ALPHABAYAUSTRIASometime in October 2015, the
31yo male Viennese AlphaBay seller ShanSa was arrested in Austria; the search turned up records of 182 international & 73 Austrian sales, amphetamine/MDMA/cocaine/LSD/RCs/tablet machine.
USA38yo Californian man David Ryan Burchard (CaliConnect/the_real_caliconnect/caliconnect4life), a major marijuana & cocaine on SR1 (DoJ claims >$1.4m in sales based on the SR1 server image
[SUP]1[/SUP]) and then Agora, Nucleus, Abraxas, and AlphaBay, was raided 21 January 2016 and arrested 28 March 2016 (
press release;
complaint), following an investigation starting March 2015 into the large number of bitcoins he had been selling to an unlicensed digital currency exchanger (possibly another SR1 user named fishing01) which, after tracking devices monitored him dropping off packages & unencrypted PMs contained tracking numbers from the SR1 server image was further linked to his area, was combined with an earlier postal investigation into an undeliverable package which was opened & contained marijuana and Burchard’s packages were intercepted; the unencrypted SR1 PMs further indicated that CaliConnect was using MoneyPak and gave the transaction IDs of several, one of which MoneyPak & AccountNow subpoenas revealed was paid to David Burchard, and had sent his personal information unencrypted to a SR1 seller of fake IDs and a benzo seller. This was followed up by a undercover purchase on AlphaBay (Burchard’s primary market in 2016) & surveillance of Burchard mailing it. After the raid, several of Burchard’s computer records were decrypted by trying a password he reused on a subpoenaed website, revealing at least 49 buyer records.
[SUP]2[/SUP]
35yo Minnesotan man Aaron James Glende (IcyEagle) was
raided 11 March 2016 based on USPS information, turning up Xanax & cash & other prescriptions (charged with Xanax, oxycodone, amphetamine, diazepam, and marijuana); the local Minnesota case was apparently promoted to the federal level as the fully sealed case 1:16-mj-366. In July 2016, charges in another (apparently unrelated?) case were filed in Georgia based on an undercover agent purchase of bank account information from IcyEagle (case gandce 1:2016-cr-00239;
press release;
indictment) but he had already been arrested. Neither the press release nor indictment specifies how an undercover purchase of digital information could possibly lead to his deanonymization or arrest, and the majority of documents in that case as well as the complaint have been sealed. (I wonder what the connection between the cases is, why Glende was still selling even after his raid, and what all the sealing is about in his case?)
26yo South Florida man Chrissano S. Leslie (Owlcity), who sold fentanyl, alpha-PVP, MDMA, cocaine & Xanax, was
raided & arrested 27 July 2016(
complaint). The DEA had made a number of undercover buys which were mailed from south Florida, and de-anonymized Owlcity when he checked the USPS.com tracking number of one of the undercover orders, revealing his IP to the USPS: On February 26, 2016, DEA agents received information from the U.S. Postal Service (USPS) that the tracking status of the Priority Mail package that OWLCITY sent to complete the October 23, 2015 heroin order was queried online on the U.S. Postal Service website from an IP address assigned by AT&T to an account associated with the Leslie Residence.After that, they began in-person surveillance of Leslie, watching him drive to the post office with additional orders & intercepted the packages, ISP monitoring of Tor activity, correlation of Owlcity inactivity with computer repair, and finally a raid 27 July 2016.
On 2 August 2016, Pakistani & Yemeni men Abdullah Almashwali (31) and Chaudhry Ahmed Farooq (24) were arrested in NY for selling cocaine & heroin on Alphabay (
although they’d also sold on Dream, Oasis, Nucleus & Agora) as the sellers Area51/DarkApollo (
complaint,
press release,
media) An investigation starting March 2016 began with their PGP keys whose metadata used a nickname that led to Twitter, Instagram, and Facebook accounts; subpoenas turned up Farooq’s real name although he was already under investigation by the DEA (detailed are sealed/redacted due to use of a confidential source). Some undercover purchases on AB found they reused a Brooklyn return address, LE lifted fingerprints from the package, and the packages’ postage had been paid for from postage kiosks which take credit cards & photographs of buyers (see also MDpro) and the mail cover database turned up further packages linked to them (likely searching for other packages using the same return address & checking postage purchase records again).
50yo Texan man Cary Lee Ogborn was arrested on 16 September 2016 in a controlled delivery after trying to buy explosives off an undercover FBI seller on Alphabay (
press release;
complaint; media:
1,
2); worsening his troubles, he communicated with the undercover agent using a clearnet email account linked to his name & IP.
Emil Vladimirov Babadjov (31) was arrested on 9 December 2016 for selling fentanyl and heroin on Alphabay and Dream (complaint, press release). He also had a profile on Valhalla but it is unclear whether he was the one that created and controlled it, since it has listed a different public PGP key and Valhalla is known to allow vendor impostors. The main investigation started in September 2016 when his PGP key’s metadata led the agents to his Facebook and Coinbase account. A subpoena to Coinbase then revealed his real name and the agents started making orders from the Blime-Sub vendor account on Alphabay. Due to the Postage Validation Imprinter (PVI) a US postal inspector was able to see that the postage for one parcel was bought on 18 September 2016 via a Self-Service Kiosk (SSK) near Babadjov’s known address. The man on the photo that was taken by the SSK system during the transaction was identified as Emil Babadjov according to the drivers license and social media photos of Babadjov. On 16 November 2016, the agents received another response from the DEA western regional lab that stated that two fingerprints belonging to Babadjov were found on the exterior of a parcel that they ordered in an UC purchase. More details to the bust here.
