Janus

Also reported as: AngelStar boyJulius Kelly

A fabricated professional identity used in the DPRK remote IT-worker scheme. Most of what follows is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, Janus. The attribution is theirs, not this site's.

The remainder was read by this site from the account itself and is cited to the page and date it was read.

IT Worker Fraud First reported 2025-05-15 · last reported 2026-09-24

Profiles and evidence

Identifiers attributed to this persona

35 indicators the sources below record for this operator, each with its sources.

IndicatorTypeAccount status
Angel alias —
Janus alias —
Julius Kelly alias —
Star boy alias —
https://dev.to/dreamfullstacker devto account live checked 2026-11-08
https://hub.docker.com/u/fullstackdev3546 dockerhub account live checked 2026-11-08
https://hub.docker.com/u/seniorwebdev215 dockerhub account live checked 2026-11-08
blackhorse0215@gmail.com email address —
careemboota@gmail.com email address —
cutewolf12345@outlook.com email address —
dreamfullstacker@gmail.com email address —
febekec383@gridmauk.com email address —
fullstackdev3546@gmail.com email address —
happypooh0802@outlook.com email address —
janus.upwork@proton.me email address —
juliusmkelly@gmail.com email address —
justinbropico@gmail.com email address —
lucas@bluestout.com email address —
seniorwebdev215@gmail.com email address —
sixoga1881@delowd.com email address —
smallstar0924@gmail.com email address —
softangel0090@gmail.com email address —
softdeveng9211@outlook.com email address —
webdev215@yandex.com email address —
yaroslav@diebestenderstadt.de email address —
zaikayarik123@gmail.com email address —
https://github.com/blackhorse0215 github profile live checked 2026-09-30
https://github.com/caesar0dev github profile removed checked 2026-09-30
https://github.com/fullstackengineer777 github profile removed checked 2026-09-30
https://github.com/seniorweb215 github profile live checked 2026-09-30
https://github.com/webmobileai github profile live checked 2026-09-30
https://gitlab.com/blackhorse0215 gitlab account live checked 2026-11-08
https://gitlab.com/dreamfullstacker gitlab account live checked 2026-11-08
https://gitlab.com/fullstackdev3546 gitlab account live checked 2026-11-08
https://huggingface.co/juliusmkelly huggingface account live checked 2026-11-08

Angel

alias IT Worker Fraud RESEARCHER POST

First seen 2025-05-15 · last seen 2025-05-15

Source

  • The four posts are one thread by the same researcher. He names the operator Janus or Angel in the second, calls him Star boy in the third where the addresses are described as the older ones, and adds the last address in the fourth alongside a remark about a GitHub account holding sixty repositories, which the post does not name.
    x.com/browsercookies/status/1922876606051176801 — Cookie Connoisseur (@browsercookies) · under “Janus / Angel / Star boy” · published 2025-05-15 · pulled 2026-08-30

