Janus
Also reported as: AngelStar boyJulius Kelly
A fabricated professional identity used in the DPRK remote IT-worker scheme. Most of what follows is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, Janus. The attribution is theirs, not this site's.
The remainder was read by this site from the account itself and is cited to the page and date it was read.
Portrait used by the persona.
The profile picture the researcher published beside smallstar0924@gmail.com, in the 17 May 2025 profile-picture thread. The address was attributed to this operator two days earlier.
Profiles and evidence
GitHub profile fullstackengineer777 the persona presented, with single sign-on into the foxcorp organization.
GitHub profile bestdeveloper23, contact softangel0090@gmail.com.
GitHub profile Dreamfullstacker, sixty repositories.
Identifiers attributed to this persona
35 indicators the sources below record for this operator, each with its sources.
Angel
alias IT Worker Fraud RESEARCHER POST
Source
-
The four posts are one thread by the same researcher. He names the operator Janus or Angel in the second, calls him Star boy in the third where the addresses are described as the older ones, and adds the last address in the fourth alongside a remark about a GitHub account holding sixty repositories, which the post does not name.
x.com/browsercookies/status/1922876606051176801 — Cookie Connoisseur (@browsercookies)
Janus
alias IT Worker Fraud CURATED
Sources
-
The four posts are one thread by the same researcher. He names the operator Janus or Angel in the second, calls him Star boy in the third where the addresses are described as the older ones, and adds the last address in the fourth alongside a remark about a GitHub account holding sixty repositories, which the post does not name.
x.com/browsercookies/status/1922876606051176801 — Cookie Connoisseur (@browsercookies) -
Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- blackhorse0215 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Black Horse. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
gitlab.com/blackhorse0215 — Chollima Hunter -
Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- dreamfullstacker -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Dream Fullstacker. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
gitlab.com/dreamfullstacker — Chollima Hunter -
Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- dreamfullstacker -- and asking dev.to whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a registration date of 29 May 2022 and no display name but the handle itself. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
dev.to/dreamfullstacker — Chollima Hunter -
Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- fullstackdev3546 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Full Stack. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
gitlab.com/fullstackdev3546 — Chollima Hunter -
Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- fullstackdev3546 -- and asking Docker Hub whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a registration date of 17 June 2023. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
hub.docker.com/u/fullstackdev3546 — Chollima Hunter -
Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- juliusmkelly -- and asking Hugging Face whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Julius Kelly. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
huggingface.co/juliusmkelly — Chollima Hunter -
Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- seniorwebdev215 -- and asking Docker Hub whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a registration date of 9 February 2021. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
hub.docker.com/u/seniorwebdev215 — Chollima Hunter -
Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it. github.com/webmobileai is account id 108163680, created on 25 June 2022, display name WMAG, with 111 public repositories. Its noreply addresses show it was previously named seniorsoftdeveloper. 91 of its own 100 commits are signed softdeveng9211@outlook.com, and its repositories hold 66 more signed fullstackdev3546@gmail.com; browsercookies gives both for the operator the researcher calls Janus.
github.com/webmobileai — Chollima Hunter -
Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it. github.com/blackhorse0215 is account id 67865729, created on 5 July 2020, bio Ecommerce Wizard. 94 of its 100 own commits are signed blackhorse0215@gmail.com, the handle as a mailbox, which browsercookies gives for Janus.
github.com/blackhorse0215 — Chollima Hunter -
Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it. github.com/seniorweb215 is account id 65157317, created on 11 May 2020. 26 of the 27 own commits GitHub's search returns for it are signed seniorwebdev215@gmail.com, which browsercookies gives for Janus.
github.com/seniorweb215 — Chollima Hunter -
Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 74 commits signed smallstar0924@gmail.com, an address browsercookies publishes for this persona, to the login Caesar0dev, which no longer resolves.
github.com/Caesar0dev — Chollima Hunter
Julius Kelly
alias IT Worker Fraud CURATED
Source
-
Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- juliusmkelly -- and asking Hugging Face whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Julius Kelly. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
huggingface.co/juliusmkelly — Chollima Hunter
Star boy
alias IT Worker Fraud RESEARCHER POST
Source
-
The four posts are one thread by the same researcher. He names the operator Janus or Angel in the second, calls him Star boy in the third where the addresses are described as the older ones, and adds the last address in the fourth alongside a remark about a GitHub account holding sixty repositories, which the post does not name.
