Li Qiang
A fabricated professional identity used in the DPRK remote IT-worker scheme. Everything below is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, Li Qiang. The attribution is theirs, not this site's.
Portrait published in the cited post. It shows the image the identity presented as itself, not necessarily a photograph of the operator.
Identifiers attributed to this persona
7 indicators the source attributes to this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
Li Qiang |
alias | |
businessvibes.financial |
domain | |
codestaff.io |
domain | |
expertweblancer.com |
domain | |
financemydeductible.com |
domain | |
getcodestaff.io |
domain | |
orioncoding.com |
domain |
Li Qiang
alias IT Worker Fraud RESEARCHER POST
Source
-
The post names the operator as Li Qiang, says the operator has a large number of online personas, and lists six domains under which the operator owns email addresses. The domains are transcribed from the post text, where they appear defanged; they are recorded here refanged, which is the form the rest of this dataset uses. The post also tags another account, which is a credit to a fellow researcher rather than an operator identifier, and is not recorded.
x.com/browsercookies/status/1926881589801202002 — Cookie Connoisseur (@browsercookies)
businessvibes.financial
domain IT Worker Fraud RESEARCHER POST
Registration
The registry had no record of businessvibes.financial when it was looked up on 2026-10-05: the registration had lapsed or been deleted.
Source
-
The post names the operator as Li Qiang, says the operator has a large number of online personas, and lists six domains under which the operator owns email addresses. The domains are transcribed from the post text, where they appear defanged; they are recorded here refanged, which is the form the rest of this dataset uses. The post also tags another account, which is a credit to a fellow researcher rather than an operator identifier, and is not recorded.
x.com/browsercookies/status/1926881589801202002 — Cookie Connoisseur (@browsercookies)
codestaff.io
domain IT Worker Fraud RESEARCHER POST
Source
-
The post names the operator as Li Qiang, says the operator has a large number of online personas, and lists six domains under which the operator owns email addresses. The domains are transcribed from the post text, where they appear defanged; they are recorded here refanged, which is the form the rest of this dataset uses. The post also tags another account, which is a credit to a fellow researcher rather than an operator identifier, and is not recorded.
x.com/browsercookies/status/1926881589801202002 — Cookie Connoisseur (@browsercookies)
expertweblancer.com
domain IT Worker Fraud RESEARCHER POST
Registration
The registry had no record of expertweblancer.com when it was looked up on 2026-10-05: the registration had lapsed or been deleted.
Source
-
The post names the operator as Li Qiang, says the operator has a large number of online personas, and lists six domains under which the operator owns email addresses. The domains are transcribed from the post text, where they appear defanged; they are recorded here refanged, which is the form the rest of this dataset uses. The post also tags another account, which is a credit to a fellow researcher rather than an operator identifier, and is not recorded.
x.com/browsercookies/status/1926881589801202002 — Cookie Connoisseur (@browsercookies)
financemydeductible.com
domain IT Worker Fraud RESEARCHER POST
Registration
| Registered | 2025-12-15 |
|---|---|
| Registrar | GoDaddy.com, LLC |
| Expires | 2026-12-15 |
| Last changed | 2025-12-15 |
| Status | client delete prohibited, client renew prohibited, client transfer prohibited, client update prohibited |
Source
-
The post names the operator as Li Qiang, says the operator has a large number of online personas, and lists six domains under which the operator owns email addresses. The domains are transcribed from the post text, where they appear defanged; they are recorded here refanged, which is the form the rest of this dataset uses. The post also tags another account, which is a credit to a fellow researcher rather than an operator identifier, and is not recorded.
x.com/browsercookies/status/1926881589801202002 — Cookie Connoisseur (@browsercookies)
getcodestaff.io
domain IT Worker Fraud RESEARCHER POST
Source
-
The post names the operator as Li Qiang, says the operator has a large number of online personas, and lists six domains under which the operator owns email addresses. The domains are transcribed from the post text, where they appear defanged; they are recorded here refanged, which is the form the rest of this dataset uses. The post also tags another account, which is a credit to a fellow researcher rather than an operator identifier, and is not recorded.
x.com/browsercookies/status/1926881589801202002 — Cookie Connoisseur (@browsercookies)
orioncoding.com
domain IT Worker Fraud RESEARCHER POST
Registration
| Registered | 2025-09-12 |
|---|---|
| Registrar | Unstoppable Domains Inc. |
| Expires | 2027-09-12 |
| Last changed | 2026-09-13 |
| Status | client delete prohibited, client transfer prohibited |
Source
-
The post names the operator as Li Qiang, says the operator has a large number of online personas, and lists six domains under which the operator owns email addresses. The domains are transcribed from the post text, where they appear defanged; they are recorded here refanged, which is the form the rest of this dataset uses. The post also tags another account, which is a credit to a fellow researcher rather than an operator identifier, and is not recorded.
x.com/browsercookies/status/1926881589801202002 — Cookie Connoisseur (@browsercookies)
Sources
- x.com/browsercookies/status/1926881589801202002 — Cookie Connoisseur (@browsercookies)