Chollima Hunter

← All personas

Mark Santiago

Also reported as: MarkSantiago02Topcoder415LovelyDodgerMitsuruKudo0213BTC415

A fabricated professional identity used in the DPRK remote IT-worker scheme. Most of what follows is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, Mark Santiago. The attribution is theirs, not this site's.

The remainder was read by this site from the account itself and is cited to the page and date it was read.

IT Worker Fraud First reported 2025-08-01 · last reported 2026-09-29

LinkedIn accounts

Identifiers reported alongside

13 indicators the sources below record for this operator, each with its sources.

IndicatorTypeAccount status
LovelyDodger alias —
Mark Santiago alias —
alenschmitt415@gmail.com email address —
marksantiago0929@gmail.com email address —
marksantiago2909@gmail.com email address —
https://github.com/imthegr8t1 github profile live checked 2026-09-30
https://github.com/luckymark228312 github profile removed checked 2026-09-30
https://github.com/marksantiago02 github profile removed checked 2026-09-02
https://github.com/marksantiago290 github profile live checked 2026-09-30
https://t.me/marksantiago02 telegram account live checked 2026-11-08
https://t.me/marksantiago290 telegram account live checked 2026-11-08
https://x.com/marksantiago02 x account not checked
https://x.com/marksantiago290 x account not checked

LovelyDodger

alias IT Worker Fraud RESEARCHER POST

First seen 2025-08-01 · last seen 2025-08-01

Source

  • The post records the LinkedIn profile as already returning 404 at the time of writing.
    x.com/browsercookies/status/1951099054861197523 — Cookie Connoisseur (@browsercookies) · under “Mark Santiago / MarkSantiago02 / Topcoder415 / LovelyDodger / MitsuruKudo0213 / BTC415” · published 2025-08-01 · pulled 2026-08-30

Mark Santiago

alias IT Worker Fraud CURATED

First seen 2025-08-01 · last seen 2026-09-29

Sources

  • The post records the LinkedIn profile as already returning 404 at the time of writing.
    x.com/browsercookies/status/1951099054861197523 — Cookie Connoisseur (@browsercookies) · under “Mark Santiago / MarkSantiago02 / Topcoder415 / LovelyDodger / MitsuruKudo0213 / BTC415” · published 2025-08-01 · pulled 2026-08-30
  • Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it. github.com/marksantiago290 is account id 133281370, created on 11 May 2023, with 100 public repositories. Its noreply addresses name the handles marksantiago02, marksantiago2909, btc415 and its current one, so it is the account browsercookies names as github.com/marksantiago02 under Mark Santiago, renamed; marksantiago02 now returns not found. Its repositories hold 70 commits signed marksantiago0929@gmail.com and 66 signed alenschmitt415@gmail.com, and 42 signed stevenpiao0822@gmail.com, which the same researcher gives for Steven Leal.
    github.com/marksantiago290 — Chollima Hunter · under “Mark Santiago” · pulled 2026-09-24
  • Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 1 commit signed marksantiago0929@gmail.com, an address browsercookies publishes for this persona, to github.com/imthegr8t1, account id 190365500, created on 2 December 2024, with 24 public repositories. GitHub attributes 100 commits signed alenschmitt415@gmail.com, an address browsercookies publishes for this persona, to the login luckymark228312, which no longer resolves.
    github.com/imthegr8t1 — Chollima Hunter · under “Mark Santiago” · pulled 2026-09-24
  • Found on 29 September 2026 by searching GitHub's code for the handles this site already holds for the persona (marksantiago290, marksantiago02) and reading the files that name them: contact blocks, profile READMEs and portfolio data in the persona's own repositories or in repositories that credit its accounts. Each value is cited to the file it was read from. Values in copied templates, client team pages and test data are not carried.
    github.com/marksantiago290/Ethereum-MEV-BOT/blob/db787bfec2aff77f6f572f5d6a5aec4b2abadae9/README.md — Chollima Hunter · under “Mark Santiago” · published 2025-04-09 · pulled 2026-09-29

alenschmitt415@gmail.com

email address IT Worker Fraud CURATED

First seen 2025-08-01 · last seen 2026-09-24

Sources

  • The post records the LinkedIn profile as already returning 404 at the time of writing.
    x.com/browsercookies/status/1951099054861197523 — Cookie Connoisseur (@browsercookies) · under “Mark Santiago / MarkSantiago02 / Topcoder415 / LovelyDodger / MitsuruKudo0213 / BTC415” · published 2025-08-01 · pulled 2026-08-30
  • Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it. github.com/marksantiago290 is account id 133281370, created on 11 May 2023, with 100 public repositories. Its noreply addresses name the handles marksantiago02, marksantiago2909, btc415 and its current one, so it is the account browsercookies names as github.com/marksantiago02 under Mark Santiago, renamed; marksantiago02 now returns not found. Its repositories hold 70 commits signed marksantiago0929@gmail.com and 66 signed alenschmitt415@gmail.com, and 42 signed stevenpiao0822@gmail.com, which the same researcher gives for Steven Leal.
    github.com/marksantiago290 — Chollima Hunter · under “Mark Santiago” · pulled 2026-09-24
  • Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 1 commit signed marksantiago0929@gmail.com, an address browsercookies publishes for this persona, to github.com/imthegr8t1, account id 190365500, created on 2 December 2024, with 24 public repositories. GitHub attributes 100 commits signed alenschmitt415@gmail.com, an address browsercookies publishes for this persona, to the login luckymark228312, which no longer resolves.
    github.com/luckymark228312 — Chollima Hunter · under “Mark Santiago” · pulled 2026-09-24