x.com/browsercookies/status/1922876606051176801 — Cookie Connoisseur (@browsercookies)
https://dev.to/dreamfullstacker
devto account IT Worker Fraud CURATED live
live
Source
-
Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- dreamfullstacker -- and asking dev.to whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a registration date of 29 May 2022 and no display name but the handle itself. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
dev.to/dreamfullstacker — Chollima Hunter
https://hub.docker.com/u/fullstackdev3546
dockerhub account IT Worker Fraud CURATED live
live
Source
-
Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- fullstackdev3546 -- and asking Docker Hub whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a registration date of 17 June 2023. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
hub.docker.com/u/fullstackdev3546 — Chollima Hunter
https://hub.docker.com/u/seniorwebdev215
dockerhub account IT Worker Fraud CURATED live
live
Source
-
Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- seniorwebdev215 -- and asking Docker Hub whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a registration date of 9 February 2021. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
hub.docker.com/u/seniorwebdev215 — Chollima Hunter
blackhorse0215@gmail.com
email address IT Worker Fraud CURATED
Sources
-
The four posts are one thread by the same researcher. He names the operator Janus or Angel in the second, calls him Star boy in the third where the addresses are described as the older ones, and adds the last address in the fourth alongside a remark about a GitHub account holding sixty repositories, which the post does not name.
x.com/browsercookies/status/1922882187541557757 — Cookie Connoisseur (@browsercookies) -
Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it. github.com/blackhorse0215 is account id 67865729, created on 5 July 2020, bio Ecommerce Wizard. 94 of its 100 own commits are signed blackhorse0215@gmail.com, the handle as a mailbox, which browsercookies gives for Janus.
github.com/blackhorse0215 — Chollima Hunter
careemboota@gmail.com
email address IT Worker Fraud RESEARCHER POST
Source
-
The four posts are one thread by the same researcher. He names the operator Janus or Angel in the second, calls him Star boy in the third where the addresses are described as the older ones, and adds the last address in the fourth alongside a remark about a GitHub account holding sixty repositories, which the post does not name.
x.com/browsercookies/status/1922877967362892189 — Cookie Connoisseur (@browsercookies)
cutewolf12345@outlook.com
email address IT Worker Fraud RESEARCHER POST
Source
-
The four posts are one thread by the same researcher. He names the operator Janus or Angel in the second, calls him Star boy in the third where the addresses are described as the older ones, and adds the last address in the fourth alongside a remark about a GitHub account holding sixty repositories, which the post does not name.
x.com/browsercookies/status/1922877967362892189 — Cookie Connoisseur (@browsercookies)
dreamfullstacker@gmail.com
email address IT Worker Fraud MATCHED IN SOURCE
Sources
-
The four posts are one thread by the same researcher. He names the operator Janus or Angel in the second, calls him Star boy in the third where the addresses are described as the older ones, and adds the last address in the fourth alongside a remark about a GitHub account holding sixty repositories, which the post does not name.
x.com/browsercookies/status/1923098202284167531 — Cookie Connoisseur (@browsercookies) -
…45@gmail.com dragonslayer.feb20@gmail.com dragontiger928@gmail.com dreamcareer070@gmail.com dreamconsolestar@gmail.com dreamdev37@gmail.com dreamfullstacker@gmail.com dreamhigh.ws917@gmail.com dreamhigh9990@gmail.com dreamhighpassionhigh@gmail.com dreamworktalent@gmail.com dreamworld130362@gmail.com dried…
Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File
febekec383@gridmauk.com
email address IT Worker Fraud RESEARCHER POST
Source
-
The four posts are one thread by the same researcher. He names the operator Janus or Angel in the second, calls him Star boy in the third where the addresses are described as the older ones, and adds the last address in the fourth alongside a remark about a GitHub account holding sixty repositories, which the post does not name.
x.com/browsercookies/status/1922882187541557757 — Cookie Connoisseur (@browsercookies)
fullstackdev3546@gmail.com
email address IT Worker Fraud CURATED
Sources
-
The four posts are one thread by the same researcher. He names the operator Janus or Angel in the second, calls him Star boy in the third where the addresses are described as the older ones, and adds the last address in the fourth alongside a remark about a GitHub account holding sixty repositories, which the post does not name.
