`https://github.com/bestselection18`

https://github.com/bestselection18 is a GitHub account that 2 published sources report in connection with IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from ketman.org. The earliest of those reports is dated 2025-04-16 and the most recent 2025-06-24.

github profile IT Worker Fraud MATCHED IN SOURCE recycled checked 2026-09-01

Listed as bestselection18

First seen 2025-04-16 · last seen 2025-06-24

recycled checked 2026-09-01

This login no longer resolves to the reported account. The present holder was created on 2025-05-13, after the identifier was first published on 2025-04-16, so it is unconnected to this indicator.

Sources

Nearby text:

…https://github.com/V0410 https://github.com/ImfanAi https://github.com/aidenwong812 https://github.com/brightlystar0117 https://github.com/bestselection18 https://github.com/codepert https://github.com/cryptogru812 https://github.com/deeplus2021 https://github.com/hi-tech-AI…
DPRK IT Workers in Open Source and Freelance Platforms - Ketman - Threat intelligence for remote and open source organizations — ketman.org · under “GitHub Profiles” · published 2025-04-16 · pulled 2026-08-30
…connected to multiple accounts under surveillance for suspected links to DPRK IT operations . Among them was: bestselection18 : https://github.com/bestselection18 — previously reported for anomalous activities in GitHub organizations and DAOs . 4.…
Understanding DPRK IT Worker Activity - Conversations and Insights - Ketman - Threat intelligence for remote and open source organizations — ketman.org · under “3. Profile Engagement” · published 2025-06-24 · pulled 2026-08-30

Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.

Account analysis

Account created	2025-05-13
Repositories	1 original, 0 forked
History older than the account	0 repositories
Commits copied into others' repositories	0
Commit identities	0 addresses, 0 names

From gh-fake-analyzer 1.0.2, the Ketman Project's GitHub analysis tool, run on 2026-10-27. These are signals: backdated history and several commit identities are common among ordinary developers too, and an account that shows none of them is not thereby cleared.

Related indicators

Cited by the same report: DPRK IT Workers in Open Source and Freelance Platforms - Ketman - Threat intelligence for remote and open source organizations

ketman.org lists 39 other indicators in this source. 7 are shown, chosen across types.

All 40 indicators from this source

Cited by the same report: Understanding DPRK IT Worker Activity - Conversations and Insights - Ketman - Threat intelligence for remote and open source organizations

ketman.org lists 14 other indicators in this source. 5 are shown, chosen across types.

All 15 indicators from this source