4K
Also reported as: Johnathon TengDavid LepotClark PicklesKobayashi KosukeZhang XuRoman KholodHanh DaoShparuk HenadiiRobert WangArtem VOleksii Ratushniak
A fabricated professional identity used in the DPRK remote IT-worker scheme. Most of what follows is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, 4K. The attribution is theirs, not this site's.
The remainder was read by this site from the account itself and is cited to the page and date it was read.
Profiles and evidence
ZachXBT table of the team’s fabricated identities, listing the GitHub, LinkedIn and email each member used.
Directory listing the researcher attributes to the team: Payoneer receipts, wallet seed phrases, GitHub recovery codes and identity-document scans (faces redacted in the source).
LinkedIn accounts
https://www.linkedin.com/in/clark-pickles330/
removed
linkedin profile IT Worker Fraud RESEARCHER POST removed
Source
-
ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here.
x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt)
https://www.linkedin.com/in/david-lepot/
removed
linkedin profile IT Worker Fraud RESEARCHER POST removed
Source
-
ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here.
x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt)
https://www.linkedin.com/in/johnathon-h-teng018/
removed
linkedin profile IT Worker Fraud RESEARCHER POST removed
Source
-
ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here.
x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt)
https://www.linkedin.com/in/kosuke-kobayashi-6b388134b/
removed
linkedin profile IT Worker Fraud RESEARCHER POST removed
Source
-
ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here.
x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt)
https://www.linkedin.com/in/zhangxu57477/
removed
linkedin profile IT Worker Fraud RESEARCHER POST removed
Source
-
ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here.
x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt)
Identifiers reported alongside
30 indicators the sources below record for this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
Artem V |
alias | |
Clark Pickles |
alias | |
David Lepot |
alias | |
Hanh Dao |
alias | |
Johnathon Teng |
alias | |
Kobayashi Kosuke |
alias | |
Oleksii Ratushniak |
alias | |
Robert Wang |
alias | |
Roman Kholod |
alias | |
Shparuk Henadii |
alias | |
Zhang Xu |
alias | |
https://dev.to/trentist |
devto account | live |
artemyaroshenko540@gmail.com |
email address | |
ayahmad1007@gmail.com |
email address | |
belacanz@yahoo.com |
email address | |
chasegreer327@gmail.cm |
email address | |
chasegreer327@gmail.com |
email address | |
clark.pickles30@proton.me |
email address | |
dkwebigo416@gmail.com |
email address | |
hanhd7231@gmail.com |
email address | |
johnathonhtneg18@gmail.com |
email address | |
kholodroman6@gmail.com |
email address | |
leptointel213@gmail.com |
email address | |
ratushniakoleksii8@gmail.com |
email address | |
sparukgena@gmail.com |
email address | |
trent.delisle@mail.com |
email address | |
zhangxu57477@gmail.com |
email address | |
https://github.com/belacanz12 |
github profile | live |
https://github.com/romik6 |
github profile | live |
https://github.com/trentist |
github profile | live |
Artem V
alias IT Worker Fraud RESEARCHER POST
Source
-
ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here.
x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt)
Clark Pickles
alias IT Worker Fraud RESEARCHER POST
Source
-
ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here.
x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt)
David Lepot
alias IT Worker Fraud RESEARCHER POST
Source
-
ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here.
x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt)
Hanh Dao
alias IT Worker Fraud RESEARCHER POST
Source
-
ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here.
x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt)
Johnathon Teng
alias IT Worker Fraud RESEARCHER POST
Source
-
ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here.
x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt)
Kobayashi Kosuke
alias IT Worker Fraud RESEARCHER POST
Source
-
ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here.
x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt)
Oleksii Ratushniak
alias IT Worker Fraud RESEARCHER POST
Source
-
ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here.
x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt)
Robert Wang
alias IT Worker Fraud RESEARCHER POST
Source
-
ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here.
x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt)
Roman Kholod
alias IT Worker Fraud RESEARCHER POST
Source
-
ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here.
x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt)
Shparuk Henadii
alias IT Worker Fraud RESEARCHER POST
Source
-
ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here.
x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt)
Zhang Xu
alias IT Worker Fraud RESEARCHER POST
Source
-
ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here.
