Aiden Mori

The post states the operator runs a project called DIFINES and that his initials may be KWH or CCI, and cites an analysis of IT-worker logs published by chollima-group.io alongside the accounts.

Found on 17 September 2026 by asking Hugging Face whether an account exists under aiden77mori, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a display name of Aiden Mori. The display name is kept here rather than as an alias, because it restates the handle, describes the work, or repeats what this operator is already called. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.

Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- codeknight0707 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Lin Elliot. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.

Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- smartfox1203 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Roy Lee. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.

Found on 18 September 2026 by putting smartfox1203, the GitLab login the index already holds for this persona, to Maigret's username search and then asking Freelancer's public user endpoint, which answers with the account record and, for a name that does not exist, with nothing. Freelancer returns the account with the display name Closed User and a registration date of 15 May 2022: an account existed under the handle and has since been closed, which is recorded here because a closed account is still a registration, and the date is the one fact it states. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.

Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it. github.com/0xdanieltran is account id 89995315, created on 2 September 2021, with 109 public repositories. Its noreply addresses name the handles aiden77mori and hellovlady, so it is the account Narcass3 names as github.com/aiden77mori under Aiden Mori, renamed; hellovlady is also a handle this index carries from other reporting, and both now return not found. Its repositories hold 82 commits signed aiden77mori@gmail.com and 3 signed smartfox1203@gmail.com, both addresses the researcher gives for the persona; its own commits are signed danillppiont106@gmail.com (83 of 100) and danieltran124@outlook.com (10), recorded here as the account's own.

Found on 29 September 2026 by searching GitHub's code for the handles this site already holds for the persona (0xdanieltran, aiden77mori) and reading the files that name them: contact blocks, profile READMEs and portfolio data in the persona's own repositories or in repositories that credit its accounts. Each value is cited to the file it was read from. Values in copied templates, client team pages and test data are not carried.

Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- codeknight0707 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Lin Elliot. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.

Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- smartfox1203 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Roy Lee. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.

The post states the operator runs a project called DIFINES and that his initials may be KWH or CCI, and cites an analysis of IT-worker logs published by chollima-group.io alongside the accounts.

The post states the operator runs a project called DIFINES and that his initials may be KWH or CCI, and cites an analysis of IT-worker logs published by chollima-group.io alongside the accounts.

Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it. github.com/0xdanieltran is account id 89995315, created on 2 September 2021, with 109 public repositories. Its noreply addresses name the handles aiden77mori and hellovlady, so it is the account Narcass3 names as github.com/aiden77mori under Aiden Mori, renamed; hellovlady is also a handle this index carries from other reporting, and both now return not found. Its repositories hold 82 commits signed aiden77mori@gmail.com and 3 signed smartfox1203@gmail.com, both addresses the researcher gives for the persona; its own commits are signed danillppiont106@gmail.com (83 of 100) and danieltran124@outlook.com (10), recorded here as the account's own.

The post states the operator runs a project called DIFINES and that his initials may be KWH or CCI, and cites an analysis of IT-worker logs published by chollima-group.io alongside the accounts.

Nearby text:

…Here's a small sample: masterdev1027@gmail.com fulldev317@gmail.com codeknight0707@gmail.com seniordev9726@outlook.com dreamcomes0704@gmail.com topdev1228@protonmail.com helios0912@outlook.com smartfox1203@gmail.com "star",…

Nearby text:

…masterdev1027 - seniordev9726 - slark0704 - smartfox1203 - topdev1228 - toshyodev - Zhang-777 - smartfox1203@gmail.com - codeknight0707@gmail.com - seniordev9726@outlook.com - anydev1103@gmail.com - fulldev114@outlook.com - boriszhang1021@gmail.com - topdev1228@protonmail.com -…

Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it. github.com/0xdanieltran is account id 89995315, created on 2 September 2021, with 109 public repositories. Its noreply addresses name the handles aiden77mori and hellovlady, so it is the account Narcass3 names as github.com/aiden77mori under Aiden Mori, renamed; hellovlady is also a handle this index carries from other reporting, and both now return not found. Its repositories hold 82 commits signed aiden77mori@gmail.com and 3 signed smartfox1203@gmail.com, both addresses the researcher gives for the persona; its own commits are signed danillppiont106@gmail.com (83 of 100) and danieltran124@outlook.com (10), recorded here as the account's own.

Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it. github.com/0xdanieltran is account id 89995315, created on 2 September 2021, with 109 public repositories. Its noreply addresses name the handles aiden77mori and hellovlady, so it is the account Narcass3 names as github.com/aiden77mori under Aiden Mori, renamed; hellovlady is also a handle this index carries from other reporting, and both now return not found. Its repositories hold 82 commits signed aiden77mori@gmail.com and 3 signed smartfox1203@gmail.com, both addresses the researcher gives for the persona; its own commits are signed danillppiont106@gmail.com (83 of 100) and danieltran124@outlook.com (10), recorded here as the account's own.

The post states the operator runs a project called DIFINES and that his initials may be KWH or CCI, and cites an analysis of IT-worker logs published by chollima-group.io alongside the accounts.

Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it. github.com/0xdanieltran is account id 89995315, created on 2 September 2021, with 109 public repositories. Its noreply addresses name the handles aiden77mori and hellovlady, so it is the account Narcass3 names as github.com/aiden77mori under Aiden Mori, renamed; hellovlady is also a handle this index carries from other reporting, and both now return not found. Its repositories hold 82 commits signed aiden77mori@gmail.com and 3 signed smartfox1203@gmail.com, both addresses the researcher gives for the persona; its own commits are signed danillppiont106@gmail.com (83 of 100) and danieltran124@outlook.com (10), recorded here as the account's own.

Nearby text:

…v317@gmail.com codeknight0707@gmail.com seniordev9726@outlook.com dreamcomes0704@gmail.com topdev1228@protonmail.com helios0912@outlook.com smartfox1203@gmail.com "star", "dev", "pro", "senior", and "coder" are typical keywords seen in the emails, usually followed by 3 or 4 digits. Personas did…

Nearby text:

…helios9116 - hellovlady - masterdev1027 - seniordev9726 - slark0704 - smartfox1203 - topdev1228 - toshyodev - Zhang-777 - smartfox1203@gmail.com - codeknight0707@gmail.com - seniordev9726@outlook.com - anydev1103@gmail.com - fulldev114@outlook.com - boriszhang1021@gmail.com -…

Found on 18 September 2026 by putting smartfox1203, the GitLab login the index already holds for this persona, to Maigret's username search and then asking Freelancer's public user endpoint, which answers with the account record and, for a name that does not exist, with nothing. Freelancer returns the account with the display name Closed User and a registration date of 15 May 2022: an account existed under the handle and has since been closed, which is recorded here because a closed account is still a registration, and the date is the one fact it states. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.

Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it. github.com/0xdanieltran is account id 89995315, created on 2 September 2021, with 109 public repositories. Its noreply addresses name the handles aiden77mori and hellovlady, so it is the account Narcass3 names as github.com/aiden77mori under Aiden Mori, renamed; hellovlady is also a handle this index carries from other reporting, and both now return not found. Its repositories hold 82 commits signed aiden77mori@gmail.com and 3 signed smartfox1203@gmail.com, both addresses the researcher gives for the persona; its own commits are signed danillppiont106@gmail.com (83 of 100) and danieltran124@outlook.com (10), recorded here as the account's own.

The post states the operator runs a project called DIFINES and that his initials may be KWH or CCI, and cites an analysis of IT-worker logs published by chollima-group.io alongside the accounts.

Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- codeknight0707 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Lin Elliot. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.

Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- smartfox1203 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Roy Lee. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.

Found on 17 September 2026 by asking Hugging Face whether an account exists under aiden77mori, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a display name of Aiden Mori. The display name is kept here rather than as an alias, because it restates the handle, describes the work, or repeats what this operator is already called. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.

Found on 29 September 2026 by searching GitHub's code for the handles this site already holds for the persona (0xdanieltran, aiden77mori) and reading the files that name them: contact blocks, profile READMEs and portfolio data in the persona's own repositories or in repositories that credit its accounts. Each value is cited to the file it was read from. Values in copied templates, client team pages and test data are not carried.