Janus

alias IT Worker Fraud CURATED

First seen 2025-05-15 · last seen 2026-09-24

Sources

  • The four posts are one thread by the same researcher. He names the operator Janus or Angel in the second, calls him Star boy in the third where the addresses are described as the older ones, and adds the last address in the fourth alongside a remark about a GitHub account holding sixty repositories, which the post does not name.
    x.com/browsercookies/status/1922876606051176801 — Cookie Connoisseur (@browsercookies) · under “Janus / Angel / Star boy” · published 2025-05-15 · pulled 2026-08-30
  • Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- blackhorse0215 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Black Horse. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    gitlab.com/blackhorse0215 — Chollima Hunter · under “Janus” · pulled 2026-09-18
  • Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- dreamfullstacker -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Dream Fullstacker. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    gitlab.com/dreamfullstacker — Chollima Hunter · under “Janus” · pulled 2026-09-18
  • Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- dreamfullstacker -- and asking dev.to whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a registration date of 29 May 2022 and no display name but the handle itself. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    dev.to/dreamfullstacker — Chollima Hunter · under “Janus” · pulled 2026-09-18
  • Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- fullstackdev3546 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Full Stack. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    gitlab.com/fullstackdev3546 — Chollima Hunter · under “Janus” · pulled 2026-09-18
  • Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- fullstackdev3546 -- and asking Docker Hub whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a registration date of 17 June 2023. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    hub.docker.com/u/fullstackdev3546 — Chollima Hunter · under “Janus” · pulled 2026-09-18
  • Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- juliusmkelly -- and asking Hugging Face whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Julius Kelly. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    huggingface.co/juliusmkelly — Chollima Hunter · under “Janus / Julius Kelly” · pulled 2026-09-18
  • Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- seniorwebdev215 -- and asking Docker Hub whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a registration date of 9 February 2021. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    hub.docker.com/u/seniorwebdev215 — Chollima Hunter · under “Janus” · pulled 2026-09-18
  • Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it. github.com/webmobileai is account id 108163680, created on 25 June 2022, display name WMAG, with 111 public repositories. Its noreply addresses show it was previously named seniorsoftdeveloper. 91 of its own 100 commits are signed softdeveng9211@outlook.com, and its repositories hold 66 more signed fullstackdev3546@gmail.com; browsercookies gives both for the operator the researcher calls Janus.
    github.com/webmobileai — Chollima Hunter · under “Janus” · pulled 2026-09-24
  • Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it. github.com/blackhorse0215 is account id 67865729, created on 5 July 2020, bio Ecommerce Wizard. 94 of its 100 own commits are signed blackhorse0215@gmail.com, the handle as a mailbox, which browsercookies gives for Janus.
    github.com/blackhorse0215 — Chollima Hunter · under “Janus” · pulled 2026-09-24
  • Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it. github.com/seniorweb215 is account id 65157317, created on 11 May 2020. 26 of the 27 own commits GitHub's search returns for it are signed seniorwebdev215@gmail.com, which browsercookies gives for Janus.
    github.com/seniorweb215 — Chollima Hunter · under “Janus” · pulled 2026-09-24
  • Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 74 commits signed smallstar0924@gmail.com, an address browsercookies publishes for this persona, to the login Caesar0dev, which no longer resolves.
    github.com/Caesar0dev — Chollima Hunter · under “Janus” · pulled 2026-09-24

Julius Kelly

alias IT Worker Fraud CURATED

First seen unknown · last seen unknown

Source

  • Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- juliusmkelly -- and asking Hugging Face whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Julius Kelly. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    huggingface.co/juliusmkelly — Chollima Hunter · under “Janus / Julius Kelly” · pulled 2026-09-18

Star boy

alias IT Worker Fraud RESEARCHER POST

First seen 2025-05-15 · last seen 2025-05-15

Source

  • The four posts are one thread by the same researcher. He names the operator Janus or Angel in the second, calls him Star boy in the third where the addresses are described as the older ones, and adds the last address in the fourth alongside a remark about a GitHub account holding sixty repositories, which the post does not name.
    x.com/browsercookies/status/1922876606051176801 — Cookie Connoisseur (@browsercookies) · under “Janus / Angel / Star boy” · published 2025-05-15 · pulled 2026-08-30

https://dev.to/dreamfullstacker

devto account IT Worker Fraud CURATED live checked 2026-11-08

First seen unknown · last seen unknown

Source

  • Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- dreamfullstacker -- and asking dev.to whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a registration date of 29 May 2022 and no display name but the handle itself. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    dev.to/dreamfullstacker — Chollima Hunter · under “Janus” · pulled 2026-09-18

https://hub.docker.com/u/fullstackdev3546

dockerhub account IT Worker Fraud CURATED live checked 2026-11-08

First seen unknown · last seen unknown

Source

  • Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- fullstackdev3546 -- and asking Docker Hub whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a registration date of 17 June 2023. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    hub.docker.com/u/fullstackdev3546 — Chollima Hunter · under “Janus” · pulled 2026-09-18

https://hub.docker.com/u/seniorwebdev215

dockerhub account IT Worker Fraud CURATED live checked 2026-11-08

First seen unknown · last seen unknown

Source

  • Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- seniorwebdev215 -- and asking Docker Hub whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a registration date of 9 February 2021. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    hub.docker.com/u/seniorwebdev215 — Chollima Hunter · under “Janus” · pulled 2026-09-18

