whisdev

Also reported as: taprwhiz

A fabricated professional identity used in the DPRK remote IT-worker scheme. Most of what follows is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, whisdev. The attribution is theirs, not this site's.

The remainder was read by this site from the account itself and is cited to the page and date it was read.

IT Worker Fraud First reported 2025-08-26

Identifiers attributed to this persona

9 indicators the sources below record for this operator, each with its sources.

IndicatorTypeAccount status
https://hub.docker.com/u/whisdev dockerhub account live checked 2026-11-08
jrodacooker.dev domain —
sakelejames@gmail.com email address —
https://github.com/taprwhiz github profile removed checked 2026-09-30
https://github.com/whisdev github profile live checked 2026-09-30
https://medium.com/@sakelejames medium account not checked
https://t.me/snipmaxi telegram account live checked 2026-11-08
https://t.me/whisdev telegram account live checked 2026-11-08
https://x.com/whisdev x account not checked

https://hub.docker.com/u/whisdev

dockerhub account IT Worker Fraud CURATED live checked 2026-11-08

First seen unknown · last seen unknown

Source

  • Found on 17 September 2026 by asking Docker Hub whether an account exists under whisdev, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 18 October 2019. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    hub.docker.com/u/whisdev — Chollima Hunter · under “whisdev” · pulled 2026-09-17

jrodacooker.dev

domain IT Worker Fraud RESEARCHER POST

First seen 2025-08-26 · last seen 2025-08-26

Registration

Registered2025-04-09
RegistrarPDR Ltd. d/b/a PublicDomainRegistry.com
Expires2027-04-09
Last changed2026-03-15
Statusclient transfer prohibited

From the registry’s RDAP record for jrodacooker.dev, looked up 2026-10-05.

Source

  • Transcribed from the researcher's Boris Lee Anderson and Friends chart, whose edges say which account hangs off which; the chart marks the link between this cluster and m4rcu5o's with the words colleagues or alts, without deciding. A contributor to m4rcu5o's personal repository. The chart records the X account identifying itself as taprwhiz in its own posts, and that GitHub account carrying the snipmaxi Telegram handle; the sakelejames address, Medium account and jrodacooker.dev site hang off the X account.
    github.com/Kawaii-Jong-UWUn/ITW-Cluster-Research/tree/main/Boris_Anderson — Kawaii Jong UwUn (@KawaiiJongUwUn) · under “whisdev / taprwhiz” · published 2025-08-26 · pulled 2026-08-30

sakelejames@gmail.com

email address IT Worker Fraud MATCHED IN SOURCE

First seen 2025-08-26 · last seen 2026-11-13

Sources

  • Transcribed from the researcher's Boris Lee Anderson and Friends chart, whose edges say which account hangs off which; the chart marks the link between this cluster and m4rcu5o's with the words colleagues or alts, without deciding. A contributor to m4rcu5o's personal repository. The chart records the X account identifying itself as taprwhiz in its own posts, and that GitHub account carrying the snipmaxi Telegram handle; the sakelejames address, Medium account and jrodacooker.dev site hang off the X account.
    github.com/Kawaii-Jong-UWUn/ITW-Cluster-Research/tree/main/Boris_Anderson — Kawaii Jong UwUn (@KawaiiJongUwUn) · under “whisdev / taprwhiz” · published 2025-08-26 · pulled 2026-08-30
  • …{"id":"8df127efb35e93f4","type":"text","text":"sakelejames@gmail.com","x":3480,"y":-2260,"width":266,"height":51,"color":"4"}, {"id":"ec033839d70ce3c3","type":"text","text":"Linked to numerous other targets…
    HyperBuildX-Continued-Research/HyperBuildX Follow-up.canvas at main · Kawaii-Jong-UWUn/HyperBuildX-Continued-Research · GitHub — Kawaii Jong UwUn (HyperBuildX-Continued-Research) · under “File metadata and controls” · pulled 2026-10-12