x.com/browsercookies/status/1922876606051176801 — Cookie Connoisseur (@browsercookies) -
Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it. github.com/webmobileai is account id 108163680, created on 25 June 2022, display name WMAG, with 111 public repositories. Its noreply addresses show it was previously named seniorsoftdeveloper. 91 of its own 100 commits are signed softdeveng9211@outlook.com, and its repositories hold 66 more signed fullstackdev3546@gmail.com; browsercookies gives both for the operator the researcher calls Janus.
github.com/webmobileai — Chollima Hunter -
…en615heart@gmail.com frubberfreep@gmail.com fujino.juzo@gmail.com fulldev0526@gmail.com fullstack926@gmail.com fullstackcoder0322@gmail.com fullstackdev3546@gmail.com fullstackninja0805@gmail.com fullstackpartner@gmail.com furiouscomet729@gmail.com gagikbabayan5105@gmail.com galoyi2320@syinxun.com garysco…
Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File
happypooh0802@outlook.com
email address IT Worker Fraud RESEARCHER POST
Source
-
The four posts are one thread by the same researcher. He names the operator Janus or Angel in the second, calls him Star boy in the third where the addresses are described as the older ones, and adds the last address in the fourth alongside a remark about a GitHub account holding sixty repositories, which the post does not name.
x.com/browsercookies/status/1922877967362892189 — Cookie Connoisseur (@browsercookies)
janus.upwork@proton.me
email address IT Worker Fraud RESEARCHER POST
Source
-
The four posts are one thread by the same researcher. He names the operator Janus or Angel in the second, calls him Star boy in the third where the addresses are described as the older ones, and adds the last address in the fourth alongside a remark about a GitHub account holding sixty repositories, which the post does not name.
x.com/browsercookies/status/1922877967362892189 — Cookie Connoisseur (@browsercookies)
juliusmkelly@gmail.com
email address IT Worker Fraud RESEARCHER POST
Source
-
The four posts are one thread by the same researcher. He names the operator Janus or Angel in the second, calls him Star boy in the third where the addresses are described as the older ones, and adds the last address in the fourth alongside a remark about a GitHub account holding sixty repositories, which the post does not name.
x.com/browsercookies/status/1922882187541557757 — Cookie Connoisseur (@browsercookies)
justinbropico@gmail.com
email address IT Worker Fraud MATCHED IN SOURCE
Sources
-
The four posts are one thread by the same researcher. He names the operator Janus or Angel in the second, calls him Star boy in the third where the addresses are described as the older ones, and adds the last address in the fourth alongside a remark about a GitHub account holding sixty repositories, which the post does not name.
x.com/browsercookies/status/1922877967362892189 — Cookie Connoisseur (@browsercookies) -
…gufum.com julian.aces.pokerdev@gmail.com juliegibbs206@gmail.com juniorcorder53@gmail.com jupiter256821@gmail.com justinbettano96@gmail.com justinbropico@gmail.com justinkal1106@gmail.com justinlee0093@gmail.com justinmichaelschaffer0402@gmail.com justinscha0402@gmail.com justinstone0603@gmail.com jxun…
Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File
lucas@bluestout.com
email address IT Worker Fraud RESEARCHER POST
Source
-
The four posts are one thread by the same researcher. He names the operator Janus or Angel in the second, calls him Star boy in the third where the addresses are described as the older ones, and adds the last address in the fourth alongside a remark about a GitHub account holding sixty repositories, which the post does not name.
x.com/browsercookies/status/1922882187541557757 — Cookie Connoisseur (@browsercookies)
seniorwebdev215@gmail.com
email address IT Worker Fraud CURATED
Sources
-
The four posts are one thread by the same researcher. He names the operator Janus or Angel in the second, calls him Star boy in the third where the addresses are described as the older ones, and adds the last address in the fourth alongside a remark about a GitHub account holding sixty repositories, which the post does not name.
x.com/browsercookies/status/1922882187541557757 — Cookie Connoisseur (@browsercookies) -
Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it. github.com/seniorweb215 is account id 65157317, created on 11 May 2020. 26 of the 27 own commits GitHub's search returns for it are signed seniorwebdev215@gmail.com, which browsercookies gives for Janus.
github.com/seniorweb215 — Chollima Hunter
sixoga1881@delowd.com
email address IT Worker Fraud RESEARCHER POST
Source
-
The four posts are one thread by the same researcher. He names the operator Janus or Angel in the second, calls him Star boy in the third where the addresses are described as the older ones, and adds the last address in the fourth alongside a remark about a GitHub account holding sixty repositories, which the post does not name.
