`melonman913@gmail.com`

melonman913@gmail.com is an email address that 4 published sources report in connection with IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from Lazarus Group DPRK IT-Worker Registry (lazarus.group) and tayvano (lazarus-bluenoroff-research). The earliest of those reports is dated 2026-08-30 and the most recent 2026-10-18.

email address IT Worker Fraud MATCHED IN SOURCE

Listed under Janul Azwan, Chai Somsri, Jannik Villostas.

First seen 2026-08-30 · last seen 2026-10-18

Sources

Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/chai-somsri — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Chai Somsri / ChaiSomsri96 / George Capraroiu / george19871205” · pulled 2026-09-09
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/jannik-villostas — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Jannik Villostas / 0xtomoon / mrcontract17877 / Henry Amin / gonzalodecruz / shoyano / vaccode365” · pulled 2026-09-09
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/janul-azwan — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Janul Azwan / 0xtomoon / ethprotector” · pulled 2026-09-09
Nearby text:

…0x94A8518B76A3c45F5387B521695024379d43d715 - ![](./lucas-wong.jpg) #### Jannik Villostas - 2025 - 0xtomoon - mrcontract17877 - melonman913@gmail.com - github.com/0xtomoon • [Archive](https://web.archive.org/web/20250516070156/https://github.com/0xtomoon) - x.com/mrcontract17877 -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “Jannik Villostas” · published 2025-06-19 · pulled 2026-08-30

Find this indicator in the index, or see every email address this site holds under Email addresses in the browse listing.

Related indicators

Same persona record: Janul Azwan

Other identifiers the reporting files under the same persona; 4 of 6 are shown.

All 6 on the Janul Azwan page

Same persona record: Chai Somsri

Other identifiers the reporting files under the same persona; 4 of 11 are shown.

All 11 on the Chai Somsri page

Cited by the same report: lazarus.group/team/chai-somsri

Lazarus Group DPRK IT-Worker Registry (lazarus.group) lists 10 other indicators in this source. 2 are shown, chosen across types.

All 11 indicators from this source

Cited by the same report: lazarus.group/team/jannik-villostas

Lazarus Group DPRK IT-Worker Registry (lazarus.group) lists 8 other indicators in this source. 1 are shown, chosen across types.

All 9 indicators from this source

Cited by the same report: lazarus.group/team/janul-azwan

Lazarus Group DPRK IT-Worker Registry (lazarus.group) lists 5 other indicators in this source. 1 are shown, chosen across types.

All 6 indicators from this source