Documenti di Didattica
Documenti di Professioni
Documenti di Cultura
No. /p-r)'-/Jz:/-Ty
UN ITED STA TE S O F A M ER ICA
V.
GM uV AL LE RIU S,
a/k/a,<CO X YM O N STER ,''
D efendant.
/
C R IM IN A L C O V ER SH EET
Bv: >
FRAN CISC O R .M A D ERA L
A SSISTA N T UN ITED STATES A TTORN EY
Fla.Bar.N o.41481
99 N .E.4th Street
M iam i,Florida 33132-211l
TEL (305)961-9159
FAX (305)530-7976
francisco.maderal@ usdoj.gov
Case 1:17-cr-20648-RNS Document 1 Entered on FLSD Docket 09/01/2017 Page 2 of 17
AO 91(Rev.08/09) CriminalComplaint
United StatesofAmerica )
V. ) .
GALVALLERIUS,a/k/a,''OXYM O NSTER,''
) casexo. j)-my-o5p//-rp
)
)
C RIM IN A L CO M PLA IN T
W Continuedontheattachedsheet.
Comp ainant'
ssignature
Date: 1 Q
Judge'ssignature
A FFID A V IT
1,AUSTIN D.LOVE,SpecialAgentwiththeDnlgEnforcementAdministration(DEA),
being tirstduly sworn,hereby depose and state as follow s:
INTRODUCTION
about the m atters set forth herein, but only those facts and circum stances that I believe are
sufficientto establish probable cause forthe Courtto sign a crim inalcom plaint.
The statem ents contained in this affidavit are based upon m y investigation,
.
inform ation provided by other sw orn 1aw enforcem ent offcers and on m y expedence and
PROBABLE C AUSE
This application stem s from an ongoing crim inal investigation into drug dealers
In the course ofthis investigation,Ihave learned thatthe Dream M arketw ebsite is one ofm any
Bitcoinandother,peer-to-peercrypto-currencies(alsoknown as,virtualcurrencies).
A s set forth in m ore detailbelow ,probable cause exists thatV A LLERIU S,acted
supporting daily illicit transactions betw een buyers and vendors on D ream M arket, such as the
trafficking in narcoticsand laundering in the proceeds oftheir activitiesusing the Bitcoin and the
The Intenzetis a globalnetw ork ofcom puters and other devices. D evices directly
connected to the Intem et are identified by their unique IP address.This num ber is used to route
inform ation betw een devices. G enerally,w hen one device contacts a second device, the first
device m ustbe directed to the IP address of the second device. M oreover,when the firstdevice
contacts the second device,the first device provides its ow n IP address to the second device,so
that the second device know s where to direct its response. A ccordingly, the tw o connected
user w ill type the dom ain nam e of the w ebsite- which com m only corresponds to a plain-
language nam e for the w ebsite,e.g., ww w .google.com - into the Uniform Resource Locator
(:EURL'')baratthetop oftheirwebbrowsers.ThisdomainnamewillbetransmittedtoaDomain
Name System (DNS'') server,which then translates the domain name into the appropriate
num ericalIP address,and thereby allow sthe userto connectw ith the requested w ebsite.
10. How ever, if a user know s of a unique IP address for a particular w ebsite,
generally'the user can type that IP address directly into the U RL bar and access the w ebsite in
thatm anner.
addressfor any know n UR L and the registered ow ner and location ofany IP address.Thus,w ith
This isproblem atic foranyone conducting clim inalactivity on the intem etand w ishing to rem ain
anonyrRous.
1The server or virtual selwer w ith a particular IP address can hostm ultiple w ebsites,in w hich
case entering thatparticular IP address w ould notdirecta user to a single w ebsite.H ow ever,if
an IP address is associated with a single website,entering the IP address as desclibed above
w ould directthe userto thatparticularw ebsite.
2 Private individuals operating hom e com puters usually do not ow n and register their own IP
address',instead,they subscribe to broadband accounts w ith ISPS,such as Com cast or A T& T,
whichin tul'nassign orleasean IP addresstothem (thesubscriber).Nevertheless,theIP address
can usually be traced to its assigned user ata given pointin tim e using the ISPSrecordsofw hich
subscriberw asassigned which IP address and when.