x.com/browsercookies/status/1922882187541557757 — Cookie Connoisseur (@browsercookies)
smallstar0924@gmail.com
email address IT Worker Fraud CURATED
Sources
-
The four posts are one thread by the same researcher. He names the operator Janus or Angel in the second, calls him Star boy in the third where the addresses are described as the older ones, and adds the last address in the fourth alongside a remark about a GitHub account holding sixty repositories, which the post does not name.
x.com/browsercookies/status/1922877967362892189 — Cookie Connoisseur (@browsercookies) -
The four posts are one thread by the same researcher. He names the operator Janus or Angel in the second, calls him Star boy in the third where the addresses are described as the older ones, and adds the last address in the fourth alongside a remark about a GitHub account holding sixty repositories, which the post does not name.
x.com/browsercookies/status/1923880596855717915 — Cookie Connoisseur (@browsercookies) -
Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 74 commits signed smallstar0924@gmail.com, an address browsercookies publishes for this persona, to the login Caesar0dev, which no longer resolves.
github.com/Caesar0dev — Chollima Hunter -
…tairmail.com sixteen1120@proton.me skybolt0307@gmail.com skygentleman6463380@skiff.com slow.spell.483e4e@gizmotik.com smallant519@gmail.com smallstar0924@gmail.com smart.developer5555@gmail.com smart.hacker.6129@gmail.com smart0315dev@gmail.com smart04240@gmail.com smartbigguru@gmail.com smartdevgroupl…
Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File
softangel0090@gmail.com
email address IT Worker Fraud RESEARCHER POST
Sources
-
The four posts are one thread by the same researcher. He names the operator Janus or Angel in the second, calls him Star boy in the third where the addresses are described as the older ones, and adds the last address in the fourth alongside a remark about a GitHub account holding sixty repositories, which the post does not name.
x.com/browsercookies/status/1922877967362892189 — Cookie Connoisseur (@browsercookies) -
The post says the operator's associates signed a guestbook on his GitHub profile and that the entries link to their profiles. The three names are transcribed by hand from the attached screenshot of that guestbook, where each is rendered as a link beside a GitHub-style identicon. The researcher characterises them as associates of the Lovely Developer operator but does not attribute any of them to a named person, so they anchor no persona here. The address softangel0090@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.
x.com/browsercookies/status/1923540150686187802 — Cookie Connoisseur (@browsercookies)
softdeveng9211@outlook.com
email address IT Worker Fraud CURATED
Sources
-
The four posts are one thread by the same researcher. He names the operator Janus or Angel in the second, calls him Star boy in the third where the addresses are described as the older ones, and adds the last address in the fourth alongside a remark about a GitHub account holding sixty repositories, which the post does not name.
x.com/browsercookies/status/1922876606051176801 — Cookie Connoisseur (@browsercookies) -
Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it. github.com/webmobileai is account id 108163680, created on 25 June 2022, display name WMAG, with 111 public repositories. Its noreply addresses show it was previously named seniorsoftdeveloper. 91 of its own 100 commits are signed softdeveng9211@outlook.com, and its repositories hold 66 more signed fullstackdev3546@gmail.com; browsercookies gives both for the operator the researcher calls Janus.
github.com/webmobileai — Chollima Hunter
webdev215@yandex.com
email address IT Worker Fraud RESEARCHER POST
Source
-
The four posts are one thread by the same researcher. He names the operator Janus or Angel in the second, calls him Star boy in the third where the addresses are described as the older ones, and adds the last address in the fourth alongside a remark about a GitHub account holding sixty repositories, which the post does not name.
x.com/browsercookies/status/1922882187541557757 — Cookie Connoisseur (@browsercookies)
yaroslav@diebestenderstadt.de
email address IT Worker Fraud RESEARCHER POST
Source
-
The four posts are one thread by the same researcher. He names the operator Janus or Angel in the second, calls him Star boy in the third where the addresses are described as the older ones, and adds the last address in the fourth alongside a remark about a GitHub account holding sixty repositories, which the post does not name.
x.com/browsercookies/status/1922882187541557757 — Cookie Connoisseur (@browsercookies)
zaikayarik123@gmail.com
email address IT Worker Fraud RESEARCHER POST
Source
-
The four posts are one thread by the same researcher. He names the operator Janus or Angel in the second, calls him Star boy in the third where the addresses are described as the older ones, and adds the last address in the fourth alongside a remark about a GitHub account holding sixty repositories, which the post does not name.