https://github.com/taprwhiz

github profile IT Worker Fraud MATCHED IN SOURCE removed checked 2026-09-30

Listed as taprwhiz

First seen 2025-08-26 · last seen 2026-11-13

Sources

  • Transcribed from the researcher's Boris Lee Anderson and Friends chart, whose edges say which account hangs off which; the chart marks the link between this cluster and m4rcu5o's with the words colleagues or alts, without deciding. A contributor to m4rcu5o's personal repository. The chart records the X account identifying itself as taprwhiz in its own posts, and that GitHub account carrying the snipmaxi Telegram handle; the sakelejames address, Medium account and jrodacooker.dev site hang off the X account.
    github.com/Kawaii-Jong-UWUn/ITW-Cluster-Research/tree/main/Boris_Anderson — Kawaii Jong UwUn (@KawaiiJongUwUn) · under “whisdev / taprwhiz” · published 2025-08-26 · pulled 2026-08-30
  • …{"id":"a5dfe7df75edfc9b","type":"link","url":"https://github.com/taprwhiz/","x":2220,"y":-2840,"width":400,"height":400},…
    HyperBuildX-Continued-Research/HyperBuildX Follow-up.canvas at main · Kawaii-Jong-UWUn/HyperBuildX-Continued-Research · GitHub — Kawaii Jong UwUn (HyperBuildX-Continued-Research) · under “File metadata and controls” · pulled 2026-10-12

https://github.com/whisdev

github profile IT Worker Fraud MATCHED IN SOURCE live checked 2026-09-30

Listed as whisdev

First seen 2025-08-26 · last seen 2026-11-13

Sources

  • Transcribed from the researcher's Boris Lee Anderson and Friends chart, whose edges say which account hangs off which; the chart marks the link between this cluster and m4rcu5o's with the words colleagues or alts, without deciding. A contributor to m4rcu5o's personal repository. The chart records the X account identifying itself as taprwhiz in its own posts, and that GitHub account carrying the snipmaxi Telegram handle; the sakelejames address, Medium account and jrodacooker.dev site hang off the X account.
    github.com/Kawaii-Jong-UWUn/ITW-Cluster-Research/tree/main/Boris_Anderson — Kawaii Jong UwUn (@KawaiiJongUwUn) · under “whisdev / taprwhiz” · published 2025-08-26 · pulled 2026-08-30
  • …{"id":"c2a573cf536e9d7e","type":"link","url":"https://github.com/whisdev","x":3821,"y":-2840,"width":400,"height":400},…
    HyperBuildX-Continued-Research/HyperBuildX Follow-up.canvas at main · Kawaii-Jong-UWUn/HyperBuildX-Continued-Research · GitHub — Kawaii Jong UwUn (HyperBuildX-Continued-Research) · under “File metadata and controls” · pulled 2026-10-12

https://medium.com/@sakelejames

medium account IT Worker Fraud MATCHED IN SOURCE

Listed as @sakelejames

First seen 2025-08-26 · last seen 2026-11-13

Sources

  • Transcribed from the researcher's Boris Lee Anderson and Friends chart, whose edges say which account hangs off which; the chart marks the link between this cluster and m4rcu5o's with the words colleagues or alts, without deciding. A contributor to m4rcu5o's personal repository. The chart records the X account identifying itself as taprwhiz in its own posts, and that GitHub account carrying the snipmaxi Telegram handle; the sakelejames address, Medium account and jrodacooker.dev site hang off the X account.
    github.com/Kawaii-Jong-UWUn/ITW-Cluster-Research/tree/main/Boris_Anderson — Kawaii Jong UwUn (@KawaiiJongUwUn) · under “whisdev / taprwhiz” · published 2025-08-26 · pulled 2026-08-30
  • …{"id":"01af939bfac5eb3c","type":"link","url":"https://medium.com/@sakelejames","x":3021,"y":-3640,"width":400,"height":400},…
    HyperBuildX-Continued-Research/HyperBuildX Follow-up.canvas at main · Kawaii-Jong-UWUn/HyperBuildX-Continued-Research · GitHub — Kawaii Jong UwUn (HyperBuildX-Continued-Research) · under “File metadata and controls” · pulled 2026-10-12

