Over
the holidays I found time to go through more than 100 pages of criminal
complaints, indictments and other resources that described how the
vendors Blime-Sub (a.k.a. BTH-Overdose) and CaliGirl got busted. Now
what is different compared to the first two parts [#1 and #2] is that these two cases are described in great detail and walk the reader through the entire investigation step-by-step.
Since they are quite lengthy I outlined the important parts of the
investigation and wrote down the mistakes that the vendors did which
eventually led to their bust. While the Blime-Sub bust is quite fresh
[just 2 months ago], the CaliGirl case dates back to the good old SR
days. However it is one of the best documented ones and many of the
investigation techniques are still used today. In this edition we have
some classic pitfalls like getting identified while buying the postage
or leaving a detailed money trail but also some new ones, that have not
been mentioned in the previous two parts.
I strongly encourage every vendor to read through these notes and
analyse their own operation so they do not make the same mistakes that
their colleagues/competition did. In the end it is not only your own
future that is at risk but also the one of your customers. Please read
the whole post because it not only includes stupid
vendor mistakes that you probably would never make, but also some tricky
pitfalls which you would miss out if you just skim the post.
Before I come to the busts themselves I want to briefly talk about
some aspects that are so important that I think they deserve a specific
mention:
one involved Task Force Agent [TF agent in the following] even
has "additional advanced training and epxerience in Computer Networking
and Unix Systems Administration" -> that was 3 years ago, imagine how
many resources they put into dnm vendor investigations nowadays
vendor used an alias similar to his real name [Matthew Jones]: Mateo Jones
CaliGirl was among the top 5% of all vendors operating on SR -> high profile
law enforcement made 2 undercover purchases on SR and 6 off-site [all between July 2013 and March 2014]
law enforcement was able to indetifiy what products he sold how
often and his total sales volume because SR provided a detailed public
record of it -> do not use markets that do not obfuscate this
information
although CaliGirl used many different return addresses some of
them were handwritten and some were business addresses [not a smart
idea, see part 2], plus the tracking number revealed where the packages
were shipped from
for his fifth purchase the TF agent placed the order on January
3, 2014 but requested that it should not be shipped until January 23
[this could be a potential red flag for other vendors] -> the TF
agent then had time to go to the mail processing plant that handled most
of the previous undercover packages and attempted to profile additional
packages that matched packages sent by CaliGirl
they found and seized 4 matching packages which originated from
one mail collection box half a mile from Jones's residence away, all 4
packages had the same return address and one of it was the undercover
order
on January 13, 2014, the TF agent opened a suspicious package
[taped excessively] that was sent to one of Jones's drops [where he
received the products that he resold under the CaliGirl account], it
contained almost 700 Hydrocodone tablets and was addresses to "Tyler
Zeddai"
CaliGirl offered the TF agent a special deal for Hydrocodone
tablets and also sent him information about them [a link to a pill
identification website] -> the branding and picture supplied by
CaliGirl matched the seized tablets on January 13 -> the TF agent
made the purchase
for his next undercover order [undercover purchase #8] the TF
agent claimed to be short on bitcoins and CaliGirl provided him with a
contact [name, telephone number and local bitcoins username] that could
sell him bitcoins for cash -> that contact [Jones] was CaliGirl
himself
apparently the TF agent told Jones [when they talked about
purchasing bitcoins] that he wanted to provide him with $1k to convert
into bitcoins and then transfer the coins to CaliGirl [Jones should
transfer the coins to CaliGirl not the TF agent] -> indication that
Jones at least knew CaliGirl [because Jones knew CaliGirl well enough to
send him the coins]
after the bitcoin purchase from Jones [$952, because Jones took a
commision] the TF agent contacted CaliGirl about the order ->
CaliGirl said that it had already been shipped and the $1k were credited
towards the purchase -> further indication that Jones and CaliGirl
are somehow connected
the phone number that CaliGirl gave to the TF agent to contact
Jones in order to buy bitcoins was purchased on Jones name one minute
before CaliGirl mentioned it in his message -> further indication
that CaliGirl was probably Jones
the features of the packages that CaliGirl sent which remained
consistent included: the manner in which the sender and recipient
addresses were printed and affixed, the placement and method of postage,
and the type of envelope utilized -> made packe profiling easier
the postage used for the purchase mentioned above was an
Automated Postal Center [APC] computer generated postage stamp -> the
TF agent was able to get the purchase date and location of the machine
that was used to buy the postage
since the machine stored images of the persons that used it, he
was also able to get an image of the person who bought the postage in
question -> compared this image to known images of Jones [including
publically available images on facebook] -> matched
postage was paid for by the utilization of $5.00+ face-value
stamps and the tracking numbers were affixed prior to mailing for every
package -> he did not have to pass the packages over a post office
counter where he could get identified by postal staff or video
surveillance systems -> however he fucked up with the package sent on
March 18, 2014 which had APC printed postage
he used the same return address for every package but switched it
once every week -> this and other mistakes allowed detailed package
profiling which made it possible for law enforcement to indentify a
total of 135 packages sent by Jones -> package profiling is a great threat so take counter measures
some return addresses that CaliGirl used were connected to his
real indentity [Matthew Jones]: e.g. a Hotel address were he stayed or a
company which he owned -> do not do that
Jones' P.O. box [where he received his products which he resold]
was opened under his name and "Tyler Zeddai" -> all incoming mail was
addressed to Tyler Zeddai but always picked up by Jones or his spouse
-> manager found that suspicious [he did not contact law enforcement
but when the TF agent interviewed him he was very talkative -> maybe avoid P.O. boxes from "EZ Mail Services"]
vendors: if you have to use P.O. boxes switch them once
in a while [and use different companies] so it is more difficult for law
enforcement to uncover the whole scope of your operation. also do not
use these addresses for other purposes like opening bank accounts, which
Jones did.