x.com/browsercookies/status/1922882187541557757 — Cookie Connoisseur (@browsercookies)
https://github.com/blackhorse0215
github profile IT Worker Fraud CURATED live
live
Source
-
Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it. github.com/blackhorse0215 is account id 67865729, created on 5 July 2020, bio Ecommerce Wizard. 94 of its 100 own commits are signed blackhorse0215@gmail.com, the handle as a mailbox, which browsercookies gives for Janus.
github.com/blackhorse0215 — Chollima Hunter
https://github.com/caesar0dev
github profile IT Worker Fraud CURATED removed
removed
Source
-
Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 74 commits signed smallstar0924@gmail.com, an address browsercookies publishes for this persona, to the login Caesar0dev, which no longer resolves.
github.com/Caesar0dev — Chollima Hunter
https://github.com/fullstackengineer777
github profile IT Worker Fraud RESEARCHER POST removed
removed
Source
-
The four posts are one thread by the same researcher. He names the operator Janus or Angel in the second, calls him Star boy in the third where the addresses are described as the older ones, and adds the last address in the fourth alongside a remark about a GitHub account holding sixty repositories, which the post does not name.
x.com/browsercookies/status/1922876606051176801 — Cookie Connoisseur (@browsercookies)
https://github.com/seniorweb215
github profile IT Worker Fraud CURATED live
live
Source
-
Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it. github.com/seniorweb215 is account id 65157317, created on 11 May 2020. 26 of the 27 own commits GitHub's search returns for it are signed seniorwebdev215@gmail.com, which browsercookies gives for Janus.
github.com/seniorweb215 — Chollima Hunter
https://github.com/webmobileai
github profile IT Worker Fraud CURATED live
live
Source
-
Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it. github.com/webmobileai is account id 108163680, created on 25 June 2022, display name WMAG, with 111 public repositories. Its noreply addresses show it was previously named seniorsoftdeveloper. 91 of its own 100 commits are signed softdeveng9211@outlook.com, and its repositories hold 66 more signed fullstackdev3546@gmail.com; browsercookies gives both for the operator the researcher calls Janus.
github.com/webmobileai — Chollima Hunter
https://gitlab.com/blackhorse0215
gitlab account IT Worker Fraud CURATED live
live
Source
-
Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- blackhorse0215 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Black Horse. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
gitlab.com/blackhorse0215 — Chollima Hunter
https://gitlab.com/dreamfullstacker
gitlab account IT Worker Fraud CURATED live
live
Source
-
Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- dreamfullstacker -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Dream Fullstacker. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
gitlab.com/dreamfullstacker — Chollima Hunter
https://gitlab.com/fullstackdev3546
gitlab account IT Worker Fraud CURATED live
live
Source
-
Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- fullstackdev3546 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Full Stack. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
gitlab.com/fullstackdev3546 — Chollima Hunter
https://huggingface.co/juliusmkelly
huggingface account IT Worker Fraud CURATED live
live
Source
-
Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- juliusmkelly -- and asking Hugging Face whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Julius Kelly. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
huggingface.co/juliusmkelly — Chollima Hunter
Sources
- Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File
- x.com/browsercookies/status/1922876606051176801 — Cookie Connoisseur (@browsercookies)
- x.com/browsercookies/status/1922877967362892189 — Cookie Connoisseur (@browsercookies)
- x.com/browsercookies/status/1922882187541557757 — Cookie Connoisseur (@browsercookies)
- x.com/browsercookies/status/1923098202284167531 — Cookie Connoisseur (@browsercookies)
- x.com/browsercookies/status/1923880596855717915 — Cookie Connoisseur (@browsercookies)
- x.com/browsercookies/status/1923540150686187802 — Cookie Connoisseur (@browsercookies)
- gitlab.com/blackhorse0215 — Chollima Hunter
- gitlab.com/dreamfullstacker — Chollima Hunter
- dev.to/dreamfullstacker — Chollima Hunter
- gitlab.com/fullstackdev3546 — Chollima Hunter
- hub.docker.com/u/fullstackdev3546 — Chollima Hunter
- huggingface.co/juliusmkelly — Chollima Hunter
- hub.docker.com/u/seniorwebdev215 — Chollima Hunter
- github.com/webmobileai — Chollima Hunter
- github.com/blackhorse0215 — Chollima Hunter
- github.com/seniorweb215 — Chollima Hunter
- github.com/Caesar0dev — Chollima Hunter