marksantiago0929@gmail.com

email address IT Worker Fraud CURATED

First seen 2025-08-01 · last seen 2026-10-18

Sources

  • The post records the LinkedIn profile as already returning 404 at the time of writing.
    x.com/browsercookies/status/1951099054861197523 — Cookie Connoisseur (@browsercookies) · under “Mark Santiago / MarkSantiago02 / Topcoder415 / LovelyDodger / MitsuruKudo0213 / BTC415” · published 2025-08-01 · pulled 2026-08-30
  • Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it. github.com/marksantiago290 is account id 133281370, created on 11 May 2023, with 100 public repositories. Its noreply addresses name the handles marksantiago02, marksantiago2909, btc415 and its current one, so it is the account browsercookies names as github.com/marksantiago02 under Mark Santiago, renamed; marksantiago02 now returns not found. Its repositories hold 70 commits signed marksantiago0929@gmail.com and 66 signed alenschmitt415@gmail.com, and 42 signed stevenpiao0822@gmail.com, which the same researcher gives for Steven Leal.
    github.com/marksantiago290 — Chollima Hunter · under “Mark Santiago” · pulled 2026-09-24
  • Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 1 commit signed marksantiago0929@gmail.com, an address browsercookies publishes for this persona, to github.com/imthegr8t1, account id 190365500, created on 2 December 2024, with 24 public repositories. GitHub attributes 100 commits signed alenschmitt415@gmail.com, an address browsercookies publishes for this persona, to the login luckymark228312, which no longer resolves.
    github.com/imthegr8t1 — Chollima Hunter · under “Mark Santiago” · pulled 2026-09-24

  • Nearby text:

    …* Same profile photo as BTC415 and luckypenny1632333 * As such, also used by Steven Leal * Telegram: https://t.me/marksantiago02 * Email: marksantiago0929@gmail.com ----------------- ### Steven Leal / Mitsuru Kudo * GitHub 1: https://github.com/steven228312 * GitHub 2:…
    Post-Minions assessment — Kawaii-Jong-UwUn (GitHub research) · under “Mark Limuel Santiago” · published 2025-07-26 · pulled 2026-09-29

marksantiago2909@gmail.com

email address IT Worker Fraud CURATED

First seen 2026-09-29 · last seen 2026-09-29

Source

  • Found on 29 September 2026 by searching GitHub's code for the handles this site already holds for the persona (marksantiago290, marksantiago02) and reading the files that name them: contact blocks, profile READMEs and portfolio data in the persona's own repositories or in repositories that credit its accounts. Each value is cited to the file it was read from. Values in copied templates, client team pages and test data are not carried.
    github.com/marksantiago290/Ethereum-MEV-BOT/blob/db787bfec2aff77f6f572f5d6a5aec4b2abadae9/README.md — Chollima Hunter · under “Mark Santiago” · published 2025-04-09 · pulled 2026-09-29

https://github.com/imthegr8t1

github profile IT Worker Fraud CURATED live checked 2026-09-30

First seen 2026-09-24 · last seen 2026-09-24

Source

  • Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 1 commit signed marksantiago0929@gmail.com, an address browsercookies publishes for this persona, to github.com/imthegr8t1, account id 190365500, created on 2 December 2024, with 24 public repositories. GitHub attributes 100 commits signed alenschmitt415@gmail.com, an address browsercookies publishes for this persona, to the login luckymark228312, which no longer resolves.
    github.com/imthegr8t1 — Chollima Hunter · under “Mark Santiago” · pulled 2026-09-24

https://github.com/luckymark228312

github profile IT Worker Fraud CURATED removed checked 2026-09-30

First seen 2026-09-24 · last seen 2026-09-24

Source

  • Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 1 commit signed marksantiago0929@gmail.com, an address browsercookies publishes for this persona, to github.com/imthegr8t1, account id 190365500, created on 2 December 2024, with 24 public repositories. GitHub attributes 100 commits signed alenschmitt415@gmail.com, an address browsercookies publishes for this persona, to the login luckymark228312, which no longer resolves.
    github.com/luckymark228312 — Chollima Hunter · under “Mark Santiago” · pulled 2026-09-24