Case 1:17-cr-20648-RNS Document 1 Entered on FLSD Docket 09/01/2017 Page 6 of 17
com m unication sentthrough Tor is directed through num erous relays w ithin the netw ork- and
w rapped in a layerofencryption ateach relay- such thatthe end recipientofthe com m unication
13. ln orderto access the Tor netw ork,anyone can sim ply dow nload the Tor brow ser
softw are and use it to access the internet.The user sim ply inputs a w ebsite IP address or U RL
into the Torbrow ser and the Tor brow ser autom atically encrypts and routes the com m unication
through severalrelays and then outto the destination so thatthe destination w ebsite can only see
l'
lometrom ptlttr wstw,-google.
tom
1P':123.
456-789
In this illustration of a standard internet connection,the w ebsite ww w .google.com can see the
brow ser to colm ectto the w ebsite in the firstplace.Thus,each users'IP addressis know n to the
15. Sim ilarly, any person m onitoling the internet traffic at a point betw een the tw o
would see the connection betw een IP 123.456.786 and ww w .google.com and know that those
On the other hand, in the case of a Tor netw ork com m unication,w hen a person
connects to a w ebsite, the traffic is encrypted and routed through m ultiple relays, and that
'
1-0rRelal-l
lP:00I.00 I-001
HomeCmputtr
IP:123,456.78t
) ww,w ,google-com
TnrRelay 2
1P:* 2.002,
002
TorRelay 3
IP:003.003.
003
ln this illustration of a Tor netw ork com w ction, the website w w w .google.com cannot see the
In addition,any person m onitoring the internettraffic ata pointbetw een the hom e
com puter and w w w .google.com and would not know that those tw o devices w ere
com m unicating. Instead,depending on the m onitoring point, that person w ould only see the
and second, or second and third Tor relays,or between the third (or 6
exif') Torrelay and
ww w .google.com .
address of the w ebsite in order to have directed a connection to it through the Tor network.
w ebsite m ustbe known to the user- the anonym ity is only one-w ay.
19. The Tor netw ork addresses this problem through a feature know n as Ehidden
services.''
C .H idden Services:W ebsite Anonym ity Provided by the Tor N etw ork
To achieve tnle, tw o-w ay anonym ity, the Tor netw ork also enables w ebsites to
operate inside the netw ork in a m anner thatconceals the true IP address ofthe com puter server
hosting the website. Such hidden selwices'' operating on Tor have com plex w eb addresses,
generated in a com puter algorithm ,ending in i6.onion.''U nlike a standard U RL,there is no way
This alleviates the need for a Tor netw ork user to know the tnle IP address of a
w ebsite.Rather the user can directhis Tor brow serto the .onion address,reach the website,and
neither the user northe w ebsite know s the other's IP address- tw o-w ay anonym ity is achieved.
22. Crim inals have taken advantage of the D ark w eb to create w ebsites w ith online
m arketplaces dedicated to the trafficking of controlled substances and other illicit goods.
on the Dark W eb, and how -to guides such as: El-low to Buy D rugs Online from Darknet
M arkets.''3
transactions online,in a m anner sim ilar to w ell-known online m arketplaces such as eB ay.Like
eBay:
a. D ream M arket functions as an interm ediary betw een buyers and sellers.
com puter passw ords,and buyers create accounts to brow se sellers'products and purchase them ;
in thisregard,D ream M arket's website interface issim ilarto w ell-know n online m arketplaces;
D ream M arket vendors. D ream M arket also provides a m eans by w hich its users can
24. How ever,unlike legitim ate online m arketplaces, Dream M arket is dedicated and
advertised and sold and are im m ediately and prom inently visible on the Dream M arketw ebsite.
com m erce by w orking to ensure the anonym ity ofits adm inistrators,as wellas ofthe buyers and
sellers who participate in com m erce on the w ebsite.The w ebsite is designed to achieve this
anonym ity prim arily by operating as a hidden service on the Tornetw ork.
To further prom ote anonym ity,purchases are m ade prim arily in bitcoin
and D ream M arket subsequently transfers the funds to the seller's account or w allet upon
satisfaction of the term s of sale. ln doing so, D ream M arket also provides a t'tum bling''or
ttm ixing'' services w hich essentially scram bles m ultiple buyer-seller Bitcoin transactions
together in order to concealthe bitcoin paym ents from buyerto seller or com m ission paym ents
to the adm inistrator.Thus,there is no directbitcoin transaction betw een the buyerand the seller.