x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt)
https://dev.to/trentist
devto account IT Worker Fraud CURATED live
live
Source
-
Found on 13 September 2026 by probing every account handle this site already holds for this operator against dev.to, and read from the profile's own public API. An account exists under trentist, a login the index already carries for this persona on another platform. It gives a joined date of Sep 10, 2026. It displays "Jonathan", a display name rather than a person's name. The profile links a GitHub account, Trentist. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
dev.to/trentist — Chollima Hunter
artemyaroshenko540@gmail.com
email address IT Worker Fraud MATCHED IN SOURCE
Sources
-
ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here.
x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt) -
…m leptointel213@gmail.com clark.pickles30@proton.me dkwebigo416@gmail.com zhangxu57477@gmail.com kholodroman6@gmail.com hanhd7231@gmail.com artemyaroshenko540@gmail.com ratushniakoleksii8@gmail.com sparukgena@gmail.com joshuagosney.dev.web@gmail.com hungpham.web3@gmail.com mak.martynenko22@gmail.com mark.de…
Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File
ayahmad1007@gmail.com
email address IT Worker Fraud CURATED
Source
-
Read on 20 September 2026 by walking the commit history of every repository on the GitHub accounts github.com/trentist and github.com/Belacanz12, already held under this persona, and tallying the author line on every commit. A commit's author line is what the holder configured their git client with rather than anything the profile page chooses to display, so it recovers addresses the account never states. The addresses recorded here were not already in this index: chasegreer327@gmail.com authored 781 commits across 10 of its repositories, commits as "Trentist"; belacanz@yahoo.com authored 184 commits across 3 of its repositories, commits as "Belacanz12"; chasegreer327@gmail.cm authored 4 commits across the repository trentist/crypto-blog, commits as "Trentist"; trent.delisle@mail.com authored 3 commits across the repository trentist/CatlistaBot, commits as "Trentist"; ayahmad1007@gmail.com authored 1 commit across the repository Belacanz12/belacanz12, commits as "Belacanz12". Each is admitted because it commits under a name the account itself uses, which is the test that separates the holder's own address from the original author of a repository copied in. Addresses belonging to unrelated developers whose work appears in these repositories are deliberately not recorded, and an address is evidence that whoever held it wrote those commits rather than proof of who holds the account.
github.com/Belacanz12 — Chollima Hunter
belacanz@yahoo.com
email address IT Worker Fraud CURATED
Source
-
Read on 20 September 2026 by walking the commit history of every repository on the GitHub accounts github.com/trentist and github.com/Belacanz12, already held under this persona, and tallying the author line on every commit. A commit's author line is what the holder configured their git client with rather than anything the profile page chooses to display, so it recovers addresses the account never states. The addresses recorded here were not already in this index: chasegreer327@gmail.com authored 781 commits across 10 of its repositories, commits as "Trentist"; belacanz@yahoo.com authored 184 commits across 3 of its repositories, commits as "Belacanz12"; chasegreer327@gmail.cm authored 4 commits across the repository trentist/crypto-blog, commits as "Trentist"; trent.delisle@mail.com authored 3 commits across the repository trentist/CatlistaBot, commits as "Trentist"; ayahmad1007@gmail.com authored 1 commit across the repository Belacanz12/belacanz12, commits as "Belacanz12". Each is admitted because it commits under a name the account itself uses, which is the test that separates the holder's own address from the original author of a repository copied in. Addresses belonging to unrelated developers whose work appears in these repositories are deliberately not recorded, and an address is evidence that whoever held it wrote those commits rather than proof of who holds the account.
github.com/Belacanz12 — Chollima Hunter
chasegreer327@gmail.cm
email address IT Worker Fraud CURATED
Source
-
Read on 20 September 2026 by walking the commit history of every repository on the GitHub accounts github.com/trentist and github.com/Belacanz12, already held under this persona, and tallying the author line on every commit. A commit's author line is what the holder configured their git client with rather than anything the profile page chooses to display, so it recovers addresses the account never states. The addresses recorded here were not already in this index: chasegreer327@gmail.com authored 781 commits across 10 of its repositories, commits as "Trentist"; belacanz@yahoo.com authored 184 commits across 3 of its repositories, commits as "Belacanz12"; chasegreer327@gmail.cm authored 4 commits across the repository trentist/crypto-blog, commits as "Trentist"; trent.delisle@mail.com authored 3 commits across the repository trentist/CatlistaBot, commits as "Trentist"; ayahmad1007@gmail.com authored 1 commit across the repository Belacanz12/belacanz12, commits as "Belacanz12". Each is admitted because it commits under a name the account itself uses, which is the test that separates the holder's own address from the original author of a repository copied in. Addresses belonging to unrelated developers whose work appears in these repositories are deliberately not recorded, and an address is evidence that whoever held it wrote those commits rather than proof of who holds the account.
