Chollima Hunter

← All personas

Michael Liu Liang

Also reported as: Joseph JacksonMichael Liang

A fabricated professional identity used in the DPRK remote IT-worker scheme. Most of what follows is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, Michael Liu Liang. The attribution is theirs, not this site's.

The remainder was read by this site from the account itself and is cited to the page and date it was read.

IT Worker Fraud First reported 2025-08-09 · last reported 2026-09-28

LinkedIn accounts

Identifiers reported alongside

18 indicators the sources below record for this operator, each with its sources.

IndicatorTypeAccount status
Joseph Jackson alias —
Michael Liang alias —
Michael Liu Liang alias —
https://dev.to/michael_liang_0208 devto account live checked 2026-11-08
https://hub.docker.com/u/phoenixfeather0208 dockerhub account live checked 2026-11-08
josephjackson0811@gmail.com email address —
phoenixfeather0208@gmail.com email address —
https://github.com/0phoenixfeather0208 github profile live checked 2026-09-30
https://github.com/dreamwork999 github profile live checked 2026-09-30
https://github.com/phoenixfeather0208 github profile live checked 2026-09-30
joseph-jackson.vercel.app hosted site —
liu-liang.vercel.app hosted site —
michael-liang.vercel.app hosted site —
https://huggingface.co/phoenixfeather0208 huggingface account live checked 2026-11-08
https://medium.com/@joseph.jackson0811 medium account not checked
+12098132524 phone number —
https://stackoverflow.com/users/20008661 stackoverflow account not checked
https://t.me/phoenixfeather0208 telegram account live checked 2026-11-08

Joseph Jackson

alias IT Worker Fraud RESEARCHER POST

First seen 2025-08-09 · last seen 2025-08-09

Source

  • Two persona names on one set of accounts: portfolios under both Michael Liang and Joseph Jackson point at the same phoenixfeather0208 handle across GitHub, Telegram, Bluesky, Mastodon and Substack. Transcribed from the researcher's chart, which groups every account under the name it gives here and draws its links from mutual follows, shared contact details and repositories carrying one another's details. Accounts on platforms this site does not index, as the chart lists them: github.com/0phoenixfeather0208/resume, bsky.app/profile/phoenixfeather0208.bsky.social, substack.com/@phoenixfeather0208, mastodon.social/@phoenixfeather0208, forem.com/michael_liang_0208.
    github.com/Kawaii-Jong-UWUn/ITW-Cluster-Research/tree/main/EliteCoder — Kawaii Jong UwUn (@KawaiiJongUwUn) · under “Michael Liu Liang / Joseph Jackson / Michael Liang” · published 2025-08-09 · pulled 2026-08-30

Michael Liang

alias IT Worker Fraud RESEARCHER POST

First seen 2025-08-09 · last seen 2025-08-09

Source

  • Two persona names on one set of accounts: portfolios under both Michael Liang and Joseph Jackson point at the same phoenixfeather0208 handle across GitHub, Telegram, Bluesky, Mastodon and Substack. Transcribed from the researcher's chart, which groups every account under the name it gives here and draws its links from mutual follows, shared contact details and repositories carrying one another's details. Accounts on platforms this site does not index, as the chart lists them: github.com/0phoenixfeather0208/resume, bsky.app/profile/phoenixfeather0208.bsky.social, substack.com/@phoenixfeather0208, mastodon.social/@phoenixfeather0208, forem.com/michael_liang_0208.
    github.com/Kawaii-Jong-UWUn/ITW-Cluster-Research/tree/main/EliteCoder — Kawaii Jong UwUn (@KawaiiJongUwUn) · under “Michael Liu Liang / Joseph Jackson / Michael Liang” · published 2025-08-09 · pulled 2026-08-30

