spearbig1021
A fabricated professional identity used in the DPRK remote IT-worker scheme. Most of what follows is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, spearbig1021. The attribution is theirs, not this site's.
The remainder was read by this site from the account itself and is cited to the page and date it was read.
The profile picture the researcher published beside this address.
Identifiers attributed to this persona
2 indicators the sources below record for this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
spearbig1021@gmail.com |
email address | |
https://github.com/sharpspear |
github profile | removed |
spearbig1021@gmail.com
email address IT Worker Fraud CURATED
Sources
-
Published on 17 May 2025 in a thread the researcher opened with "Lets play a profile picture game! Here are a few fun DPRK ITW/remote worker profile pics and their associated emails." Each post in it pairs one address with the profile photograph used alongside it. This entry is one such post: the address spearbig1021@gmail.com and the picture below it. The photograph is mirrored here because these posts are the only published record of the face an operator presented, and the accounts they came from are routinely deleted. It is not evidence of who operates the address: a profile picture in this dataset is as likely to be generated, stock, or taken from an uninvolved person. The researcher gives no name, and the address does not read as one, so the page is filed under the address’s own local part rather than under a name invented for it.
x.com/browsercookies/status/1923880673989087648 — Cookie Connoisseur (@browsercookies) -
Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 22 commits signed spearbig1021@gmail.com, an address browsercookies publishes for this persona, to the login SharpSpear, which no longer resolves.
github.com/SharpSpear — Chollima Hunter -
….com snowscape226@gmail.com sofihuk3@gmail.com softangel0080@gmail.com softmax0112@gmail.com solomiiahuliak@gmail.com sonjerry909@gmail.com spearbig1021@gmail.com speedoandy1004@gmail.com spencerbob2001@gmail.com spoemklpo23er@gmail.com sprysoul0908@gmail.com srwj.strong@gmail.com sse.calebmartin.roya…
Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File
https://github.com/sharpspear
github profile IT Worker Fraud CURATED removed
removed
Source
-
Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 22 commits signed spearbig1021@gmail.com, an address browsercookies publishes for this persona, to the login SharpSpear, which no longer resolves.
github.com/SharpSpear — Chollima Hunter
Sources
- Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File
- x.com/browsercookies/status/1923880673989087648 — Cookie Connoisseur (@browsercookies)
- github.com/SharpSpear — Chollima Hunter