• Home
  • Become a Hacker
    • Get Started
    • Hacker Mindset
    • Roadmap
    • Simple Setup – Hacker 101
    • Types of Hackers
    • Recommended Courses
  • Boot People Offline
  • Courses
    • All Hacking Courses
    • Cyber Security School
  • CTF
    • Beginners to Advanced Guide
    • Create your own CTF box
    • Field and Resources Guide
    • Platforms & Wargames
    • Tools Used for Solving CTF
    • Writeups
  • Dark Web
    • Beginners Guide
    • Darknet Markets
    • Darkweb 101 (Anonymity Guide)
    • Dark Web OSINT Tools
    • Hacking Forums
    • Latest News
    • Onion Links
  • Hacker Gadgets
  • Hacking Books
  • Tools Directory
Menu
  • Home
  • Become a Hacker
    • Get Started
    • Hacker Mindset
    • Roadmap
    • Simple Setup – Hacker 101
    • Types of Hackers
    • Recommended Courses
  • Boot People Offline
  • Courses
    • All Hacking Courses
    • Cyber Security School
  • CTF
    • Beginners to Advanced Guide
    • Create your own CTF box
    • Field and Resources Guide
    • Platforms & Wargames
    • Tools Used for Solving CTF
    • Writeups
  • Dark Web
    • Beginners Guide
    • Darknet Markets
    • Darkweb 101 (Anonymity Guide)
    • Dark Web OSINT Tools
    • Hacking Forums
    • Latest News
    • Onion Links
  • Hacker Gadgets
  • Hacking Books
  • Tools Directory
Search
Close
  • Home
  • 2022
  • February
  • 5
  • Counterfeit Oxy Vendor “Ghost831” Sentenced to Prison

Counterfeit Oxy Vendor “Ghost831” Sentenced to Prison

February 5, 2022 Comments Off on Counterfeit Oxy Vendor “Ghost831” Sentenced to Prison
Counterfeit Oxy Vendor “Ghost831” Sentenced to Prison

An Arizona man was sentenced to prison for distributing a wide variety of drugs through the darkweb under the “Ghost831” vendor moniker.

According to court records (.org, .onion), 29-year-old Jacob Matthew Medina, of Glendale, Arizona, was imprisoned after he admitted that he had participated in a conspiracy to distribute fentanyl and heroin on the darkweb through a vendor account on Dream Market. The profile on Dream Market had the username “Ghost831.”

During execution of a search warrant, feds found 502 grams of counterfeit oxycodon pills.

The United States Postal Inspection Service (USPIS) launched an investigation into Medina’s drug trafficking operation in November 2018, after investigators discovered the “Ghost831” vendor account on Dream Market. The vendor sold heroin, methamphetamine, and counterfeit oxycodone pills.

During the investigations, investigators conducted an undercover purchase of heroin from “Ghost831.” Investigators also intercepted multiple drug packages that had been mailed by the vendor. Further investigations traced the packages back to Medina.

Investigators executed a search warrant at Medina’s home on March 4, 2019. The search resulted in the seizure of 502 grams of counterfeit oxycodone pills that tested positive for fentanyl, more than 400 grams of heroin, a list of customer mailing addresses, package tracking numbers, $31,000 in cash, and a firearm.

A picture of Feds found mailers and the usual vendor equipment during the raid.

Feds found mailers and the usual vendor equipment during the raid.

The investigators established that one of the customers who had purchased drugs from Medina had fatally overdosed.

Melisa Llosa, Inspector in Charge of the USPIS, Phoenix Division:

“Mr. Medina profited off of numerous individuals addicted to opioids with his fentanyl-laced pills. He utilized the dark web, mistakenly thinking he could outsmart the authorities. The US Postal Inspection Service is committed to investigating and dismantling drug trafficking organizations to keep US Postal Service customers and employees safe from such dangerous drugs.”

Medina pleaded guilty to conspiring in the possession of fentanyl and heroin with intent to distribute. On January 4, 2022, U.S. District Judge Douglas L. Rayes sentenced Medina to 13 years and four months in federal prison.


DNL: I want to add a little background to this case as I do not think we have covered it and the sentencing announcement contains very little information.

This case is a result of an investigation initiated by the Narcotics and Economic Crime Investigations (NECI) Task Force in Sacramento, CA. Undercover purchases revealed that the vendor operated out of Arizona. Investigators found that Medina and one of his co-conspirators had purchased postage at a USPS self service kiosk (SSK). Surveillance footage revealed that one of the people purchasing postage for packages associated with the vendor account was a “Hispanic male with a bard and goatee” who appeared to be between the ages of 20 and 30. They also matched the postage purchases with a pre-paid Visa card from Bancorp Bank.