https://t.me/snipmaxi

telegram account IT Worker Fraud MATCHED IN SOURCE live checked 2026-11-08

Listed as snipmaxi

First seen 2025-08-26 · last seen 2026-11-13

Sources

  • Transcribed from the researcher's Boris Lee Anderson and Friends chart, whose edges say which account hangs off which; the chart marks the link between this cluster and m4rcu5o's with the words colleagues or alts, without deciding. A contributor to m4rcu5o's personal repository. The chart records the X account identifying itself as taprwhiz in its own posts, and that GitHub account carrying the snipmaxi Telegram handle; the sakelejames address, Medium account and jrodacooker.dev site hang off the X account.
    github.com/Kawaii-Jong-UWUn/ITW-Cluster-Research/tree/main/Boris_Anderson — Kawaii Jong UwUn (@KawaiiJongUwUn) · under “whisdev / taprwhiz” · published 2025-08-26 · pulled 2026-08-30
  • …{"id":"2c291ceee8edfbb1","type":"link","url":"https://t.me/snipmaxi","x":2222,"y":-3640,"width":400,"height":400,"color":"4"},…
    HyperBuildX-Continued-Research/HyperBuildX Follow-up.canvas at main · Kawaii-Jong-UWUn/HyperBuildX-Continued-Research · GitHub — Kawaii Jong UwUn (HyperBuildX-Continued-Research) · under “File metadata and controls” · pulled 2026-10-12

https://t.me/whisdev

telegram account IT Worker Fraud MATCHED IN SOURCE live checked 2026-11-08

Listed as whisdev

First seen 2025-08-26 · last seen 2026-11-13

Sources

  • Transcribed from the researcher's Boris Lee Anderson and Friends chart, whose edges say which account hangs off which; the chart marks the link between this cluster and m4rcu5o's with the words colleagues or alts, without deciding. A contributor to m4rcu5o's personal repository. The chart records the X account identifying itself as taprwhiz in its own posts, and that GitHub account carrying the snipmaxi Telegram handle; the sakelejames address, Medium account and jrodacooker.dev site hang off the X account.
    github.com/Kawaii-Jong-UWUn/ITW-Cluster-Research/tree/main/Boris_Anderson — Kawaii Jong UwUn (@KawaiiJongUwUn) · under “whisdev / taprwhiz” · published 2025-08-26 · pulled 2026-08-30
  • …{"id":"83e9e992f2c38f39","type":"link","url":"https://t.me/whisdev","x":2220,"y":-2040,"width":400,"height":400},…
    HyperBuildX-Continued-Research/HyperBuildX Follow-up.canvas at main · Kawaii-Jong-UWUn/HyperBuildX-Continued-Research · GitHub — Kawaii Jong UwUn (HyperBuildX-Continued-Research) · under “File metadata and controls” · pulled 2026-10-12

https://x.com/whisdev

x account IT Worker Fraud RESEARCHER POST

First seen 2025-08-26 · last seen 2025-08-26

Source

  • Transcribed from the researcher's Boris Lee Anderson and Friends chart, whose edges say which account hangs off which; the chart marks the link between this cluster and m4rcu5o's with the words colleagues or alts, without deciding. A contributor to m4rcu5o's personal repository. The chart records the X account identifying itself as taprwhiz in its own posts, and that GitHub account carrying the snipmaxi Telegram handle; the sakelejames address, Medium account and jrodacooker.dev site hang off the X account.
    github.com/Kawaii-Jong-UWUn/ITW-Cluster-Research/tree/main/Boris_Anderson — Kawaii Jong UwUn (@KawaiiJongUwUn) · under “whisdev / taprwhiz” · published 2025-08-26 · pulled 2026-08-30

Sources

Back to all personas

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. whisdev as the name of the operator is the cited researcher’s assertion, repeated here as their claim.