https://github.com/marksantiago02

github profile IT Worker Fraud MATCHED IN SOURCE removed checked 2026-09-02

Listed as marksantiago02

First seen 2025-08-01 · last seen 2026-10-18

Sources

  • The post records the LinkedIn profile as already returning 404 at the time of writing.
    x.com/browsercookies/status/1951099054861197523 — Cookie Connoisseur (@browsercookies) · under “Mark Santiago / MarkSantiago02 / Topcoder415 / LovelyDodger / MitsuruKudo0213 / BTC415” · published 2025-08-01 · pulled 2026-08-30
  • …is required to open the .canvas file. ## Cluster of Interest identified on 30 Jul 2025: ### Mark Limuel Santiago * GitHub 1: https://github.com/marksantiago02 * Display Name: MARK * Repo of interest *…
    Post-Minions assessment — Kawaii-Jong-UwUn (GitHub research) · under “Mark Limuel Santiago” · published 2025-07-26 · pulled 2026-09-29

https://github.com/marksantiago290

github profile IT Worker Fraud CURATED live checked 2026-09-30

First seen 2026-09-24 · last seen 2026-09-24

Source

  • Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it. github.com/marksantiago290 is account id 133281370, created on 11 May 2023, with 100 public repositories. Its noreply addresses name the handles marksantiago02, marksantiago2909, btc415 and its current one, so it is the account browsercookies names as github.com/marksantiago02 under Mark Santiago, renamed; marksantiago02 now returns not found. Its repositories hold 70 commits signed marksantiago0929@gmail.com and 66 signed alenschmitt415@gmail.com, and 42 signed stevenpiao0822@gmail.com, which the same researcher gives for Steven Leal.
    github.com/marksantiago290 — Chollima Hunter · under “Mark Santiago” · pulled 2026-09-24

https://t.me/marksantiago02

telegram account IT Worker Fraud CURATED live checked 2026-11-08

Listed as marksantiago02

First seen 2026-09-29 · last seen 2026-10-18

Sources

  • Found on 29 September 2026 by searching GitHub's code for the handles this site already holds for the persona (marksantiago290, marksantiago02) and reading the files that name them: contact blocks, profile READMEs and portfolio data in the persona's own repositories or in repositories that credit its accounts. Each value is cited to the file it was read from. Values in copied templates, client team pages and test data are not carried.
    github.com/marksantiago290/ERC20-Token-Presale/blob/32d81213a2768193c0060851141463a595123c23/components/Footer.tsx — Chollima Hunter · under “Mark Santiago” · published 2025-08-21 · pulled 2026-09-29

  • Nearby text:

    …https://app.daily.dev/alenschmitt * Same profile photo as BTC415 and luckypenny1632333 * As such, also used by Steven Leal * Telegram: https://t.me/marksantiago02 * Email: marksantiago0929@gmail.com ----------------- ### Steven Leal / Mitsuru Kudo * GitHub 1: https://github.com/steven228312 * GitHub…
    Post-Minions assessment — Kawaii-Jong-UwUn (GitHub research) · under “Mark Limuel Santiago” · published 2025-07-26 · pulled 2026-09-29

https://t.me/marksantiago290

telegram account IT Worker Fraud CURATED live checked 2026-11-08

First seen 2026-09-29 · last seen 2026-09-29

Source

  • Found on 29 September 2026 by searching GitHub's code for the handles this site already holds for the persona (marksantiago290, marksantiago02) and reading the files that name them: contact blocks, profile READMEs and portfolio data in the persona's own repositories or in repositories that credit its accounts. Each value is cited to the file it was read from. Values in copied templates, client team pages and test data are not carried.
    github.com/marksantiago290/Ethereum-MEV-BOT/blob/db787bfec2aff77f6f572f5d6a5aec4b2abadae9/README.md — Chollima Hunter · under “Mark Santiago” · published 2025-04-09 · pulled 2026-09-29

https://x.com/marksantiago02

x account IT Worker Fraud RESEARCHER POST

First seen 2025-08-01 · last seen 2025-08-01

Source

  • The post records the LinkedIn profile as already returning 404 at the time of writing.
    x.com/browsercookies/status/1951099054861197523 — Cookie Connoisseur (@browsercookies) · under “Mark Santiago / MarkSantiago02 / Topcoder415 / LovelyDodger / MitsuruKudo0213 / BTC415” · published 2025-08-01 · pulled 2026-08-30

https://x.com/marksantiago290

x account IT Worker Fraud CURATED

First seen 2026-09-29 · last seen 2026-09-29

Source

  • Found on 29 September 2026 by searching GitHub's code for the handles this site already holds for the persona (marksantiago290, marksantiago02) and reading the files that name them: contact blocks, profile READMEs and portfolio data in the persona's own repositories or in repositories that credit its accounts. Each value is cited to the file it was read from. Values in copied templates, client team pages and test data are not carried.
    github.com/marksantiago290/Ethereum-MEV-BOT/blob/db787bfec2aff77f6f572f5d6a5aec4b2abadae9/README.md — Chollima Hunter · under “Mark Santiago” · published 2025-04-09 · pulled 2026-09-29

Sources

Back to all personas

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. Mark Santiago as the name of the operator is the cited researcher’s assertion, repeated here as their claim.