blackhorse0215@gmail.com

email address IT Worker Fraud CURATED

First seen 2025-05-15 · last seen 2026-09-24

Sources

  • The four posts are one thread by the same researcher. He names the operator Janus or Angel in the second, calls him Star boy in the third where the addresses are described as the older ones, and adds the last address in the fourth alongside a remark about a GitHub account holding sixty repositories, which the post does not name.
    x.com/browsercookies/status/1922882187541557757 — Cookie Connoisseur (@browsercookies) · under “Janus / Angel / Star boy” · published 2025-05-15 · pulled 2026-08-30
  • Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it. github.com/blackhorse0215 is account id 67865729, created on 5 July 2020, bio Ecommerce Wizard. 94 of its 100 own commits are signed blackhorse0215@gmail.com, the handle as a mailbox, which browsercookies gives for Janus.
    github.com/blackhorse0215 — Chollima Hunter · under “Janus” · pulled 2026-09-24

careemboota@gmail.com

email address IT Worker Fraud RESEARCHER POST

First seen 2025-05-15 · last seen 2025-05-15

Source

  • The four posts are one thread by the same researcher. He names the operator Janus or Angel in the second, calls him Star boy in the third where the addresses are described as the older ones, and adds the last address in the fourth alongside a remark about a GitHub account holding sixty repositories, which the post does not name.
    x.com/browsercookies/status/1922877967362892189 — Cookie Connoisseur (@browsercookies) · under “Janus / Angel / Star boy” · published 2025-05-15 · pulled 2026-08-30

cutewolf12345@outlook.com

email address IT Worker Fraud RESEARCHER POST

First seen 2025-05-15 · last seen 2025-05-15

Source

  • The four posts are one thread by the same researcher. He names the operator Janus or Angel in the second, calls him Star boy in the third where the addresses are described as the older ones, and adds the last address in the fourth alongside a remark about a GitHub account holding sixty repositories, which the post does not name.
    x.com/browsercookies/status/1922877967362892189 — Cookie Connoisseur (@browsercookies) · under “Janus / Angel / Star boy” · published 2025-05-15 · pulled 2026-08-30

dreamfullstacker@gmail.com

email address IT Worker Fraud MATCHED IN SOURCE

First seen 2025-05-15 · last seen 2025-08-19

Sources

  • The four posts are one thread by the same researcher. He names the operator Janus or Angel in the second, calls him Star boy in the third where the addresses are described as the older ones, and adds the last address in the fourth alongside a remark about a GitHub account holding sixty repositories, which the post does not name.
    x.com/browsercookies/status/1923098202284167531 — Cookie Connoisseur (@browsercookies) · under “Janus / Angel / Star boy” · published 2025-05-15 · pulled 2026-08-30
  • Nearby text:

    …45@gmail.com dragonslayer.feb20@gmail.com dragontiger928@gmail.com dreamcareer070@gmail.com dreamconsolestar@gmail.com dreamdev37@gmail.com dreamfullstacker@gmail.com dreamhigh.ws917@gmail.com dreamhigh9990@gmail.com dreamhighpassionhigh@gmail.com dreamworktalent@gmail.com dreamworld130362@gmail.com dried…
    Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File · under “CONCLUSION” · published 2025-08-19 · pulled 2026-09-01

febekec383@gridmauk.com

email address IT Worker Fraud RESEARCHER POST

First seen 2025-05-15 · last seen 2025-05-15

Source

  • The four posts are one thread by the same researcher. He names the operator Janus or Angel in the second, calls him Star boy in the third where the addresses are described as the older ones, and adds the last address in the fourth alongside a remark about a GitHub account holding sixty repositories, which the post does not name.
    x.com/browsercookies/status/1922882187541557757 — Cookie Connoisseur (@browsercookies) · under “Janus / Angel / Star boy” · published 2025-05-15 · pulled 2026-08-30

