Raven File addresses (IT Worker Fraud)” · pulled 2026-09-28
  • Found on 28 September 2026 by asking GitHub's commit search, for each of the addresses this index holds from The Raven File's reporting, which account its commits are credited to. GitHub credits a commit to the account that has registered the author address, so each account below owns the address shown; the count is the commits credited in the search's first page. alexjoe118 holds debrajoycel8323@gmail.com (100); demi-guy holds demi4987@skiff.com (6); devbeast0121 holds devbeast3800@gmail.com (100); Johann-0213 holds devcomposer0213@gmail.com (28); Topdeveloper0322 holds devgroup006@gmail.com (41); AI-Julia holds devguru13580@gmail.com (48); qvantax holds devmania1223@gmail.com (100); socool728 holds devope08@gmail.com (15); devscottmiller-lang holds devscottmiller@gmail.com (75); devsuperstar121 holds devsuperstar121@gmail.com (15); Dev0109 holds devtop0109@gmail.com (100); CheongRui holds devtop617@gmail.com (30); topstar920707 holds dlee59664@gmail.com (100); LuckyTycoon holds dp2genius@gmail.com (1); hiddenmyth holds dragon99steel@gmail.com (100); kevin-sse holds dragonknight0522@gmail.com (100); dragon927 holds dragonsea145@gmail.com (1); CodeWizard928 holds dragontiger928@gmail.com (9); SEV-96 holds dreamconsolestar@gmail.com (42); dreamhigh9990 holds dreamhigh9990@gmail.com (100); bitcookr holds dreamhighpassionhigh@gmail.com (35); DreamWorker777 holds dreamworktalent@gmail.com (51); CodeMonkey0301 holds dt1527699@gmail.com (2); duartejose0202 holds duartejose020202@gmail.com (1); eureka000306 holds edureka000306@outlook.com (35); Demon991108 holds edwardschwartz1108@gmail.com (23); dolphinstar0202 holds eliasforsberger@gmail.com (100); Gitplayboy holds elijahrobersone@gmail.com (11); enjoyandlove holds enjoyandlovecoding@gmail.com (65); erosgod1118 holds erosgod19921118@gmail.com (100); bluesky0209 holds feature0209@gmail.com (43); senior-dev-1019 holds fightingmonkey1@gmail.com (3); cl0ver012 holds finleybeech10@gmail.com (3); flybear5500 holds flybear5500@gmail.com (100); ct2187 holds for2187test@gmail.com (2); Phantomlancer123 holds fronzen615heart@gmail.com (22); neverVector holds fulldev0526@gmail.com (69); FuriousComet holds furiouscomet729@gmail.com (39); dagger367 holds gholmeih@gmail.com (1); Dr-GlassesPIG holds glassespiger@gmail.com (6); godDev0331 holds god880331@skiff.com (100); golddev53 holds golddev53@gmail.com (1); goldnite holds goldendevens@gmail.com (89); GoldenDragon0710 holds goldendragon0710@gmail.com (40); KingStar1001 holds goldlion0819@gmail.com (74); shinobi8894 holds goldstardev2002@gmail.com (83); GreatHub1204 holds grahasmin@gmail.com (100); Wuffle1125 holds handsomeprince1125@gmail.com (100); SuperDev0417 holds happinessman0417@gmail.com (27); kaerur holds happyday03518@gmail.com (9); happy7525 holds happydeveloper0816@gmail.com (2); onlinedev-601 holds happysuperevil601@gmail.com (100); harrychendev holds harrychendev226@gmail.com (23); light3b holds harrydev0724@gmail.com (100); kingstar1115 holds hatoyama1115@gmail.com (100); harrialeksi holds hawkpeter0324@gmail.com (100); peace00000 holds heidikalatasra20@gmail.com (100); cupidbow20000 holds helemonar2023@gmail.com (10); Henry-Baldovino holds henrybaldovino81@gmail.com (4); smartdev1102 holds hfish7789@gmail.com (50); DevMaster37 holds hidev237@gmail.com (100); happy-teddy holds hidev537@gmail.com (63); mlhiq holds hiqdevlord@gmail.com (100); SunlightLuck holds hope4wd88@gmail.com (100); dirtymalikjin9k holds hopemalik0512@gmail.com (100); MilanJelesic holds hubamykytafree@gmail.com (100); fantasticoder850 holds hy99aa@gmail.com (8); InfiniteAengus holds infiniteaengus@gmail.com (100); uchiha5555 holds innocentdev0512@gmail.com (100); AboveAndBeyondSolution holds intersting987@gmail.com (100); ITsolution1014 holds itsolution1014@gmail.com (1); appleseed010622 holds ivangrigorasuk560@gmail.com (13); crazyAI427 holds jackieliu1224@gmail.com (52); choace0427 holds jacobkevin0427@gmail.com (100). Where the address came from a report, the report is https://theravenfile.com/2025/08/19/unmasking-dprk-it-workers-email-address-patterns-as-hiring-red-flags/. An account was left out where the address may belong to a real person rather than the operator: a stolen-CV listing, a mirrored contributor's identity, a copied repository's upstream author, or an account with a long, verifiable history of its own.
    theravenfile.com/2025/08/19/unmasking-dprk-it-workers-email-address-patterns-as-hiring-red-flags/ — Chollima Hunter · under “GitHub accounts credited with commits from The Raven File addresses (IT Worker Fraud)” · published 2025-08-19 · pulled 2026-09-28

Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.

Account analysis

Account created2023-12-06
Repositories4 original, 0 forked
History older than the account1 repository: create-solana-dapp (first commit 2022-05-05)
Commits copied into others' repositories0
Commit identities1 address, 2 names
Name then four digitsdolphinstar0202

Commit addresses this index holds

From gh-fake-analyzer 1.0.2, the Ketman Project's GitHub analysis tool, run on 2026-11-09. These are signals: backdated history and several commit identities are common among ordinary developers too, and an account that shows none of them is not thereby cleared.

Related indicators

Cited by the same report: theravenfile.com/2025/08/19/unmasking-dprk-it-workers-email-address-patterns-as-hiring-red-flags/

Chollima Hunter lists 1,741 other indicators in this source. 12 are shown, chosen across types.

All 1,742 indicators from this source

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. See the sourcing methodology.