Michael Liu Liang

alias IT Worker Fraud CURATED

First seen 2025-08-09 · last seen 2026-09-28

Sources

  • Two persona names on one set of accounts: portfolios under both Michael Liang and Joseph Jackson point at the same phoenixfeather0208 handle across GitHub, Telegram, Bluesky, Mastodon and Substack. Transcribed from the researcher's chart, which groups every account under the name it gives here and draws its links from mutual follows, shared contact details and repositories carrying one another's details. Accounts on platforms this site does not index, as the chart lists them: github.com/0phoenixfeather0208/resume, bsky.app/profile/phoenixfeather0208.bsky.social, substack.com/@phoenixfeather0208, mastodon.social/@phoenixfeather0208, forem.com/michael_liang_0208.
    github.com/Kawaii-Jong-UWUn/ITW-Cluster-Research/tree/main/EliteCoder — Kawaii Jong UwUn (@KawaiiJongUwUn) · under “Michael Liu Liang / Joseph Jackson / Michael Liang” · published 2025-08-09 · pulled 2026-08-30
  • Found on 13 September 2026 by probing every account handle this site already holds for this operator against dev.to, and read from the profile's own public API. An account exists under michael_liang_0208, a login the index already carries for this persona on another platform. It gives a joined date of May 7, 2025. It displays "Michael Liang", a display name rather than a person's name. The profile links a GitHub account, phoenixfeather0208. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    dev.to/michael_liang_0208 — Chollima Hunter · under “Michael Liu Liang” · pulled 2026-09-13
  • Found on 17 September 2026 by asking Docker Hub whether an account exists under phoenixfeather0208, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 20 July 2026. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    hub.docker.com/u/phoenixfeather0208 — Chollima Hunter · under “Michael Liu Liang” · pulled 2026-09-17
  • Found on 17 September 2026 by asking Hugging Face whether an account exists under phoenixfeather0208, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a display name of Liu Liang. The display name is kept here rather than as an alias, because it restates the handle, describes the work, or repeats what this operator is already called. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    huggingface.co/phoenixfeather0208 — Chollima Hunter · under “Michael Liu Liang” · pulled 2026-09-17
  • Read on 28 September 2026 from the site's own page and the script bundles it loads. The Joseph Jackson portfolio, which gives josephjackson0811@gmail.com as its address, lists a phone number and links a LinkedIn profile, a GitHub account and a Stack Overflow profile, the last two under the name Daniel Jin with the same 0811 suffix.
    joseph-jackson.vercel.app/ https://joseph-jackson.vercel.app/ not linked — Chollima Hunter · under “Michael Liu Liang” · pulled 2026-09-28

https://dev.to/michael_liang_0208

devto account IT Worker Fraud CURATED live checked 2026-11-08

First seen 2025-08-09 · last seen 2025-08-09

Sources

  • Two persona names on one set of accounts: portfolios under both Michael Liang and Joseph Jackson point at the same phoenixfeather0208 handle across GitHub, Telegram, Bluesky, Mastodon and Substack. Transcribed from the researcher's chart, which groups every account under the name it gives here and draws its links from mutual follows, shared contact details and repositories carrying one another's details. Accounts on platforms this site does not index, as the chart lists them: github.com/0phoenixfeather0208/resume, bsky.app/profile/phoenixfeather0208.bsky.social, substack.com/@phoenixfeather0208, mastodon.social/@phoenixfeather0208, forem.com/michael_liang_0208.
    github.com/Kawaii-Jong-UWUn/ITW-Cluster-Research/tree/main/EliteCoder — Kawaii Jong UwUn (@KawaiiJongUwUn) · under “Michael Liu Liang / Joseph Jackson / Michael Liang” · published 2025-08-09 · pulled 2026-08-30
  • Found on 13 September 2026 by probing every account handle this site already holds for this operator against dev.to, and read from the profile's own public API. An account exists under michael_liang_0208, a login the index already carries for this persona on another platform. It gives a joined date of May 7, 2025. It displays "Michael Liang", a display name rather than a person's name. The profile links a GitHub account, phoenixfeather0208. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    dev.to/michael_liang_0208 — Chollima Hunter · under “Michael Liu Liang” · pulled 2026-09-13

https://hub.docker.com/u/phoenixfeather0208

dockerhub account IT Worker Fraud CURATED live checked 2026-11-08

First seen unknown · last seen unknown

Source

  • Found on 17 September 2026 by asking Docker Hub whether an account exists under phoenixfeather0208, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 20 July 2026. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    hub.docker.com/u/phoenixfeather0208 — Chollima Hunter · under “Michael Liu Liang” · pulled 2026-09-17