fullstackdev3546@gmail.com

email address IT Worker Fraud CURATED

First seen 2025-05-15 · last seen 2026-09-24

Sources

  • The four posts are one thread by the same researcher. He names the operator Janus or Angel in the second, calls him Star boy in the third where the addresses are described as the older ones, and adds the last address in the fourth alongside a remark about a GitHub account holding sixty repositories, which the post does not name.
    x.com/browsercookies/status/1922876606051176801 — Cookie Connoisseur (@browsercookies) · under “Janus / Angel / Star boy” · published 2025-05-15 · pulled 2026-08-30
  • Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it. github.com/webmobileai is account id 108163680, created on 25 June 2022, display name WMAG, with 111 public repositories. Its noreply addresses show it was previously named seniorsoftdeveloper. 91 of its own 100 commits are signed softdeveng9211@outlook.com, and its repositories hold 66 more signed fullstackdev3546@gmail.com; browsercookies gives both for the operator the researcher calls Janus.
    github.com/webmobileai — Chollima Hunter · under “Janus” · pulled 2026-09-24
  • Nearby text:

    …en615heart@gmail.com frubberfreep@gmail.com fujino.juzo@gmail.com fulldev0526@gmail.com fullstack926@gmail.com fullstackcoder0322@gmail.com fullstackdev3546@gmail.com fullstackninja0805@gmail.com fullstackpartner@gmail.com furiouscomet729@gmail.com gagikbabayan5105@gmail.com galoyi2320@syinxun.com garysco…
    Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File · under “CONCLUSION” · published 2025-08-19 · pulled 2026-09-01

happypooh0802@outlook.com

email address IT Worker Fraud RESEARCHER POST

First seen 2025-05-15 · last seen 2025-05-15

Source

  • The four posts are one thread by the same researcher. He names the operator Janus or Angel in the second, calls him Star boy in the third where the addresses are described as the older ones, and adds the last address in the fourth alongside a remark about a GitHub account holding sixty repositories, which the post does not name.
    x.com/browsercookies/status/1922877967362892189 — Cookie Connoisseur (@browsercookies) · under “Janus / Angel / Star boy” · published 2025-05-15 · pulled 2026-08-30

janus.upwork@proton.me

email address IT Worker Fraud RESEARCHER POST

First seen 2025-05-15 · last seen 2025-05-15

Source

  • The four posts are one thread by the same researcher. He names the operator Janus or Angel in the second, calls him Star boy in the third where the addresses are described as the older ones, and adds the last address in the fourth alongside a remark about a GitHub account holding sixty repositories, which the post does not name.
    x.com/browsercookies/status/1922877967362892189 — Cookie Connoisseur (@browsercookies) · under “Janus / Angel / Star boy” · published 2025-05-15 · pulled 2026-08-30

juliusmkelly@gmail.com

email address IT Worker Fraud RESEARCHER POST

First seen 2025-05-15 · last seen 2025-05-15

Source

  • The four posts are one thread by the same researcher. He names the operator Janus or Angel in the second, calls him Star boy in the third where the addresses are described as the older ones, and adds the last address in the fourth alongside a remark about a GitHub account holding sixty repositories, which the post does not name.
    x.com/browsercookies/status/1922882187541557757 — Cookie Connoisseur (@browsercookies) · under “Janus / Angel / Star boy” · published 2025-05-15 · pulled 2026-08-30

justinbropico@gmail.com

email address IT Worker Fraud MATCHED IN SOURCE

First seen 2025-05-15 · last seen 2025-08-19

Sources

  • The four posts are one thread by the same researcher. He names the operator Janus or Angel in the second, calls him Star boy in the third where the addresses are described as the older ones, and adds the last address in the fourth alongside a remark about a GitHub account holding sixty repositories, which the post does not name.
    x.com/browsercookies/status/1922877967362892189 — Cookie Connoisseur (@browsercookies) · under “Janus / Angel / Star boy” · published 2025-05-15 · pulled 2026-08-30
  • Nearby text:

    …gufum.com julian.aces.pokerdev@gmail.com juliegibbs206@gmail.com juniorcorder53@gmail.com jupiter256821@gmail.com justinbettano96@gmail.com justinbropico@gmail.com justinkal1106@gmail.com justinlee0093@gmail.com justinmichaelschaffer0402@gmail.com justinscha0402@gmail.com justinstone0603@gmail.com jxun…
    Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File · under “CONCLUSION” · published 2025-08-19 · pulled 2026-09-01

lucas@bluestout.com

email address IT Worker Fraud RESEARCHER POST

First seen 2025-05-15 · last seen 2025-05-15

Source

  • The four posts are one thread by the same researcher. He names the operator Janus or Angel in the second, calls him Star boy in the third where the addresses are described as the older ones, and adds the last address in the fourth alongside a remark about a GitHub account holding sixty repositories, which the post does not name.
    x.com/browsercookies/status/1922882187541557757 — Cookie Connoisseur (@browsercookies) · under “Janus / Angel / Star boy” · published 2025-05-15 · pulled 2026-08-30

seniorwebdev215@gmail.com

email address IT Worker Fraud CURATED

First seen 2025-05-15 · last seen 2026-09-24

Sources

  • The four posts are one thread by the same researcher. He names the operator Janus or Angel in the second, calls him Star boy in the third where the addresses are described as the older ones, and adds the last address in the fourth alongside a remark about a GitHub account holding sixty repositories, which the post does not name.
    x.com/browsercookies/status/1922882187541557757 — Cookie Connoisseur (@browsercookies) · under “Janus / Angel / Star boy” · published 2025-05-15 · pulled 2026-08-30
  • Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it. github.com/seniorweb215 is account id 65157317, created on 11 May 2020. 26 of the 27 own commits GitHub's search returns for it are signed seniorwebdev215@gmail.com, which browsercookies gives for Janus.
    github.com/seniorweb215 — Chollima Hunter · under “Janus” · pulled 2026-09-24

sixoga1881@delowd.com

email address IT Worker Fraud RESEARCHER POST

First seen 2025-05-15 · last seen 2025-05-15

Source

  • The four posts are one thread by the same researcher. He names the operator Janus or Angel in the second, calls him Star boy in the third where the addresses are described as the older ones, and adds the last address in the fourth alongside a remark about a GitHub account holding sixty repositories, which the post does not name.
    x.com/browsercookies/status/1922882187541557757 — Cookie Connoisseur (@browsercookies) · under “Janus / Angel / Star boy” · published 2025-05-15 · pulled 2026-08-30

smallstar0924@gmail.com

email address IT Worker Fraud CURATED

First seen 2025-05-15 · last seen 2026-09-24

Sources

  • The four posts are one thread by the same researcher. He names the operator Janus or Angel in the second, calls him Star boy in the third where the addresses are described as the older ones, and adds the last address in the fourth alongside a remark about a GitHub account holding sixty repositories, which the post does not name.
    x.com/browsercookies/status/1922877967362892189 — Cookie Connoisseur (@browsercookies) · under “Janus / Angel / Star boy” · published 2025-05-15 · pulled 2026-08-30
  • The four posts are one thread by the same researcher. He names the operator Janus or Angel in the second, calls him Star boy in the third where the addresses are described as the older ones, and adds the last address in the fourth alongside a remark about a GitHub account holding sixty repositories, which the post does not name.
    x.com/browsercookies/status/1923880596855717915 — Cookie Connoisseur (@browsercookies) · under “Janus / Angel / Star boy” · published 2025-05-17 · pulled 2026-08-30
  • Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 74 commits signed smallstar0924@gmail.com, an address browsercookies publishes for this persona, to the login Caesar0dev, which no longer resolves.
    github.com/Caesar0dev — Chollima Hunter · under “Janus” · pulled 2026-09-24
  • Nearby text:

    …tairmail.com sixteen1120@proton.me skybolt0307@gmail.com skygentleman6463380@skiff.com slow.spell.483e4e@gizmotik.com smallant519@gmail.com smallstar0924@gmail.com smart.developer5555@gmail.com smart.hacker.6129@gmail.com smart0315dev@gmail.com smart04240@gmail.com smartbigguru@gmail.com smartdevgroupl…
    Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File · under “CONCLUSION” · published 2025-08-19 · pulled 2026-09-01

softangel0090@gmail.com

email address IT Worker Fraud RESEARCHER POST

First seen 2025-05-15 · last seen 2025-05-17

Sources

  • The four posts are one thread by the same researcher. He names the operator Janus or Angel in the second, calls him Star boy in the third where the addresses are described as the older ones, and adds the last address in the fourth alongside a remark about a GitHub account holding sixty repositories, which the post does not name.
    x.com/browsercookies/status/1922877967362892189 — Cookie Connoisseur (@browsercookies) · under “Janus / Angel / Star boy” · published 2025-05-15 · pulled 2026-08-30
  • The post says the operator's associates signed a guestbook on his GitHub profile and that the entries link to their profiles. The three names are transcribed by hand from the attached screenshot of that guestbook, where each is rendered as a link beside a GitHub-style identicon. The researcher characterises them as associates of the Lovely Developer operator but does not attribute any of them to a named person, so they anchor no persona here. The address softangel0090@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.
    x.com/browsercookies/status/1923540150686187802 — Cookie Connoisseur (@browsercookies) · under “Accounts that signed the guestbook on the Josue Valdivia profile” · published 2025-05-17 · pulled 2026-08-30

softdeveng9211@outlook.com

email address IT Worker Fraud CURATED

First seen 2025-05-15 · last seen 2026-09-24

Sources

  • The four posts are one thread by the same researcher. He names the operator Janus or Angel in the second, calls him Star boy in the third where the addresses are described as the older ones, and adds the last address in the fourth alongside a remark about a GitHub account holding sixty repositories, which the post does not name.
    x.com/browsercookies/status/1922876606051176801 — Cookie Connoisseur (@browsercookies) · under “Janus / Angel / Star boy” · published 2025-05-15 · pulled 2026-08-30
  • Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it. github.com/webmobileai is account id 108163680, created on 25 June 2022, display name WMAG, with 111 public repositories. Its noreply addresses show it was previously named seniorsoftdeveloper. 91 of its own 100 commits are signed softdeveng9211@outlook.com, and its repositories hold 66 more signed fullstackdev3546@gmail.com; browsercookies gives both for the operator the researcher calls Janus.
    github.com/webmobileai — Chollima Hunter · under “Janus” · pulled 2026-09-24

webdev215@yandex.com

email address IT Worker Fraud RESEARCHER POST

First seen 2025-05-15 · last seen 2025-05-15

Source

  • The four posts are one thread by the same researcher. He names the operator Janus or Angel in the second, calls him Star boy in the third where the addresses are described as the older ones, and adds the last address in the fourth alongside a remark about a GitHub account holding sixty repositories, which the post does not name.
    x.com/browsercookies/status/1922882187541557757 — Cookie Connoisseur (@browsercookies) · under “Janus / Angel / Star boy” · published 2025-05-15 · pulled 2026-08-30

yaroslav@diebestenderstadt.de

email address IT Worker Fraud RESEARCHER POST

First seen 2025-05-15 · last seen 2025-05-15

Source

  • The four posts are one thread by the same researcher. He names the operator Janus or Angel in the second, calls him Star boy in the third where the addresses are described as the older ones, and adds the last address in the fourth alongside a remark about a GitHub account holding sixty repositories, which the post does not name.
    x.com/browsercookies/status/1922882187541557757 — Cookie Connoisseur (@browsercookies) · under “Janus / Angel / Star boy” · published 2025-05-15 · pulled 2026-08-30

zaikayarik123@gmail.com

email address IT Worker Fraud RESEARCHER POST

First seen 2025-05-15 · last seen 2025-05-15

Source

  • The four posts are one thread by the same researcher. He names the operator Janus or Angel in the second, calls him Star boy in the third where the addresses are described as the older ones, and adds the last address in the fourth alongside a remark about a GitHub account holding sixty repositories, which the post does not name.
    x.com/browsercookies/status/1922882187541557757 — Cookie Connoisseur (@browsercookies) · under “Janus / Angel / Star boy” · published 2025-05-15 · pulled 2026-08-30

