widespace344712
A fabricated professional identity used in the DPRK remote IT-worker scheme. Most of what follows is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, widespace344712. The attribution is theirs, not this site's.
The remainder was read by this site from the account itself and is cited to the page and date it was read.
The profile picture the researcher published beside this address.
Identifiers attributed to this persona
2 indicators the sources below record for this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
widespace344712@gmail.com |
email address | |
https://github.com/redbird1218 |
github profile | live |
widespace344712@gmail.com
email address IT Worker Fraud CURATED
Sources
-
Published on 17 May 2025 in a thread the researcher opened with "Lets play a profile picture game! Here are a few fun DPRK ITW/remote worker profile pics and their associated emails." Each post in it pairs one address with the profile photograph used alongside it. This entry is one such post: the address widespace344712@gmail.com and the picture below it. The photograph is mirrored here because these posts are the only published record of the face an operator presented, and the accounts they came from are routinely deleted. It is not evidence of who operates the address: a profile picture in this dataset is as likely to be generated, stock, or taken from an uninvolved person. The researcher gives no name, and the address does not read as one, so the page is filed under the address’s own local part rather than under a name invented for it.
x.com/browsercookies/status/1923881142069100776 — Cookie Connoisseur (@browsercookies) -
Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 25 commits signed widespace344712@gmail.com, an address browsercookies publishes for this persona, to github.com/redbird1218, account id 130370137, created on 10 April 2023, with 10 public repositories.
github.com/redbird1218 — Chollima Hunter -
…@gmail.com wesleykeithfordev@gmail.com wev.dev.up@gmail.com whaydigital@gmail.com wheat.country.fb12a8@gizmotik.com whitecrow0109@gmail.com widespace344712@gmail.com wil.mok.86@gmail.com wilbert.lee1205@gmail.com wilfredogahit0821@gmail.com wiliwork1103@gmail.com william.greene0622@gmail.com william0803s…
Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File
https://github.com/redbird1218
github profile IT Worker Fraud CURATED live
live
Source
-
Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 25 commits signed widespace344712@gmail.com, an address browsercookies publishes for this persona, to github.com/redbird1218, account id 130370137, created on 10 April 2023, with 10 public repositories.
github.com/redbird1218 — Chollima Hunter
Sources
- Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File
- x.com/browsercookies/status/1923881142069100776 — Cookie Connoisseur (@browsercookies)
- github.com/redbird1218 — Chollima Hunter