Daniel Salo

Daniel Salo

alias IT Worker Fraud CURATED

First seen 2025-07-01 · last seen 2025-07-01

Source

• As printed:

  Daniel Salo Blockchain & Web3 Engineer dsalo0915@gmail.com …

  Read on 21 September 2026 from a listing on the pipu.cc marketplace whose product description is this curriculum vitae, one of 1,882 such listings posted between 26 June and 2 July 2025 from seller accounts named after each CV's subject. The listing carries a photograph as its product image; it is the same photograph four other listings in the set carry under four other names, so it is not shown here and is not evidence of anyone's face. What ties this listing to the index is the GitHub account printed on the CV, princecharming0115, read directly on 21 September 2026. The account was created in October 2022 and holds 25 repositories. Its own commits are signed coolprince0115@gmail.com 491 times and, once, on the repository it created most recently, dsalo0915@gmail.com, the address the CV gives. Two of its repositories, exoid-did-wallet-backend and did-wallet-verifier-widget, hold 44 commits by a second account, arturdranhoi, signed artur.dranhoi@exiod.io and artur.dranhoi@exoid.io, beside commits by a developer at Exoid, the company whose product they are; the CV describes that product, a decentralised-identity wallet with zero-knowledge proofs built for a DIFC Court notarisation project, as this persona's own work. The lazarus.group registry lists coolprince0115@gmail.com and artur.dranhoi@exiod.io under one operator it names Oleksandr Muravskyi, alias Artur Dranhoi, alias PrinceCharming0115, with no published methodology; the commit metadata read here ties those two addresses and the CV's own to one GitHub account first-hand, which is the corroboration the registry entry lacked, and adds the name, address and telephone number this CV presents under. The registry's remaining two addresses are not repeated here because nothing read first-hand reaches them. The telephone number is printed on the CV as shown and is too short to be a complete Finnish mobile number. A CV in this set may be a real person's stolen document, so the name on it, and the employers and schools it lists, may belong to someone with no part in the operation.

  pipu.cc/en/item_detail.php?item_id=4625 — Chollima Hunter · under “Daniel Salo” · published 2025-07-01 · pulled 2026-09-21

artur.dranhoi@exiod.io

email address IT Worker Fraud CURATED

Also listed under Oleksandr Muravskyi — this value’s page names all of them.

First seen 2026-08-30 · last seen 2026-10-18

Sources

• Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.

  lazarus.group/team/oleksandr-muravskyi — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Oleksandr Muravskyi / Artur Dranhoi / oleksandr-muravskyi / PrinceCharming0115” · pulled 2026-09-09

• Read on 21 September 2026 from a listing on the pipu.cc marketplace whose product description is this curriculum vitae, one of 1,882 such listings posted between 26 June and 2 July 2025 from seller accounts named after each CV's subject. The listing carries a photograph as its product image; it is the same photograph four other listings in the set carry under four other names, so it is not shown here and is not evidence of anyone's face. What ties this listing to the index is the GitHub account printed on the CV, princecharming0115, read directly on 21 September 2026. The account was created in October 2022 and holds 25 repositories. Its own commits are signed coolprince0115@gmail.com 491 times and, once, on the repository it created most recently, dsalo0915@gmail.com, the address the CV gives. Two of its repositories, exoid-did-wallet-backend and did-wallet-verifier-widget, hold 44 commits by a second account, arturdranhoi, signed artur.dranhoi@exiod.io and artur.dranhoi@exoid.io, beside commits by a developer at Exoid, the company whose product they are; the CV describes that product, a decentralised-identity wallet with zero-knowledge proofs built for a DIFC Court notarisation project, as this persona's own work. The lazarus.group registry lists coolprince0115@gmail.com and artur.dranhoi@exiod.io under one operator it names Oleksandr Muravskyi, alias Artur Dranhoi, alias PrinceCharming0115, with no published methodology; the commit metadata read here ties those two addresses and the CV's own to one GitHub account first-hand, which is the corroboration the registry entry lacked, and adds the name, address and telephone number this CV presents under. The registry's remaining two addresses are not repeated here because nothing read first-hand reaches them. The telephone number is printed on the CV as shown and is too short to be a complete Finnish mobile number. A CV in this set may be a real person's stolen document, so the name on it, and the employers and schools it lists, may belong to someone with no part in the operation.

  github.com/princecharming0115 — Chollima Hunter · under “Daniel Salo” · pulled 2026-09-21

• Nearby text:

  …0xa8cb25ddf0a7195bdc3232ac6e1d812c8a4713fe #### Oleksandr Muravskyi (aka Artur Dranhoi) - oleksandr-muravskyi - PrinceCharming0115 - artur.dranhoi@exiod.io - coolprince0115@gmail.com - ole.dev300@hotmail.com - olek.muravskyi@outlook.com #### Joel Kursala -…

  DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “Oleksandr Muravskyi (aka Artur Dranhoi)” · published 2025-06-19 · pulled 2026-08-30

artur.dranhoi@exoid.io

email address IT Worker Fraud CURATED

First seen unknown · last seen unknown

Source

• Read on 21 September 2026 from a listing on the pipu.cc marketplace whose product description is this curriculum vitae, one of 1,882 such listings posted between 26 June and 2 July 2025 from seller accounts named after each CV's subject. The listing carries a photograph as its product image; it is the same photograph four other listings in the set carry under four other names, so it is not shown here and is not evidence of anyone's face. What ties this listing to the index is the GitHub account printed on the CV, princecharming0115, read directly on 21 September 2026. The account was created in October 2022 and holds 25 repositories. Its own commits are signed coolprince0115@gmail.com 491 times and, once, on the repository it created most recently, dsalo0915@gmail.com, the address the CV gives. Two of its repositories, exoid-did-wallet-backend and did-wallet-verifier-widget, hold 44 commits by a second account, arturdranhoi, signed artur.dranhoi@exiod.io and artur.dranhoi@exoid.io, beside commits by a developer at Exoid, the company whose product they are; the CV describes that product, a decentralised-identity wallet with zero-knowledge proofs built for a DIFC Court notarisation project, as this persona's own work. The lazarus.group registry lists coolprince0115@gmail.com and artur.dranhoi@exiod.io under one operator it names Oleksandr Muravskyi, alias Artur Dranhoi, alias PrinceCharming0115, with no published methodology; the commit metadata read here ties those two addresses and the CV's own to one GitHub account first-hand, which is the corroboration the registry entry lacked, and adds the name, address and telephone number this CV presents under. The registry's remaining two addresses are not repeated here because nothing read first-hand reaches them. The telephone number is printed on the CV as shown and is too short to be a complete Finnish mobile number. A CV in this set may be a real person's stolen document, so the name on it, and the employers and schools it lists, may belong to someone with no part in the operation.

  github.com/princecharming0115 — Chollima Hunter · under “Daniel Salo” · pulled 2026-09-21

coolprince0115@gmail.com

email address IT Worker Fraud CURATED

Also listed under Oleksandr Muravskyi — this value’s page names all of them.

First seen 2026-08-30 · last seen 2026-10-18

Sources

• Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.

  lazarus.group/team/oleksandr-muravskyi — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Oleksandr Muravskyi / Artur Dranhoi / oleksandr-muravskyi / PrinceCharming0115” · pulled 2026-09-09

• Read on 21 September 2026 from a listing on the pipu.cc marketplace whose product description is this curriculum vitae, one of 1,882 such listings posted between 26 June and 2 July 2025 from seller accounts named after each CV's subject. The listing carries a photograph as its product image; it is the same photograph four other listings in the set carry under four other names, so it is not shown here and is not evidence of anyone's face. What ties this listing to the index is the GitHub account printed on the CV, princecharming0115, read directly on 21 September 2026. The account was created in October 2022 and holds 25 repositories. Its own commits are signed coolprince0115@gmail.com 491 times and, once, on the repository it created most recently, dsalo0915@gmail.com, the address the CV gives. Two of its repositories, exoid-did-wallet-backend and did-wallet-verifier-widget, hold 44 commits by a second account, arturdranhoi, signed artur.dranhoi@exiod.io and artur.dranhoi@exoid.io, beside commits by a developer at Exoid, the company whose product they are; the CV describes that product, a decentralised-identity wallet with zero-knowledge proofs built for a DIFC Court notarisation project, as this persona's own work. The lazarus.group registry lists coolprince0115@gmail.com and artur.dranhoi@exiod.io under one operator it names Oleksandr Muravskyi, alias Artur Dranhoi, alias PrinceCharming0115, with no published methodology; the commit metadata read here ties those two addresses and the CV's own to one GitHub account first-hand, which is the corroboration the registry entry lacked, and adds the name, address and telephone number this CV presents under. The registry's remaining two addresses are not repeated here because nothing read first-hand reaches them. The telephone number is printed on the CV as shown and is too short to be a complete Finnish mobile number. A CV in this set may be a real person's stolen document, so the name on it, and the employers and schools it lists, may belong to someone with no part in the operation.

  github.com/princecharming0115 — Chollima Hunter · under “Daniel Salo” · pulled 2026-09-21

• Nearby text:

  …Oleksandr Muravskyi (aka Artur Dranhoi) - oleksandr-muravskyi - PrinceCharming0115 - artur.dranhoi@exiod.io - coolprince0115@gmail.com - ole.dev300@hotmail.com - olek.muravskyi@outlook.com #### Joel Kursala - 0xa8cB25ddf0A7195BDc3232ac6e1D812c8a4713Fe #### Daniel Klein…

  DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “Oleksandr Muravskyi (aka Artur Dranhoi)” · published 2025-06-19 · pulled 2026-08-30

dsalo0915@gmail.com

email address IT Worker Fraud CURATED

First seen 2025-07-01 · last seen 2025-07-01

Source

• As printed:

  Daniel Salo Blockchain & Web3 Engineer dsalo0915@gmail.com +358 044 1576 Helsinki, Finland …

  Read on 21 September 2026 from a listing on the pipu.cc marketplace whose product description is this curriculum vitae, one of 1,882 such listings posted between 26 June and 2 July 2025 from seller accounts named after each CV's subject. The listing carries a photograph as its product image; it is the same photograph four other listings in the set carry under four other names, so it is not shown here and is not evidence of anyone's face. What ties this listing to the index is the GitHub account printed on the CV, princecharming0115, read directly on 21 September 2026. The account was created in October 2022 and holds 25 repositories. Its own commits are signed coolprince0115@gmail.com 491 times and, once, on the repository it created most recently, dsalo0915@gmail.com, the address the CV gives. Two of its repositories, exoid-did-wallet-backend and did-wallet-verifier-widget, hold 44 commits by a second account, arturdranhoi, signed artur.dranhoi@exiod.io and artur.dranhoi@exoid.io, beside commits by a developer at Exoid, the company whose product they are; the CV describes that product, a decentralised-identity wallet with zero-knowledge proofs built for a DIFC Court notarisation project, as this persona's own work. The lazarus.group registry lists coolprince0115@gmail.com and artur.dranhoi@exiod.io under one operator it names Oleksandr Muravskyi, alias Artur Dranhoi, alias PrinceCharming0115, with no published methodology; the commit metadata read here ties those two addresses and the CV's own to one GitHub account first-hand, which is the corroboration the registry entry lacked, and adds the name, address and telephone number this CV presents under. The registry's remaining two addresses are not repeated here because nothing read first-hand reaches them. The telephone number is printed on the CV as shown and is too short to be a complete Finnish mobile number. A CV in this set may be a real person's stolen document, so the name on it, and the employers and schools it lists, may belong to someone with no part in the operation.

  pipu.cc/en/item_detail.php?item_id=4625 — Chollima Hunter · under “Daniel Salo” · published 2025-07-01 · pulled 2026-09-21

https://github.com/arturdranhoi

github profile IT Worker Fraud CURATED live checked 2026-09-21

First seen unknown · last seen unknown

Source

• Read on 21 September 2026 from a listing on the pipu.cc marketplace whose product description is this curriculum vitae, one of 1,882 such listings posted between 26 June and 2 July 2025 from seller accounts named after each CV's subject. The listing carries a photograph as its product image; it is the same photograph four other listings in the set carry under four other names, so it is not shown here and is not evidence of anyone's face. What ties this listing to the index is the GitHub account printed on the CV, princecharming0115, read directly on 21 September 2026. The account was created in October 2022 and holds 25 repositories. Its own commits are signed coolprince0115@gmail.com 491 times and, once, on the repository it created most recently, dsalo0915@gmail.com, the address the CV gives. Two of its repositories, exoid-did-wallet-backend and did-wallet-verifier-widget, hold 44 commits by a second account, arturdranhoi, signed artur.dranhoi@exiod.io and artur.dranhoi@exoid.io, beside commits by a developer at Exoid, the company whose product they are; the CV describes that product, a decentralised-identity wallet with zero-knowledge proofs built for a DIFC Court notarisation project, as this persona's own work. The lazarus.group registry lists coolprince0115@gmail.com and artur.dranhoi@exiod.io under one operator it names Oleksandr Muravskyi, alias Artur Dranhoi, alias PrinceCharming0115, with no published methodology; the commit metadata read here ties those two addresses and the CV's own to one GitHub account first-hand, which is the corroboration the registry entry lacked, and adds the name, address and telephone number this CV presents under. The registry's remaining two addresses are not repeated here because nothing read first-hand reaches them. The telephone number is printed on the CV as shown and is too short to be a complete Finnish mobile number. A CV in this set may be a real person's stolen document, so the name on it, and the employers and schools it lists, may belong to someone with no part in the operation.

  github.com/princecharming0115 — Chollima Hunter · under “Daniel Salo” · pulled 2026-09-21

https://github.com/princecharming0115

github profile IT Worker Fraud CURATED live checked 2026-09-21

First seen 2025-07-01 · last seen 2025-07-01

live checked 2026-09-21

The image is the avatar this account displays, not evidence of who operates it.

