webninja16@gmail.com
webninja16@gmail.com is an email address
that 2 published sources report
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Lazarus Group DPRK IT-Worker Registry (lazarus.group) and Chollima Hunter.
The reports are dated 2026-09-24.
The reporting files it under the persona Danny Jin, alongside 8 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.
email address IT Worker Fraud CURATED
Sources
-
Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
lazarus.group/team/danny-jin — Lazarus Group DPRK IT-Worker Registry (lazarus.group) -
Found on 24 September 2026 by searching GitHub's commit index for every personal address the lazarus.group registry and the ZEUS-DEV-919 working document give for a persona, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so former handles below are a matter of record. github.com/ssmith542 is account id 48925763, created on 25 March 2019. Of the 100 commits GitHub's search returns for it, 31 are signed dannyjin117@gmail.com and 6 as5179000@gmail.com, and 56 are signed with its own noreply address under the former handles dansofter and webninja1992; a further six commits in its repositories are signed webninja16@gmail.com. lazarus.group gives all three of those mailboxes for Danny Jin. The commits carry the author names Danny, danny-biztree, topdev17 and dansofter, and are made on the day each repository is created.
github.com/ssmith542 — Chollima Hunter
Find this indicator in the index, or see every email address this site holds under Email addresses in the browse listing.