lambook35
Also reported as: Daichi Okazaki
A fabricated professional identity used in the DPRK remote IT-worker scheme. Most of what follows is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, lambook35. The attribution is theirs, not this site's.
The remainder was read by this site from the account itself and is cited to the page and date it was read.
The profile picture the researcher published beside this address.
Identifiers attributed to this persona
3 indicators the sources below record for this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
Daichi Okazaki |
alias | |
lambook35@gmail.com |
email address | |
https://gitlab.com/lambook35 |
gitlab account | live |
Daichi Okazaki
alias IT Worker Fraud CURATED
Source
-
Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- lambook35 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Daichi Okazaki. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
gitlab.com/lambook35 — Chollima Hunter
lambook35@gmail.com
email address IT Worker Fraud MATCHED IN SOURCE
Sources
-
Published on 17 May 2025 in a thread the researcher opened with "Lets play a profile picture game! Here are a few fun DPRK ITW/remote worker profile pics and their associated emails." Each post in it pairs one address with the profile photograph used alongside it. This entry is one such post: the address lambook35@gmail.com and the picture below it. The photograph is mirrored here because these posts are the only published record of the face an operator presented, and the accounts they came from are routinely deleted. It is not evidence of who operates the address: a profile picture in this dataset is as likely to be generated, stock, or taken from an uninvolved person. The researcher gives no name, and the address does not read as one, so the page is filed under the address’s own local part rather than under a name invented for it.
x.com/browsercookies/status/1923880294744207539 — Cookie Connoisseur (@browsercookies) -
…@minutestep.com kylecollins412@gmail.com kyler714307@gmail.com kyrychenkov30@gmail.com lael.damareon@minofangle.org lambertlee410@gmail.com lambook35@gmail.com lancerok8@gmail.com larrypotter0000@gmail.com larrywilkerson663@gmail.com layton.hart.cool@gmail.com lazyknight223@gmail.com lclement927@gm…
Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File
https://gitlab.com/lambook35
gitlab account IT Worker Fraud CURATED live
live
Source
-
Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- lambook35 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Daichi Okazaki. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
gitlab.com/lambook35 — Chollima Hunter
Sources
- Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File
- x.com/browsercookies/status/1923880294744207539 — Cookie Connoisseur (@browsercookies)
- gitlab.com/lambook35 — Chollima Hunter