josephjackson0811@gmail.com

email address IT Worker Fraud RESEARCHER POST

First seen 2025-08-09 · last seen 2025-08-09

Source

  • Two persona names on one set of accounts: portfolios under both Michael Liang and Joseph Jackson point at the same phoenixfeather0208 handle across GitHub, Telegram, Bluesky, Mastodon and Substack. Transcribed from the researcher's chart, which groups every account under the name it gives here and draws its links from mutual follows, shared contact details and repositories carrying one another's details. Accounts on platforms this site does not index, as the chart lists them: github.com/0phoenixfeather0208/resume, bsky.app/profile/phoenixfeather0208.bsky.social, substack.com/@phoenixfeather0208, mastodon.social/@phoenixfeather0208, forem.com/michael_liang_0208.
    github.com/Kawaii-Jong-UWUn/ITW-Cluster-Research/tree/main/EliteCoder — Kawaii Jong UwUn (@KawaiiJongUwUn) · under “Michael Liu Liang / Joseph Jackson / Michael Liang” · published 2025-08-09 · pulled 2026-08-30

phoenixfeather0208@gmail.com

email address IT Worker Fraud RESEARCHER POST

First seen 2025-08-09 · last seen 2025-08-09

Source

  • Two persona names on one set of accounts: portfolios under both Michael Liang and Joseph Jackson point at the same phoenixfeather0208 handle across GitHub, Telegram, Bluesky, Mastodon and Substack. Transcribed from the researcher's chart, which groups every account under the name it gives here and draws its links from mutual follows, shared contact details and repositories carrying one another's details. Accounts on platforms this site does not index, as the chart lists them: github.com/0phoenixfeather0208/resume, bsky.app/profile/phoenixfeather0208.bsky.social, substack.com/@phoenixfeather0208, mastodon.social/@phoenixfeather0208, forem.com/michael_liang_0208.
    github.com/Kawaii-Jong-UWUn/ITW-Cluster-Research/tree/main/EliteCoder — Kawaii Jong UwUn (@KawaiiJongUwUn) · under “Michael Liu Liang / Joseph Jackson / Michael Liang” · published 2025-08-09 · pulled 2026-08-30

https://github.com/0phoenixfeather0208

github profile IT Worker Fraud RESEARCHER POST live checked 2026-09-30

First seen 2025-08-09 · last seen 2025-08-09

Source

  • Two persona names on one set of accounts: portfolios under both Michael Liang and Joseph Jackson point at the same phoenixfeather0208 handle across GitHub, Telegram, Bluesky, Mastodon and Substack. Transcribed from the researcher's chart, which groups every account under the name it gives here and draws its links from mutual follows, shared contact details and repositories carrying one another's details. Accounts on platforms this site does not index, as the chart lists them: github.com/0phoenixfeather0208/resume, bsky.app/profile/phoenixfeather0208.bsky.social, substack.com/@phoenixfeather0208, mastodon.social/@phoenixfeather0208, forem.com/michael_liang_0208.
    github.com/Kawaii-Jong-UWUn/ITW-Cluster-Research/tree/main/EliteCoder — Kawaii Jong UwUn (@KawaiiJongUwUn) · under “Michael Liu Liang / Joseph Jackson / Michael Liang” · published 2025-08-09 · pulled 2026-08-30

https://github.com/dreamwork999

github profile IT Worker Fraud CURATED live checked 2026-09-30

First seen 2026-09-28 · last seen 2026-09-28

Source

  • Read on 28 September 2026 from the site's own page and the script bundles it loads. The Joseph Jackson portfolio, which gives josephjackson0811@gmail.com as its address, lists a phone number and links a LinkedIn profile, a GitHub account and a Stack Overflow profile, the last two under the name Daniel Jin with the same 0811 suffix.
    joseph-jackson.vercel.app/ https://joseph-jackson.vercel.app/ not linked — Chollima Hunter · under “Michael Liu Liang” · pulled 2026-09-28