https://github.com/blackhorse0215

github profile IT Worker Fraud CURATED live checked 2026-09-30

First seen 2026-09-24 · last seen 2026-09-24

Source

  • Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it. github.com/blackhorse0215 is account id 67865729, created on 5 July 2020, bio Ecommerce Wizard. 94 of its 100 own commits are signed blackhorse0215@gmail.com, the handle as a mailbox, which browsercookies gives for Janus.
    github.com/blackhorse0215 — Chollima Hunter · under “Janus” · pulled 2026-09-24

https://github.com/caesar0dev

github profile IT Worker Fraud CURATED removed checked 2026-09-30

First seen 2026-09-24 · last seen 2026-09-24

Source

  • Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 74 commits signed smallstar0924@gmail.com, an address browsercookies publishes for this persona, to the login Caesar0dev, which no longer resolves.
    github.com/Caesar0dev — Chollima Hunter · under “Janus” · pulled 2026-09-24

https://github.com/fullstackengineer777

github profile IT Worker Fraud RESEARCHER POST removed checked 2026-09-30

First seen 2025-05-15 · last seen 2025-05-15

Source

  • The four posts are one thread by the same researcher. He names the operator Janus or Angel in the second, calls him Star boy in the third where the addresses are described as the older ones, and adds the last address in the fourth alongside a remark about a GitHub account holding sixty repositories, which the post does not name.
    x.com/browsercookies/status/1922876606051176801 — Cookie Connoisseur (@browsercookies) · under “Janus / Angel / Star boy” · published 2025-05-15 · pulled 2026-08-30

https://github.com/seniorweb215

github profile IT Worker Fraud CURATED live checked 2026-09-30

First seen 2026-09-24 · last seen 2026-09-24

Source

  • Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it. github.com/seniorweb215 is account id 65157317, created on 11 May 2020. 26 of the 27 own commits GitHub's search returns for it are signed seniorwebdev215@gmail.com, which browsercookies gives for Janus.
    github.com/seniorweb215 — Chollima Hunter · under “Janus” · pulled 2026-09-24

https://github.com/webmobileai

github profile IT Worker Fraud CURATED live checked 2026-09-30

First seen 2026-09-24 · last seen 2026-09-24

Source

  • Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it. github.com/webmobileai is account id 108163680, created on 25 June 2022, display name WMAG, with 111 public repositories. Its noreply addresses show it was previously named seniorsoftdeveloper. 91 of its own 100 commits are signed softdeveng9211@outlook.com, and its repositories hold 66 more signed fullstackdev3546@gmail.com; browsercookies gives both for the operator the researcher calls Janus.
    github.com/webmobileai — Chollima Hunter · under “Janus” · pulled 2026-09-24

https://gitlab.com/blackhorse0215

gitlab account IT Worker Fraud CURATED live checked 2026-11-08

First seen unknown · last seen unknown

Source

  • Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- blackhorse0215 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Black Horse. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    gitlab.com/blackhorse0215 — Chollima Hunter · under “Janus” · pulled 2026-09-18

https://gitlab.com/dreamfullstacker

gitlab account IT Worker Fraud CURATED live checked 2026-11-08

First seen unknown · last seen unknown

Source

  • Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- dreamfullstacker -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Dream Fullstacker. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    gitlab.com/dreamfullstacker — Chollima Hunter · under “Janus” · pulled 2026-09-18

https://gitlab.com/fullstackdev3546

gitlab account IT Worker Fraud CURATED live checked 2026-11-08

First seen unknown · last seen unknown

Source

  • Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- fullstackdev3546 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Full Stack. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    gitlab.com/fullstackdev3546 — Chollima Hunter · under “Janus” · pulled 2026-09-18

https://huggingface.co/juliusmkelly

huggingface account IT Worker Fraud CURATED live checked 2026-11-08

First seen unknown · last seen unknown

Source

  • Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- juliusmkelly -- and asking Hugging Face whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Julius Kelly. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
    huggingface.co/juliusmkelly — Chollima Hunter · under “Janus / Julius Kelly” · pulled 2026-09-18

Sources

Back to all personas

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. Janus as the name of the operator is the cited researcher’s assertion, repeated here as their claim.