Inappropriate GitHub Solicitation

Posted: Saturday, April 4, 2026 at 09:24 AM | Categories: Miscellaneous, Phishing

I received a few emails like the following recently:

From: James Ferry <ferry.j@worldtechglobal.site>
Date: April 2, 2026 at 11:54:58 AM EDT
To: john@johnwargo.com
Subject: Saw your profile – quick intro
Reply-To: topcodebeast53@gmail.com
Hi John M. Wargo,

I came across your GitHub profile (https://github.com/johnwargo) and see you're based in the US.

I'm James, from the Philippines—over 10 years in software development. Salary levels here don't match the 
US market, so I'm focused on a long-term partnership with someone in the US, not a one-off.

Our collaboration model:

- I apply to US roles using your professional profile (you're the face of the engagement).
- You attend interviews; I provide full prep and technical backup so you're ready.
- Once a role is secured, I handle delivery; you stay in the loop and in control.
- Revenue is shared on a clear, agreed structure—fair and transparent.

The aim is something that scales: a few solid contracts can become steady income and a real partnership. No scam, 
no risk to you—I'm happy to share references or jump on a short call before we commit.

Reply if you're open to exploring a long-term collaboration.

Best regards,
James

I originally didn't think it was a scam, mostly because the only option for me is to reply to the email. It just seemed like a very inappropriate 'business' proposition. If this wasn't some sort of scam message, I can't think of any reason why a GitHub user with enough public work to have a reputation would ever, even consider participating in this kind of scam. I certainly wouldn't. If the GitHub user didn't have any sort of reputation, then this approach wouldn't work either. This just doesn't make sense.

But, then I started really looking at the message and noticed a couple of things.

First of all, the replyto address (topcodebeast53@gmail.com) doesn't match the sender's email address (ferry.j@worldtechglobal.site). That seems weird to me, if this person really wanted to do a scam consulting gig through me (not that I ever would), why wouldn't the replyto address not be the same as the sender's? And, if this really was from a business, why would the replyto be a gmail address?

Next, I checked out the worldtechglobal dot site, well, um site. It doesn't exist. Now, it's possible, but not likely that the domain's used solely for email, but if I worked for a reputable company, why wouldn't there be a web presence associated with the email domain?

Anyway, I'm not responding to the email and I've blocked the sender address. You should stay away from this on in my opinion.

Previous Post: Eleventy Generate Posts Utility Updates

Header image: Photo by Marcos Paulo Prado on Unsplash