github.com/trentist — Chollima Hunter
chasegreer327@gmail.com
email address IT Worker Fraud CURATED
Source
-
Read on 20 September 2026 by walking the commit history of every repository on the GitHub accounts github.com/trentist and github.com/Belacanz12, already held under this persona, and tallying the author line on every commit. A commit's author line is what the holder configured their git client with rather than anything the profile page chooses to display, so it recovers addresses the account never states. The addresses recorded here were not already in this index: chasegreer327@gmail.com authored 781 commits across 10 of its repositories, commits as "Trentist"; belacanz@yahoo.com authored 184 commits across 3 of its repositories, commits as "Belacanz12"; chasegreer327@gmail.cm authored 4 commits across the repository trentist/crypto-blog, commits as "Trentist"; trent.delisle@mail.com authored 3 commits across the repository trentist/CatlistaBot, commits as "Trentist"; ayahmad1007@gmail.com authored 1 commit across the repository Belacanz12/belacanz12, commits as "Belacanz12". Each is admitted because it commits under a name the account itself uses, which is the test that separates the holder's own address from the original author of a repository copied in. Addresses belonging to unrelated developers whose work appears in these repositories are deliberately not recorded, and an address is evidence that whoever held it wrote those commits rather than proof of who holds the account.
github.com/trentist — Chollima Hunter
clark.pickles30@proton.me
email address IT Worker Fraud MATCHED IN SOURCE
Sources
-
ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here.
x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt) -
…2 ====== johnathon.h.tneg18@gmail.com leptointel213@gmail.com clark.pickles30@proton.me dkwebigo416@gmail.com zhangxu57477@gmail.com kholodroman6@gmail.com hanhd7231@gmail.com artemyaroshenko540@gmail.com ratushniakoleksii8@gma…
Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File
dkwebigo416@gmail.com
email address IT Worker Fraud MATCHED IN SOURCE
Sources
-
ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here.
x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt) -
…2 ====== johnathon.h.tneg18@gmail.com leptointel213@gmail.com clark.pickles30@proton.me dkwebigo416@gmail.com zhangxu57477@gmail.com kholodroman6@gmail.com hanhd7231@gmail.com artemyaroshenko540@gmail.com ratushniakoleksii8@gmail.com sparukgena@gmai…
Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File
hanhd7231@gmail.com
email address IT Worker Fraud MATCHED IN SOURCE
Sources
-
ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here.
x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt) -
…on.h.tneg18@gmail.com leptointel213@gmail.com clark.pickles30@proton.me dkwebigo416@gmail.com zhangxu57477@gmail.com kholodroman6@gmail.com hanhd7231@gmail.com artemyaroshenko540@gmail.com ratushniakoleksii8@gmail.com sparukgena@gmail.com joshuagosney.dev.web@gmail.com hungpham.web3@gmail.com mak.m…
Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File
johnathonhtneg18@gmail.com
email address IT Worker Fraud MATCHED IN SOURCE
Listed as johnathon.h.tneg18@gmail.com
Sources
-
ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here.
x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt) -
…2 ====== johnathon.h.tneg18@gmail.com leptointel213@gmail.com clark.pickles30@proton.me dkwebigo416@gmail.com zhangxu57477@gmail.com kholodroman6@gmail.com hanhd7231@gmail.com a…
Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File
kholodroman6@gmail.com
email address IT Worker Fraud CURATED
Sources
-
ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here.
x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt) -
Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 10 commits signed kholodroman6@gmail.com, an address ZachXBT publishes for this persona, to github.com/romik6, account id 216759224, created on 17 June 2025, with 4 public repositories.
github.com/romik6 — Chollima Hunter -
…2 ====== johnathon.h.tneg18@gmail.com leptointel213@gmail.com clark.pickles30@proton.me dkwebigo416@gmail.com zhangxu57477@gmail.com kholodroman6@gmail.com hanhd7231@gmail.com artemyaroshenko540@gmail.com ratushniakoleksii8@gmail.com sparukgena@gmail.com joshuagosney.dev.web@gmail.com hungpham.…
Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File
leptointel213@gmail.com
email address IT Worker Fraud MATCHED IN SOURCE
Sources
-
ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here.