the TF agent also reviewed records obtained from amazon about
Jones' purchases which included purchase, shipping, billing, and IP
address information -> he bought zip lock baggies and bubble mailer
manila envelopes which were also used for shipping the undercover
purchases -> do not order your shipping equipment online or at least not with your identity
he also travelled to Colombia frequently -> the TF agent
compared these dates with the times when CaliGirl was on vacation ->
matched -> vendors should go to fake vacations [vacation mode
on the market but continuing their everyday life] and extended vactions
[do not go into/come back from vaction on the exact days when you
actually go away/come back]
Note: Jones bought Oxycodone and Hydrocodone in Colombia
and shipped them to the P.O. box mentioned above: it is easier and
cheaper to get these products in Colombia and they are marked like many
other tablets -> careful inspection or laboratory anaylsis needed to
indentify them -> preferred by drug traffickers
Xoom [an online wire transfer service where he had an account
with his real data] revealed that he transferred over $58k from January
2012 to August 2013 to Colombia
some of these transfers were sent to "Mateo Jones" which is an alias utilized by Matthew Jones on facebook -> please learn to separate identities properly
transactions have been structured in a manner to intentionally
avoid triggering money laundering and reporting requirements [e.g.
multiple transaction on the same day to the same person] -> say hello
to another charge
he should have taken the money in cash with him on the plane or
mail it to Colombia instead of producing all the detailed evidence by
using Xoom
"The Wells Fargo counter and ATM deposits [to one of Jones'
accounts] were in inconsistent amounts, occurred on a variety of dates,
and were made at a variety of geographical areas. Based on my training
and experience, this activity is consistent with Bitcoin sales where a
Bitcoin customer makes a pre-arranged counter-deposit into a Bitcoin
dealer's bank account. The deposit slips contain only the minimum amount
of information required to make a cash deposit. Based on my training,
experience, and this investigation, this is common behavior utilized by
Bitcoin exchangers and drug traffickers a when utilizing counter
deposits to transmit currency." this was written 3 years ago,
vendors should finally start using methods that do not create extensive
and suspicious paper trails to cash out their bitcoins
he used small variations in telephone numbers, addresses and
other identifying information for receiving funds in his Western Union
account -> this is a common method drug traffickers and money
launderers utilize to avoid detection by law enforcement -> do not do
this
Jones used only one account on the exchanges [local bitcoins and
and bitcoin-otc] to cash out his bitcoins for his entire vending time
and also publicly linked the accounts on both sites
'fun' fact: a screen shot [exhibit 1] shows that law enforcement
does not even disables javascript globally and seems to be using windows
-> they really need to step up their opsec :)
I also wrote an article on deepdotweb about this bust using these notes, so if you read it you can skip the following notes. /u/deepdot can you please post a short 'confirmed' comment so that people know that I am not bullshitting?
