MBenz12
Also reported as: Christmas Jin
A fabricated professional identity used in the DPRK remote IT-worker scheme. Most of what follows is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, MBenz12. The attribution is theirs, not this site's.
The remainder was read by this site from the account itself and is cited to the page and date it was read.
Identifiers attributed to this persona
6 indicators the sources below record for this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
Christmas Jin |
alias | |
https://hub.docker.com/u/mbenz12 |
dockerhub account | live |
mbenz10120112@gmail.com |
email address | |
mbnez10120112@gmail.com |
email address | |
https://github.com/mbenz12 |
github profile | live |
https://gitlab.com/mbenz12 |
gitlab account | live |
Christmas Jin
alias IT Worker Fraud CURATED
Source
-
Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under mbenz12, a login the index already carries for this persona on another platform. The profile gives a member-since date of 23 May 2022. It displays the name Christmas Jin, which no source this site holds had attached to this operator before. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.
gitlab.com/MBenz12 — Chollima Hunter
https://hub.docker.com/u/mbenz12
dockerhub account IT Worker Fraud CURATED live
live
Source
-
Found on 17 September 2026 by asking Docker Hub whether an account exists under mbenz12, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 20 September 2023. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
hub.docker.com/u/mbenz12 — Chollima Hunter
mbenz10120112@gmail.com
email address IT Worker Fraud MATCHED IN SOURCE
Sources
-
A fourteen-post thread on the accounts that worked on Tokamak Network's bridge front end, marketplace and subgraph between November 2023 and February 2025, read as a single cell from the primary account's following list, commit-email forensics, renamed and deleted handles, and account-creation dates clustered within days of each other. Every value here is stated in the thread; post thirteen is the researcher's own address map for the cell. Post nine: created 7 March 2022 with a GitHub id consecutive to JamesH0807's, about three minutes apart, which the researcher reads as batch creation from one session.
x.com/meow_mfer/status/2045112535968596342 — meow mfer (@meow_mfer) -
…ng@gmail.com max.cricle@gmail.com maxb47163@gmail.com maximpdev@gmail.com maxivinc0507@gmail.com maxstevens.st@gmail.com maybex66@gmail.com mbenz10120112@gmail.com megebeb119@mustbeit.com mehmetdemir.58fr@gmail.com meidancrystalhero@gmail.com melodydev0521@gmail.com melodyxpot@gmail.com michael.elliott…
Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File
mbnez10120112@gmail.com
email address IT Worker Fraud CURATED
Source
-
Read on 20 September 2026 by walking the commit history of every repository on the GitHub account github.com/mbenz12, already held under this persona, and tallying the author line on every commit. A commit's author line is what the holder configured their git client with rather than anything the profile page chooses to display, so it recovers addresses the account never states. The address recorded here was not already in this index: mbnez10120112@gmail.com authored 3 commits across 2 of its repositories, commits as "mbenz12". Each is admitted because it commits under a name the account itself uses, which is the test that separates the holder's own address from the original author of a repository copied in. Addresses belonging to unrelated developers whose work appears in these repositories are deliberately not recorded, and an address is evidence that whoever held it wrote those commits rather than proof of who holds the account.
github.com/mbenz12 — Chollima Hunter
https://github.com/mbenz12
github profile IT Worker Fraud RESEARCHER POST live
live
Source
-
A fourteen-post thread on the accounts that worked on Tokamak Network's bridge front end, marketplace and subgraph between November 2023 and February 2025, read as a single cell from the primary account's following list, commit-email forensics, renamed and deleted handles, and account-creation dates clustered within days of each other. Every value here is stated in the thread; post thirteen is the researcher's own address map for the cell. Post nine: created 7 March 2022 with a GitHub id consecutive to JamesH0807's, about three minutes apart, which the researcher reads as batch creation from one session.
x.com/meow_mfer/status/2045108605028831330 — meow mfer (@meow_mfer)
https://gitlab.com/mbenz12
gitlab account IT Worker Fraud CURATED live
live
Source
-
Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under mbenz12, a login the index already carries for this persona on another platform. The profile gives a member-since date of 23 May 2022. It displays the name Christmas Jin, which no source this site holds had attached to this operator before. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.
gitlab.com/MBenz12 — Chollima Hunter
Sources
- Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File
- x.com/meow_mfer/status/2045108605028831330 — meow mfer (@meow_mfer)
- x.com/meow_mfer/status/2045112535968596342 — meow mfer (@meow_mfer)
- gitlab.com/MBenz12 — Chollima Hunter
- hub.docker.com/u/mbenz12 — Chollima Hunter
- github.com/mbenz12 — Chollima Hunter