x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt) -
…2 ====== johnathon.h.tneg18@gmail.com leptointel213@gmail.com clark.pickles30@proton.me dkwebigo416@gmail.com zhangxu57477@gmail.com kholodroman6@gmail.com hanhd7231@gmail.com artemyaroshenko540@gmail.…
Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File
ratushniakoleksii8@gmail.com
email address IT Worker Fraud MATCHED IN SOURCE
Sources
-
ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here.
x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt) -
…rk.pickles30@proton.me dkwebigo416@gmail.com zhangxu57477@gmail.com kholodroman6@gmail.com hanhd7231@gmail.com artemyaroshenko540@gmail.com ratushniakoleksii8@gmail.com sparukgena@gmail.com joshuagosney.dev.web@gmail.com hungpham.web3@gmail.com mak.martynenko22@gmail.com mark.developer.2006@gmail.com kevin.…
Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File
sparukgena@gmail.com
email address IT Worker Fraud MATCHED IN SOURCE
Sources
-
ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here.
x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt) -
…go416@gmail.com zhangxu57477@gmail.com kholodroman6@gmail.com hanhd7231@gmail.com artemyaroshenko540@gmail.com ratushniakoleksii8@gmail.com sparukgena@gmail.com joshuagosney.dev.web@gmail.com hungpham.web3@gmail.com mak.martynenko22@gmail.com mark.developer.2006@gmail.com kevin.tsang.coder@gmail.com…
Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File
trent.delisle@mail.com
email address IT Worker Fraud CURATED
Source
-
Read on 20 September 2026 by walking the commit history of every repository on the GitHub accounts github.com/trentist and github.com/Belacanz12, already held under this persona, and tallying the author line on every commit. A commit's author line is what the holder configured their git client with rather than anything the profile page chooses to display, so it recovers addresses the account never states. The addresses recorded here were not already in this index: chasegreer327@gmail.com authored 781 commits across 10 of its repositories, commits as "Trentist"; belacanz@yahoo.com authored 184 commits across 3 of its repositories, commits as "Belacanz12"; chasegreer327@gmail.cm authored 4 commits across the repository trentist/crypto-blog, commits as "Trentist"; trent.delisle@mail.com authored 3 commits across the repository trentist/CatlistaBot, commits as "Trentist"; ayahmad1007@gmail.com authored 1 commit across the repository Belacanz12/belacanz12, commits as "Belacanz12". Each is admitted because it commits under a name the account itself uses, which is the test that separates the holder's own address from the original author of a repository copied in. Addresses belonging to unrelated developers whose work appears in these repositories are deliberately not recorded, and an address is evidence that whoever held it wrote those commits rather than proof of who holds the account.
github.com/trentist — Chollima Hunter
zhangxu57477@gmail.com
email address IT Worker Fraud MATCHED IN SOURCE
Sources
-
ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here.
x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt) -
…2 ====== johnathon.h.tneg18@gmail.com leptointel213@gmail.com clark.pickles30@proton.me dkwebigo416@gmail.com zhangxu57477@gmail.com kholodroman6@gmail.com hanhd7231@gmail.com artemyaroshenko540@gmail.com ratushniakoleksii8@gmail.com sparukgena@gmail.com joshuagosney.dev.…
Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File
https://github.com/belacanz12
github profile IT Worker Fraud RESEARCHER POST live
live
Source
-
ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here.
x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt)
https://github.com/romik6
github profile IT Worker Fraud CURATED live
live
Source
-
Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 10 commits signed kholodroman6@gmail.com, an address ZachXBT publishes for this persona, to github.com/romik6, account id 216759224, created on 17 June 2025, with 4 public repositories.
github.com/romik6 — Chollima Hunter
https://github.com/trentist
github profile IT Worker Fraud RESEARCHER POST live
live
Source
-
ZachXBT published a table of the fake identities this operator ran, drawn from a device an unnamed source compromised. The post states five IT workers between them operated more than thirty identities, using purchased Upwork and LinkedIn accounts and government IDs to obtain developer jobs. THE VALUES BELOW WERE READ FROM THE SCREENSHOT IN THE POST, not from text: the table is an image and exists in no machine-readable form. Each was transcribed and checked against the image by a person, and the team designation is the source's own grouping, not an inference drawn here.
x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt)
Sources
- Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File
- x.com/zachxbt/status/1955613912201896113 — ZachXBT (@zachxbt)
- dev.to/trentist — Chollima Hunter
- github.com/trentist — Chollima Hunter
- github.com/Belacanz12 — Chollima Hunter
- github.com/romik6 — Chollima Hunter