Chollima Hunter

← All personas

Jordan Lopez

Also reported as: Nemanja Djordjevicfirstninja111

A professional identity listed by a third-party registry of suspected DPRK IT-worker personas, cited below. The registry publishes no byline or methodology, so the attribution is the registry's. Values this site read from a live account are cited to the page and date.

IT Worker Fraud First reported 2026-09-29

Profiles and evidence

Identifiers attributed to this persona

8 indicators the sources below record for this operator, each with its sources.

IndicatorTypeAccount status
Jordan Lopez alias —
Nemanja Djordjevic alias —
cloudriderm92@gmail.com email address —
yamadamasayoshi282@gmail.com email address —
https://github.com/firstninja111 github profile live checked 2026-08-30
https://github.com/warmth1224 github profile live checked 2026-09-30
+14074369174 phone number —
0x92cd7363c5b1853bc8fe6b5ae269836fc508ca73 wallet address —

Jordan Lopez

alias IT Worker Fraud CURATED

First seen 2026-09-29 · last seen 2026-09-29

Sources

  • Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
    lazarus.group/team/jordan-lopez — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Jordan Lopez / Nemanja Djordjevic / firstninja111” · pulled 2026-09-09
  • Found on 29 September 2026 by searching GitHub's code for the handles this site already holds for the persona (firstninja111) and reading the files that name them: contact blocks, profile READMEs and portfolio data in the persona's own repositories or in repositories that credit its accounts. Each value is cited to the file it was read from. Values in copied templates, client team pages and test data are not carried.
    github.com/warmth1224/engine/blob/fbc572c3942f31245e4fb183177753e918f8ac56/utils/data/personal-data.js — Chollima Hunter · under “Jordan Lopez” · published 2025-06-18 · pulled 2026-09-29

Nemanja Djordjevic

alias IT Worker Fraud THIRD-PARTY REGISTRY

First seen unknown · last seen unknown

Source

  • Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
    lazarus.group/team/jordan-lopez — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Jordan Lopez / Nemanja Djordjevic / firstninja111” · pulled 2026-09-09

cloudriderm92@gmail.com

email address IT Worker Fraud MATCHED IN SOURCE

Listed as cloudrider.m92@gmail.com

First seen 2025-08-19 · last seen 2026-10-18

Sources

  • Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
    lazarus.group/team/jordan-lopez — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Jordan Lopez / Nemanja Djordjevic / firstninja111” · pulled 2026-09-09
  • …fka Nemanja Djordjevic - firstninja111 - github.com/firstninja111 • [Archive](https://archive.ph/tFeQG) - cloudrider.m92@gmail.com - 0x92cd7363c5b1853bc8fe6b5ae269836fc508ca73 #### Mike Willie Lee - 2024, [Zach's…
    DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “Jordan Lopez” · published 2025-06-19 · pulled 2026-08-30

  • Nearby text:

    ….superdev@gmail.com cleancode0928@gmail.com clearstarbluce@gmail.com cleverdev727@gmail.com clientanna01@gmail.com cloud.dev.1992@gmail.com cloudrider.m92@gmail.com coach.wife.30791f@gizmotik.com cocodev0113@gmail.com cocokingdom27@gmail.com codechef730@gmail.com codefan0915@gmail.com codegenerator1994@…
    Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File · under “CONCLUSION” · published 2025-08-19 · pulled 2026-09-01

yamadamasayoshi282@gmail.com

email address IT Worker Fraud CURATED

First seen 2026-09-29 · last seen 2026-09-29

Source

  • Found on 29 September 2026 by searching GitHub's code for the handles this site already holds for the persona (firstninja111) and reading the files that name them: contact blocks, profile READMEs and portfolio data in the persona's own repositories or in repositories that credit its accounts. Each value is cited to the file it was read from. Values in copied templates, client team pages and test data are not carried.
    github.com/warmth1224/engine/blob/fbc572c3942f31245e4fb183177753e918f8ac56/utils/data/personal-data.js — Chollima Hunter · under “Jordan Lopez” · published 2025-06-18 · pulled 2026-09-29

https://github.com/firstninja111

github profile IT Worker Fraud MATCHED IN SOURCE live checked 2026-08-30

Listed as firstninja111

First seen 2026-08-30 · last seen 2026-10-18

Sources

  • Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
    lazarus.group/team/jordan-lopez — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Jordan Lopez / Nemanja Djordjevic / firstninja111” · pulled 2026-09-09

  • Nearby text:

    …Jordan Lopez - 2024, [Zach's List](https://x.com/zachxbt/status/1824047425822310580) - fka Nemanja Djordjevic - firstninja111 - github.com/firstninja111 • [Archive](https://archive.ph/tFeQG) - cloudrider.m92@gmail.com - 0x92cd7363c5b1853bc8fe6b5ae269836fc508ca73 #### Mike Willie Lee -…
    DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “Jordan Lopez” · published 2025-06-19 · pulled 2026-08-30

https://github.com/warmth1224

github profile IT Worker Fraud CURATED live checked 2026-09-30

First seen 2026-09-29 · last seen 2026-09-29

Source

  • Found on 29 September 2026 by searching GitHub's code for the handles this site already holds for the persona (firstninja111) and reading the files that name them: contact blocks, profile READMEs and portfolio data in the persona's own repositories or in repositories that credit its accounts. Each value is cited to the file it was read from. Values in copied templates, client team pages and test data are not carried.
    github.com/warmth1224/engine/blob/fbc572c3942f31245e4fb183177753e918f8ac56/utils/data/personal-data.js — Chollima Hunter · under “Jordan Lopez” · published 2025-06-18 · pulled 2026-09-29

+14074369174

phone number IT Worker Fraud CURATED

First seen 2026-09-29 · last seen 2026-09-29

Line type

Line typeVoIP
CarrierGOOGLE VOICE
Rate centreKENANSVILLE, FL

Looked up 2026-09-30 at phonevalidator.com. This is a lookup of the line itself. A VoIP line is not evidence on its own.

Source

  • Found on 29 September 2026 by searching GitHub's code for the handles this site already holds for the persona (firstninja111) and reading the files that name them: contact blocks, profile READMEs and portfolio data in the persona's own repositories or in repositories that credit its accounts. Each value is cited to the file it was read from. Values in copied templates, client team pages and test data are not carried.
    github.com/warmth1224/engine/blob/fbc572c3942f31245e4fb183177753e918f8ac56/utils/data/personal-data.js — Chollima Hunter · under “Jordan Lopez” · published 2025-06-18 · pulled 2026-09-29

0x92cd7363c5b1853bc8fe6b5ae269836fc508ca73

wallet address IT Worker Fraud THIRD-PARTY REGISTRY

First seen unknown · last seen unknown

Source

  • Entry in the lazarus.group DPRK IT-worker registry, which asserts that these accounts belong to one operator. The registry publishes no methodology, so this is recorded as its claim and not as a finding of this site. Its evidence links and its cross-references to other operators in the same registry are deliberately not reproduced as indicators.
    lazarus.group/team/jordan-lopez — Lazarus Group DPRK IT-Worker Registry (lazarus.group) · under “Jordan Lopez / Nemanja Djordjevic / firstninja111” · pulled 2026-09-09

Sources

Back to all personas

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. Jordan Lopez as the name of the operator is the cited researcher’s assertion, repeated here as their claim.