https://github.com/phoenixfeather0208

github profile IT Worker Fraud RESEARCHER POST live checked 2026-09-30

First seen 2025-08-09 · last seen 2025-08-09

Source

  • Two persona names on one set of accounts: portfolios under both Michael Liang and Joseph Jackson point at the same phoenixfeather0208 handle across GitHub, Telegram, Bluesky, Mastodon and Substack. Transcribed from the researcher's chart, which groups every account under the name it gives here and draws its links from mutual follows, shared contact details and repositories carrying one another's details. Accounts on platforms this site does not index, as the chart lists them: github.com/0phoenixfeather0208/resume, bsky.app/profile/phoenixfeather0208.bsky.social, substack.com/@phoenixfeather0208, mastodon.social/@phoenixfeather0208, forem.com/michael_liang_0208.
    github.com/Kawaii-Jong-UWUn/ITW-Cluster-Research/tree/main/EliteCoder — Kawaii Jong UwUn (@KawaiiJongUwUn) · under “Michael Liu Liang / Joseph Jackson / Michael Liang” · published 2025-08-09 · pulled 2026-08-30

joseph-jackson.vercel.app

hosted site IT Worker Fraud RESEARCHER POST

First seen 2025-08-09 · last seen 2025-08-09

Source

  • Two persona names on one set of accounts: portfolios under both Michael Liang and Joseph Jackson point at the same phoenixfeather0208 handle across GitHub, Telegram, Bluesky, Mastodon and Substack. Transcribed from the researcher's chart, which groups every account under the name it gives here and draws its links from mutual follows, shared contact details and repositories carrying one another's details. Accounts on platforms this site does not index, as the chart lists them: github.com/0phoenixfeather0208/resume, bsky.app/profile/phoenixfeather0208.bsky.social, substack.com/@phoenixfeather0208, mastodon.social/@phoenixfeather0208, forem.com/michael_liang_0208.
    github.com/Kawaii-Jong-UWUn/ITW-Cluster-Research/tree/main/EliteCoder — Kawaii Jong UwUn (@KawaiiJongUwUn) · under “Michael Liu Liang / Joseph Jackson / Michael Liang” · published 2025-08-09 · pulled 2026-08-30

liu-liang.vercel.app

hosted site IT Worker Fraud RESEARCHER POST

First seen 2025-08-09 · last seen 2025-08-09

Source

  • Two persona names on one set of accounts: portfolios under both Michael Liang and Joseph Jackson point at the same phoenixfeather0208 handle across GitHub, Telegram, Bluesky, Mastodon and Substack. Transcribed from the researcher's chart, which groups every account under the name it gives here and draws its links from mutual follows, shared contact details and repositories carrying one another's details. Accounts on platforms this site does not index, as the chart lists them: github.com/0phoenixfeather0208/resume, bsky.app/profile/phoenixfeather0208.bsky.social, substack.com/@phoenixfeather0208, mastodon.social/@phoenixfeather0208, forem.com/michael_liang_0208.
    github.com/Kawaii-Jong-UWUn/ITW-Cluster-Research/tree/main/EliteCoder — Kawaii Jong UwUn (@KawaiiJongUwUn) · under “Michael Liu Liang / Joseph Jackson / Michael Liang” · published 2025-08-09 · pulled 2026-08-30

michael-liang.vercel.app

hosted site IT Worker Fraud RESEARCHER POST

First seen 2025-08-09 · last seen 2025-08-09

Source

  • Two persona names on one set of accounts: portfolios under both Michael Liang and Joseph Jackson point at the same phoenixfeather0208 handle across GitHub, Telegram, Bluesky, Mastodon and Substack. Transcribed from the researcher's chart, which groups every account under the name it gives here and draws its links from mutual follows, shared contact details and repositories carrying one another's details. Accounts on platforms this site does not index, as the chart lists them: github.com/0phoenixfeather0208/resume, bsky.app/profile/phoenixfeather0208.bsky.social, substack.com/@phoenixfeather0208, mastodon.social/@phoenixfeather0208, forem.com/michael_liang_0208.
    github.com/Kawaii-Jong-UWUn/ITW-Cluster-Research/tree/main/EliteCoder — Kawaii Jong UwUn (@KawaiiJongUwUn) · under “Michael Liu Liang / Joseph Jackson / Michael Liang” · published 2025-08-09 · pulled 2026-08-30

https://huggingface.co/phoenixfeather0208

huggingface account IT Worker Fraud CURATED live checked 2026-11-08

First seen unknown · last seen unknown

Source

  • Found on 17 September 2026 by asking Hugging Face whether an account exists under phoenixfeather0208, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a display name of Liu Liang. The display name is kept here rather than as an alias, because it restates the handle, describes the work, or repeats what this operator is already called. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    huggingface.co/phoenixfeather0208 — Chollima Hunter · under “Michael Liu Liang” · pulled 2026-09-17