Source

• Read on 21 September 2026 from a listing on the pipu.cc marketplace whose product description is this curriculum vitae, one of 1,882 such listings posted between 26 June and 2 July 2025 from seller accounts named after each CV's subject. The listing carries a photograph as its product image; it is the same photograph four other listings in the set carry under four other names, so it is not shown here and is not evidence of anyone's face. What ties this listing to the index is the GitHub account printed on the CV, princecharming0115, read directly on 21 September 2026. The account was created in October 2022 and holds 25 repositories. Its own commits are signed coolprince0115@gmail.com 491 times and, once, on the repository it created most recently, dsalo0915@gmail.com, the address the CV gives. Two of its repositories, exoid-did-wallet-backend and did-wallet-verifier-widget, hold 44 commits by a second account, arturdranhoi, signed artur.dranhoi@exiod.io and artur.dranhoi@exoid.io, beside commits by a developer at Exoid, the company whose product they are; the CV describes that product, a decentralised-identity wallet with zero-knowledge proofs built for a DIFC Court notarisation project, as this persona's own work. The lazarus.group registry lists coolprince0115@gmail.com and artur.dranhoi@exiod.io under one operator it names Oleksandr Muravskyi, alias Artur Dranhoi, alias PrinceCharming0115, with no published methodology; the commit metadata read here ties those two addresses and the CV's own to one GitHub account first-hand, which is the corroboration the registry entry lacked, and adds the name, address and telephone number this CV presents under. The registry's remaining two addresses are not repeated here because nothing read first-hand reaches them. The telephone number is printed on the CV as shown and is too short to be a complete Finnish mobile number. A CV in this set may be a real person's stolen document, so the name on it, and the employers and schools it lists, may belong to someone with no part in the operation.

  pipu.cc/en/item_detail.php?item_id=4625 — Chollima Hunter · under “Daniel Salo” · published 2025-07-01 · pulled 2026-09-21

+3580441576

phone number IT Worker Fraud CURATED

First seen 2025-07-01 · last seen 2025-07-01

Line type

A per-number lookup returns no record and marks the number fabricated: invalid Number. The listing prints it as +358 044 1576, which keeps the domestic trunk 0 after the country code and is too short for a Finnish number.

Looked up 2026-09-30 at phonevalidator.com. This is a lookup of the line itself.

Source

• As printed:

  … Blockchain & Web3 Engineer dsalo0915@gmail.com +358 044 1576 Helsinki, Finland github.com/princecharming0115 …

  Read on 21 September 2026 from a listing on the pipu.cc marketplace whose product description is this curriculum vitae, one of 1,882 such listings posted between 26 June and 2 July 2025 from seller accounts named after each CV's subject. The listing carries a photograph as its product image; it is the same photograph four other listings in the set carry under four other names, so it is not shown here and is not evidence of anyone's face. What ties this listing to the index is the GitHub account printed on the CV, princecharming0115, read directly on 21 September 2026. The account was created in October 2022 and holds 25 repositories. Its own commits are signed coolprince0115@gmail.com 491 times and, once, on the repository it created most recently, dsalo0915@gmail.com, the address the CV gives. Two of its repositories, exoid-did-wallet-backend and did-wallet-verifier-widget, hold 44 commits by a second account, arturdranhoi, signed artur.dranhoi@exiod.io and artur.dranhoi@exoid.io, beside commits by a developer at Exoid, the company whose product they are; the CV describes that product, a decentralised-identity wallet with zero-knowledge proofs built for a DIFC Court notarisation project, as this persona's own work. The lazarus.group registry lists coolprince0115@gmail.com and artur.dranhoi@exiod.io under one operator it names Oleksandr Muravskyi, alias Artur Dranhoi, alias PrinceCharming0115, with no published methodology; the commit metadata read here ties those two addresses and the CV's own to one GitHub account first-hand, which is the corroboration the registry entry lacked, and adds the name, address and telephone number this CV presents under. The registry's remaining two addresses are not repeated here because nothing read first-hand reaches them. The telephone number is printed on the CV as shown and is too short to be a complete Finnish mobile number. A CV in this set may be a real person's stolen document, so the name on it, and the employers and schools it lists, may belong to someone with no part in the operation.

  pipu.cc/en/item_detail.php?item_id=4625 — Chollima Hunter · under “Daniel Salo” · published 2025-07-01 · pulled 2026-09-21