lucaslee129
lucaslee129 is a username
that one published source reports
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Chollima Hunter.
The report is dated 2026-09-20.
username IT Worker Fraud CURATED
Source
-
A GitHub noreply address is minted from the account's immutable numeric id, in the form id+handle@users.noreply.github.com, and the handle in it is whatever the account was called when the commit was made. Walking the commit history of the accounts this index already holds therefore recovers their previous names as a matter of record rather than as an inference: the same numeric id under two handles is one account, and GitHub's own API resolves an id to whatever that account is called today. Thirty-two of the walked accounts turned out to have been renamed at least once, yielding 51 former handles. Every one of the thirty-two numeric ids resolves to an account this index already holds, so nothing here names a new account; what it adds is the earlier names, which is what a search of older reporting would turn up. The mapping, current name first: accompany1205 was prince2115, graeme2115; admin-0123 was nicolas-95, achiever0123; AMagicHarry was besthonestman; apollo0102 was peterjiro; attractiveDev was phoenix10221004; bitcrusher1023 was shinystar-0314; blockbusterdev was devtwinkler, softvoyager, talenteddev36428; CleverSofter was miss0702; codomposer was gitakileus; coinyx was cryptobunny0x, techtrust0x0, trust023, techtruth1; cryptostar7 was lucaslee129, harbon486; DreamHigh0806 was ssguardheaker; dtorres314 was trustme000777, whimsyrover; eros1006 was dedicatedsoftwaredev, fredericrowe; erosyj was xfika, greengarden510; euri21 was solution888; h918m was topdev707; icetrust0212 was trust0212, sergey0142; jusdy was dylandev125, pauleta0126; kstar0102 was wangjin0102; prodev90 was prodev1991715; resplegend was trust0212-fantohm; smartgeek1003 was olderdev523, olderdev1003; SoftwarePassioner was care823; starmastar1126 was ministar1126; Stenor5 was luckydev0515, stenor0515; Talented0Dev was createnewhistory; Talentedtopcoder was topcoderben, benjaminstewart123; top-dev-999 was vitaliy-egorov; wenMoonx was yucob; whisdev was ptcbink, ptc-bink, sakele1026. Seven of these former handles are already published in this index as separate github_profile indicators, recorded before the rename was known: trust0212, trust0212-fantohm, dylandev125, xfika, greengarden510, gitakileus and olderdev523. All seven now return 404, and all seven are the same accounts as icetrust0212, resplegend, jusdy, erosyj, erosyj, codomposer and smartgeek1003 respectively, which this index also holds. They are kept rather than removed, because a dead handle is still the right thing to find in a report written while it was live, but a reader should not count them as separate accounts. These are recorded as usernames rather than as profile URLs on purpose. 49 of the 51 are unregistered today, and an unregistered handle can be taken by anyone, at which point a published URL would point at a stranger. That is not hypothetical here: yamamotojiro, formerly DreamHigh0806, and fancydeveloper, formerly BitFancy, have both been re-registered by unrelated accounts under different numeric ids. Neither is published as a value in this entry for that reason, and neither should be treated as an indicator of anything. Read on 20 September 2026 by resolving every numeric id found in the noreply addresses captured by the commit walk of 19 September. No persona is attached: these are earlier names for accounts already filed, and recovering a name supplies no attribution the index did not already have.
github.com/AMagicHarry — Chollima Hunter
Find this indicator in the index, or see every username this site holds under Usernames in the browse listing.