Evander Li
A fabricated professional identity used in the DPRK remote IT-worker scheme. Most of what follows is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, Evander Li. The attribution is theirs, not this site's.
The remainder was read by this site from the account itself and is cited to the page and date it was read.
Freelancer profile the cited post publishes, headed Cheng Lin, Software Engineer, Chinese and English, with a portrait. It is the image the identity presented as itself.
Identifiers attributed to this persona
4 indicators the sources below record for this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
Evander Li |
alias | |
lievander24@gmail.com |
email address | |
https://github.com/harun961018 |
github profile | live |
https://gitlab.com/harun961018 |
gitlab account | live |
Evander Li
alias IT Worker Fraud CURATED
Sources
-
The post gives the identity's name, one address and one GitHub account, with no further detail in its text.
x.com/browsercookies/status/1932950369304523229 — Cookie Connoisseur (@browsercookies) -
Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under harun961018, a login the index already carries for this persona on another platform. The profile gives a member-since date of 14 November 2023. It displays "harun961018", which is a display name rather than a person's name and is recorded here rather than as an alias. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.
gitlab.com/harun961018 — Chollima Hunter
lievander24@gmail.com
email address IT Worker Fraud RESEARCHER POST
Source
-
The post gives the identity's name, one address and one GitHub account, with no further detail in its text.
x.com/browsercookies/status/1932950369304523229 — Cookie Connoisseur (@browsercookies)
https://github.com/harun961018
github profile IT Worker Fraud RESEARCHER POST live
live
Source
-
The post gives the identity's name, one address and one GitHub account, with no further detail in its text.
x.com/browsercookies/status/1932950369304523229 — Cookie Connoisseur (@browsercookies)
https://gitlab.com/harun961018
gitlab account IT Worker Fraud CURATED live
live
Source
-
Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under harun961018, a login the index already carries for this persona on another platform. The profile gives a member-since date of 14 November 2023. It displays "harun961018", which is a display name rather than a person's name and is recorded here rather than as an alias. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.
gitlab.com/harun961018 — Chollima Hunter
Sources
- x.com/browsercookies/status/1932950369304523229 — Cookie Connoisseur (@browsercookies)
- gitlab.com/harun961018 — Chollima Hunter