after getting training on how to use dnms a DEA agent began
analyzing and investigating top heroin vendors on alphabay in january
2016
he initiated a full investigation into the vendors Blime-Sub and BTH-Overdose in september 2016
he knew they were shipping from the west coast (possibly somewhere in california) because customers mentioned it in forums
BTH-Overdose (Emil Babadjov) used the same email address for his
pgp key as he used for his facebook account with his real name (but
written backwards)
Babadjov made a public facebook post in september 2015 that
people could contact him through the email address he also used for his
pgp keys
on November 14th, 2016, the agent sent a subpoena to coinbase to get any information they have about the email address
he received replies from Coinbase on the very same day and one day after:
- the email address was used to create an account in November 2015 for "Emil Babadjov"
- on March 18, 2016, he attempted to create another account with the
name "Emil Babadjov" and the email address "blimesub@***.com"
-> do not mix vendor identities with exchange accounts and do not use
vendor email addresses for any other purpose than talking to customers
on November 14th, 2016, the agent got Babadjov's address (through
his drivers license) and found out that he was arrested in 2013 for
possession of controlled substances (but the charge was dismissed)
on October 19, 2016, the agent bought $800 worth of bitcoins to buy 3g heroin on the next day from Blime-Sub on alphabay
the parcel (UC parcel #1) arrived on October 25 at the undercover
address and he got the return address and tracking number of it
the product in the package was submitted to the DEA western
regional lab for fingerprint and drug analysis after it got tested
positive for heroin
the agent got a response from the lab on November 10, 2016, which stated that it was a mix of heroin and fentanyl
the US postal inspector was able to conduct comparative analysis
of these parcels to identify who purchased the postage for UC parcel #1
due to the Postage Validation Imprinter (PVI) the US postal
inspector was able to see that the postage was bought on september 18
2016 at 4:03 PM via a Self-Service Kiosk (SSK) 0.7 miles away from
Babadjov's known address
the US postal inspector gave the photo that was taken by the SSK system during the transaction to the agent
he identified the person in the photo as Emil Babadjov according to the drivers license and social media photos of Babadjov
on November 16, 2016, the agent received another response from
the DEA western regional lab that stated that two fingerprints belonging
to Babadjov were found on the exterior of UC parcel #1
That is it for now, if you know other busts that could provide useful
information or additions to the summarized ones please leave a comment
here.
One last shameless self-promotion: I developed an Addon for Firefox
[also compatible with the Tor browser] which lets you view selfposts of
NSFW subs [like this one] without having to enable JavaScript. The
source code is of course publicly available, so check it out if you want
to boost your opsec: https://www.reddit.com/r/DarkNetMarkets/comments/5ek0lm/a_present_for_the_lurkers_on_here/
[–]cidilicious 208 points209 points210 points (8 children)
[–]free-agent 64 points65 points66 points (5 children)
[–][deleted] (4 children)
[deleted]
[–][deleted] (1 child)
[removed]
[–]AutoModerator[M] 0 points1 point2 points (0 children)
[–]free-agent 10 points11 points12 points (1 child)
[–]1835Cartel 2 points3 points4 points (0 children)
[–]Wombattington[🍰] 2 points3 points4 points (0 children)
[–]ahismyidol 35 points36 points37 points (5 children)
[–]wombat2combat[S] 27 points28 points29 points (3 children)
[–][Fresh Account]Nigletpapar 10 points11 points12 points (0 children)
[–]trentreznorthrowaway 0 points1 point2 points (1 child)
[–]wombat2combat[S] 1 point2 points3 points (0 children)
[–]deepdot 29 points30 points31 points (0 children)
[–]SketchyyG 20 points21 points22 points (0 children)
[–]bmoreproduct1 78 points79 points80 points (3 children)
[–]wombat2combat[S] 26 points27 points28 points (2 children)
[+][deleted] (1 child)
[deleted]
[–]wombat2combat[S] 24 points25 points26 points (0 children)
[–]roare 11 points12 points13 points (0 children)
[–][deleted] 22 points23 points24 points (14 children)
[–]BassNet 17 points18 points19 points (0 children)
[–]Spodur 8 points9 points10 points (3 children)
[–]wombat2combat[S] 16 points17 points18 points (2 children)
[–]Spodur 8 points9 points10 points (1 child)
[–]tractorferret 9 points10 points11 points (0 children)
[–]murderhomelesspeople -10 points-9 points-8 points (8 children)
[–]Farmy 7 points8 points9 points (1 child)
[–]murderhomelesspeople 4 points5 points6 points (0 children)