A picture of A USPIS Activity/Investigation report

A USPIS Activity/Investigation report

There is a change.org petition calling for the release of an inmate named Jacob Matthew Medina that has a picture matching the description above. The petition claims that Medina is serving “a mandatory minimum of 10 years in prison for a alleged non violent drug offense” at an institution in Arizona. It provides a Central Arizona Florence Correctional Complex inmate number that matches the profile an inmate also matching the description of Medina with a 1992 DOB.

Interestingly, the criminal complaint described the U.S. Postal Inspection Service (USPIS) Cyber Crime Unit’s role in the investigation.

Postal Inspectors sent a request to the U.S. Postal Inspection Service (USPIS) Cyber Crime Unit for an analysis of “Ghost831.” Historical USPIS information showed a “Ghost831” registered accounts on the Alphabay (AB), Cloud9, Hydra, SilkRoad (SR), and SilkRoad 2.0 (SR2) markets. The following historical information was found for “Ghost831” on SR:

  • Registered: October 17, 2012.
  • Last Seen: September 22, 2013.
  • Private “sent” messages show “Ghost831” was selling Oxycodone.
  • “Ghost 831” identified his location as being in Arizona. On May 22, 2013, “Ghost831” posted “…in AZ theres a lot of BS here…”
  • On June 3, 2013, “Ghost831” identified himself as being 21 years old when he posted, “…I been hustling since I was 15 im 21 on june 3”’…” This would have meant the date of birth for “Ghost83 1” was June 3, ‘ 1992.
  • User Email: [email protected]

This information alone was enough to identify Medina, according to the complaint. And not through the use of a court order for subscriber information assosciated with the Yahoo email address.

On January 30, 2019, analysts utilized a law enforcement database to search for individuals who were arrested in Arizona with a date of birth of June 3, 1992 and a first initial of “J” based on the email address, [email protected], provided by “Ghost831” on SR. The research identified a male individual with the name of JACOB MATTHEW MEDINA (MEDINA). Analysts obtained a booking photo of MEDINA and visually compared the booking photo and his Arizona driver’s license photo with the SSK photos obtained of the male mailer on December 4, 2018. The comparison revealed the mailer to be MEDINA.

Investigators found Facebook profiles for Medina and the second defendant. They conducted an extensive physical surveillance campaign, following the defendants to Post Offices and grocery stores. And the rest is history.

Also, here is an excerpt from the USPIS Activity/Investigation Report filed by Postal Inspector Andrea Brandon

As of December 28, 2018, Postal Inspector Brandon still had not received anything. Postal Inspector Brandon logged into NFusion and the Dream Market and sent Ghost831 a message inquiring about the purchase. On the same day, Ghost831 responded and asked when the order was placed and what address it was supposed to go to. Postal Inspector Brandon provided the information and Ghost831 stated, “I believe yours is in route ill check later today? “

On December 31, 2018, Postal Inspector Brandon sent Ghost831 another message inquiring about the purchase. Ghost831 replied, We know we checked the tracking and its lost we gave you 3.5 and sent you a new one were sorry or the inconvenience?

On January 4, 2019, Postal Inspector Brandon was notified that the SUBJECT PARCEL had arrived at the undercover address.

On January 7, 2019, Postal Inspector Michael Kaminski took custody of the SUBJECT PARCEL and transported it to the U.S. Postal Inspection Service, Phoenix Headquarters, for evidence processing. The SUBJECT PARCEL is described as follows: One USPS First-Class parcel with a return address of “Gift card LLC, 6409 N. Scottsdale Rd., Scottsdale, AZ 85253? It is a manila envelope; measuring approximately 4” X 7”; mailed on 12/31/18 from a SSK at the Cactus Station, located at 2901 E. Greenway Rd., Phoenix, AZ 85032; with $1.00 in postage.

On January 11, 2019, Postal Inspectors McClamrock and Postal Inspector Shepard processed the SUBJECT PARCEL and contents, which revealed the following: one manila envelope and one small blue zip lock baggie containing a white crystallized substance. The total weight of the baggie and white crystallized substance was approximately 4.0 grams. Postal Inspector McClamrock conducted a TruNarc drug identification test (scan 329), which resulted in a positive alert for methamphetamine.


h/t to the person who pointed out that the archive.is onion does not require a captcha often, if ever.