https://medium.com/@joseph.jackson0811

medium account IT Worker Fraud RESEARCHER POST

First seen 2025-08-09 · last seen 2025-08-09

Source

  • Two persona names on one set of accounts: portfolios under both Michael Liang and Joseph Jackson point at the same phoenixfeather0208 handle across GitHub, Telegram, Bluesky, Mastodon and Substack. Transcribed from the researcher's chart, which groups every account under the name it gives here and draws its links from mutual follows, shared contact details and repositories carrying one another's details. Accounts on platforms this site does not index, as the chart lists them: github.com/0phoenixfeather0208/resume, bsky.app/profile/phoenixfeather0208.bsky.social, substack.com/@phoenixfeather0208, mastodon.social/@phoenixfeather0208, forem.com/michael_liang_0208.
    github.com/Kawaii-Jong-UWUn/ITW-Cluster-Research/tree/main/EliteCoder — Kawaii Jong UwUn (@KawaiiJongUwUn) · under “Michael Liu Liang / Joseph Jackson / Michael Liang” · published 2025-08-09 · pulled 2026-08-30

+12098132524

phone number IT Worker Fraud CURATED

First seen 2026-09-28 · last seen 2026-09-28

Line type

Line typeVoIP
CarrierSKYPE COMMUNICATIONS
Rate centreANGELS CAMP, CA

phonevalidator.com labels the line LANDLINE while naming Skype Communications as the carrier in the same row. The carrier is an interconnected VoIP provider, which is what the classification here follows.

Looked up 2026-09-30 at phonevalidator.com. This is a lookup of the line itself. A VoIP line is not evidence on its own.

Source

  • Read on 28 September 2026 from the site's own page and the script bundles it loads. The Joseph Jackson portfolio, which gives josephjackson0811@gmail.com as its address, lists a phone number and links a LinkedIn profile, a GitHub account and a Stack Overflow profile, the last two under the name Daniel Jin with the same 0811 suffix.
    joseph-jackson.vercel.app/ https://joseph-jackson.vercel.app/ not linked — Chollima Hunter · under “Michael Liu Liang” · pulled 2026-09-28

https://stackoverflow.com/users/20008661

stackoverflow account IT Worker Fraud CURATED

First seen 2026-09-28 · last seen 2026-09-28

Source

  • Read on 28 September 2026 from the site's own page and the script bundles it loads. The Joseph Jackson portfolio, which gives josephjackson0811@gmail.com as its address, lists a phone number and links a LinkedIn profile, a GitHub account and a Stack Overflow profile, the last two under the name Daniel Jin with the same 0811 suffix.
    joseph-jackson.vercel.app/ https://joseph-jackson.vercel.app/ not linked — Chollima Hunter · under “Michael Liu Liang” · pulled 2026-09-28

https://t.me/phoenixfeather0208

telegram account IT Worker Fraud RESEARCHER POST live checked 2026-11-08

First seen 2025-08-09 · last seen 2025-08-09

Source

  • Two persona names on one set of accounts: portfolios under both Michael Liang and Joseph Jackson point at the same phoenixfeather0208 handle across GitHub, Telegram, Bluesky, Mastodon and Substack. Transcribed from the researcher's chart, which groups every account under the name it gives here and draws its links from mutual follows, shared contact details and repositories carrying one another's details. Accounts on platforms this site does not index, as the chart lists them: github.com/0phoenixfeather0208/resume, bsky.app/profile/phoenixfeather0208.bsky.social, substack.com/@phoenixfeather0208, mastodon.social/@phoenixfeather0208, forem.com/michael_liang_0208.
    github.com/Kawaii-Jong-UWUn/ITW-Cluster-Research/tree/main/EliteCoder — Kawaii Jong UwUn (@KawaiiJongUwUn) · under “Michael Liu Liang / Joseph Jackson / Michael Liang” · published 2025-08-09 · pulled 2026-08-30

Sources

Back to all personas

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. Michael Liu Liang as the name of the operator is the cited researcher’s assertion, repeated here as their claim.