[–]inEuph0ria 5 points6 points7 points (3 children)
[–]murderhomelesspeople 3 points4 points5 points (2 children)
[–]wombat2combat[S] 7 points8 points9 points (1 child)
[–]murderhomelesspeople 1 point2 points3 points (0 children)
[–][deleted] (1 child)
[removed]
[–]AutoModerator[M] 0 points1 point2 points (0 children)
[–]Immaloner 16 points17 points18 points (2 children)
[–][deleted] 8 points9 points10 points (1 child)
[–]blackhand25 8 points9 points10 points (0 children)
[+][deleted] (1 child)
[deleted]
[–]Udaypbuh 2 points3 points4 points (0 children)
[–]AlpraKing 32 points33 points34 points (4 children)
[–]murderhomelesspeople 62 points63 points64 points (1 child)
[–]pnchdrnk 42 points43 points44 points (0 children)
[–]honestlyimeanreally 7 points8 points9 points (0 children)
[–]RookieMafia 0 points1 point2 points (0 children)
[–][deleted] 7 points8 points9 points (0 children)
[–]Florida51 9 points10 points11 points (13 children)
[–]wombat2combat[S] 23 points24 points25 points (2 children)
[–]ItsOxymorphinTime 14 points15 points16 points (0 children)
[–]Florida51 2 points3 points4 points (0 children)
[–]hhayn 7 points8 points9 points (9 children)
[–]wombat2combat[S] 15 points16 points17 points (5 children)
[–]hhayn 5 points6 points7 points (3 children)
[–]wombat2combat[S] 4 points5 points6 points (1 child)
[–]Seraphim_X 0 points1 point2 points (0 children)
[–]hhayn 1 point2 points3 points (0 children)
[–][deleted] (2 children)
[removed]
[–]AutoModerator[M] 1 point2 points3 points (1 child)
[–]postmort3m 0 points1 point2 points (0 children)
[+][deleted] (1 child)
[deleted]
[–]Jethro23 0 points1 point2 points (0 children)
[–]murderhomelesspeople 5 points6 points7 points (0 children)
[–]XxExpansionxX 1 point2 points3 points (2 children)
[–]wombat2combat[S] 2 points3 points4 points (1 child)
[–]XxExpansionxX 1 point2 points3 points (0 children)
[–]thascarecro 1 point2 points3 points (2 children)
[–]Trinklefat 0 points1 point2 points (0 children)
[–]BakedPastaParty 0 points1 point2 points (0 children)
[–]Trinklefat 1 point2 points3 points (4 children)
[–]wombat2combat[S] 1 point2 points3 points (3 children)
[–]BakedPastaParty 0 points1 point2 points (2 children)
[–]wombat2combat[S] 0 points1 point2 points (1 child)
[–]BakedPastaParty 0 points1 point2 points (0 children)
[–]BGFlyingToaster 1 point2 points3 points (0 children)
[–]Nurah 1 point2 points3 points (7 children)
[–]wombat2combat[S] 0 points1 point2 points (6 children)
[–][deleted] (5 children)
[removed]
[–][deleted] 0 points1 point2 points (2 children)
[–][deleted] (1 child)
[removed]
[–]AutoModerator[M] 0 points1 point2 points (0 children)
[–]wombat2combat[S] 0 points1 point2 points (0 children)
[–]AutoModerator[M] 0 points1 point2 points (0 children)
[–]mattelwensh 1 point2 points3 points (0 children)
[–]MollieIsYourFriend 1 point2 points3 points (0 children)
[–]ishq 0 points1 point2 points (0 children)
[–]crystalizedpoundz47 0 points1 point2 points (0 children)
[–]hhayn 0 points1 point2 points (0 children)
[–]_Thunder_Child_ 0 points1 point2 points (0 children)
[–]Selectivescammer1 0 points1 point2 points (1 child)
[–]wombat2combat[S] 3 points4 points5 points (0 children)
[–]Udaypbuh 0 points1 point2 points (2 children)
[–]wombat2combat[S] 0 points1 point2 points (1 child)
[–]Udaypbuh 1 point2 points3 points (0 children)
[–]Derrick4Real 0 points1 point2 points (0 children)
[–]regulardoobage 0 points1 point2 points (0 children)
[–]TheBitterBuffalo 0 points1 point2 points (5 children)
[–]wombat2combat[S] 2 points3 points4 points (4 children)
[–]TheBitterBuffalo 0 points1 point2 points (3 children)
[–]wombat2combat[S] 0 points1 point2 points (2 children)
[–]TheBitterBuffalo 0 points1 point2 points (1 child)
[–]wombat2combat[S] 1 point2 points3 points (0 children)
[–]throwahooawayyfoe 0 points1 point2 points (0 children)
[–]python134r 0 points1 point2 points (0 children)
[–]LibertyDNM 0 points1 point2 points (0 children)
[–]Kofeb 0 points1 point2 points (2 children)
[–]wombat2combat[S] 0 points1 point2 points (1 child)
[–]Kofeb 0 points1 point2 points (0 children)
[–]AutoModerator[M] -2 points-1 points0 points (0 children)
[–]Razbonez -2 points-1 points0 points (0 children)
reddit gold
In Summation
Want to say thanks to %(recipient)s for this comment? Give them a month of reddit gold.
Please select a payment method.
Give gold often? Consider buying creddits to use, they're 40% cheaper if purchased in a set of 12.
Would you like to learn more about giving gold?
reddit gold
In Summation
Want to say thanks to %(recipient)s for this submission? Give them a month of reddit gold.
Please select a payment method.
Give gold often? Consider buying creddits to use, they're 40% cheaper if purchased in a set of 12.
Would you like to learn more about giving gold?