Criminal complaint pdf
Plea agreement pdf

(via darknetlive.com at https://darknetlive.com/post/counterfeit-oxy-vendor-ghost831-sentenced-to-13-years-in-prison/)

Post navigation

SMBSR – Lookup For Interesting Stuff In SMB Shares
SentryPeer – A Distributed Peer To Peer List Of Bad Actor IP Addresses And Phone Numbers Collected Via A SIP Honeypot

Related Articles

Two Charged for Selling Counterfeit Oxycodone Pills

Two Charged for Selling Counterfeit Oxycodone Pills

- Dark Web News
July 7, 2022
Fraudulent Credit Card Maker Sentenced to 108 Months in Prison

Fraudulent Credit Card Maker Sentenced to 108 Months in Prison

- Dark Web News
July 6, 2022
‘Welcome To Video’ Admin Sentenced to Prison for Two Years

‘Welcome To Video’ Admin Sentenced to Prison for Two Years

- Dark Web News
July 5, 2022
hacker gadgets
hacker phone covers

Recent Posts

mx-takeover: detects misconfigured MX records

mx-takeover: detects misconfigured MX records

July 7, 2022
Two Charged for Selling Counterfeit Oxycodone Pills

Two Charged for Selling Counterfeit Oxycodone Pills

July 7, 2022
pywhisker: Python tool for Shadow Credentials attacks

pywhisker: Python tool for Shadow Credentials attacks

July 7, 2022
CrackQL - GraphQL Password Brute-Force And Fuzzing Utility

CrackQL – GraphQL Password Brute-Force And Fuzzing Utility

July 7, 2022
CVE-2022-2274: OpenSSL Remote Code Execution Vulnerability

CVE-2022-2274: OpenSSL Remote Code Execution Vulnerability

July 6, 2022
Fraudulent Credit Card Maker Sentenced to 108 Months in Prison

Fraudulent Credit Card Maker Sentenced to 108 Months in Prison

July 6, 2022

Social Media Hacking

SocialPath – Track users across Social Media Platforms

SocialPath – Track users across Social Media Platforms

- Social Media Hacking
October 16, 2019October 16, 2019

SocialPath is a django application for gathering social media intelligence on specific username. It checks for Twitter, Instagram, Facebook, Reddit...

SocialScan – Check Email Address and Username Availability on Online Platforms

SocialScan – Check Email Address and Username Availability on Online Platforms

June 17, 2019
Shellphish – Phishing Tool For 18 Social Media Apps

Shellphish – Phishing Tool For 18 Social Media Apps

June 10, 2019July 27, 2019
WhatsApp Hacking using QRLJacking

WhatsApp Hacking using QRLJacking

May 2, 2019May 19, 2019
How to Hack any Facebook Account with Z-Shadow

How to Hack any Facebook Account with Z-Shadow

April 26, 2019June 29, 2020
hacker buffs
ABOUT US

Haxf4rall is a collective, a good starting point and provides a variety of quality material for cyber security professionals.

Our primary focus revolves around the latest tools released in the Infosec community and provide a platform for developers to showcase their skillset and current projects.

COMPANY
  • Contact Us
  • Disclaimer
  • Hacker Gadgets
  • LANC Remastered
  • PCPS IP Puller
  • Privacy Policy
  • Sitemap
  • Submit your Tool
Menu
  • Contact Us
  • Disclaimer
  • Hacker Gadgets
  • LANC Remastered
  • PCPS IP Puller
  • Privacy Policy
  • Sitemap
  • Submit your Tool
Live Chat
RESOURCES
  • Attack Process
  • Become a Hacker
  • Career Pathways
  • Dark Web
  • Hacking Books
  • Practice Your Skills
  • Recommended Courses
  • Simple Setup – Hacker 101
Menu
  • Attack Process
  • Become a Hacker
  • Career Pathways
  • Dark Web
  • Hacking Books
  • Practice Your Skills
  • Recommended Courses
  • Simple Setup – Hacker 101
Get Started
TOOLBOX
  • Anonymity
  • Bruteforce
  • DoS – Denial of Service
  • Information Gathering
  • Phishing
  • SQL Injection
  • Vulnerability Scanners
  • Wifi Hacking
Menu
  • Anonymity
  • Bruteforce
  • DoS – Denial of Service
  • Information Gathering
  • Phishing
  • SQL Injection
  • Vulnerability Scanners
  • Wifi Hacking
Tools Directory

2014 – 2020 | Haxf4rall.com               Stay Connected:

Facebook Twitter Google-plus Wordpress
Please wait...

Join Our Community

Subscribe now and get your free HACKERS HANDBOOK

Don't Worry ! You will not be spammed
SIGN UP FOR NEWSLETTER NOW