Dissociatives, Prescription, Psychedelics, RCs, Steroids and W eight Loss. Each sub-category
cocaine. For exam ple, the E6stim ulats'' category contains 934 listings for crystal
m etham phetam ine ranging from .5 gram s to 11 pounds per listing,totaling over 200 pounds of
b. ttllligitalGoods''(41394listings).ThettDigitalGoods''categoryisbroken
dow n into the follow ing sub-categories: D ata,D rugs,E-Books,Fraud,Fraud Related,Hacking,
tDl'ugParaphernalia''(456listings).
d. Services(3056listings).Theservices''category isbroken down intothe
follow ing sub-categories: Hacking,lDs & Passports,M oney,Other,Cash out.
D efense.
These activities and the m arketplace w ebsite itself is overseen, m anaged and
and controlthe actual w ebsite and the sever on which its located,as w ell as ultim ately
vendors and buyers and seek to assure the continued operation ofits activities.
Dream M arket under the follow ing m onikers: Digitalpossizol4, Rexim usM axim us and
Case 1:17-cr-20648-RNS Document 1 Entered on FLSD Docket 09/01/2017 Page 12 of 17
crystal m eth, LSD and hydrocodone from the aforem entioned vendors on Dream M arket and
received the drugs via U .S. M ail, shipped to undercover m ailboxes in M iam i, Florida. For
instance:
Rexim usM axim us on D ream M arket for 1.084 bitcoins.ln the descliption, Rexim usM axim us
stated'
.'<100X G D F 150ug LSD !!''.
stated:(ONE)10.325Hydrocodone 14.50apiece.''
On M ay 25, 2016, DEA agents purchased 10 hydrocodone pills from
stated,KKITEN)7.5Hydrocodone$100.00 free2/3daypriori.''
On M ay 25, 2016, DEA agents purchased gram s of crystal
m etham phetam ine from M ethForDum m ies on Dream M arket for 1.516 bitcoins. ln the
Priority M ail to M iam i, Florida. Laboratory results confinned that the above-listed item s
30. On January 27,2017,D EA agents logged into Dream M arketand observed a link
to Fonlm ''on the Dream M arkethom e page.A gents clicked on the link,w hich took them to a
Torw ebsite called D ream M arketForum .Based on m y training and experience,dark w eb m arket
10
Case 1:17-cr-20648-RNS Document 1 Entered on FLSD Docket 09/01/2017 Page 13 of 17
adm inistrators create forum w ebpages on the dark w eb to allow vendors, buyers and
adm inistrators to discuss anything related to the dark w eb m arket.In order to post on the forum ,
w ill appear m arked as an adm inistrator,''m oderator'' or fvendor'' on the fonlm .4 U nverified
31. W hile brow sing the D ream M arket Forum , agents navigated to a topic called
on the user 'toxyM onster'' and w ere taken to 'to xyM onster's''protile on D ream M arket. The
profile stated that'r xyM onster's''was a Senior M oderatoron Dream M arket,whose profile was
33. Severalm onths later,on June 30,2017,agentsalso identified tto xyM onster''as a
vendor on Dream M arket. oxyM onster's vendor profile featured listings for Schedule 11
controlled substances O xycontin and Ritalin.H isprofile listed 60 priorsales and five starreview s
from buyers.In addition, his profile stated that he ships from France to anywhere in Europe.
Iz
lzrchighl
y recommend using TradeRouteforpurchasingfrom us:
Trade routeilbgzton ion//shop =oxyM onster...''
THE OFFICIAL TIP JAR FOR ''
DM WATTEAM ''(STAFF)IS.
.
lDREAMv7kl6T8bMyE7ghe4nLQVSdBbPJAe.
A gents navigated to the aforem entioned TradeRoute link, w hich 1ed them to
OxyM onster's dnlg vendor page TradeRoute- an em erging dark w eb m arketplace sim ilar to
Dream M arket. O xyM onster's TradeRoute profile stated thathe w asan active drug vendor,w ho
ships from France to Europe and the United Statesand hasbeen a m em ber since February,2017.
In addition,hisprotile stated:
35. In other posts on the Dream M arket forum ,'toxyM onster''characterized him self
as a D ream M arket adm inistrator.For instance,on Decem ber 10,2015,to xyM onster''posted
view ed o xyM onster's'' profile. At that tim e, his title was changed to E'V endor'' on D ream
M arket. H is profile also stated thathe has 1,052 posts and his last post w as on February l3,
12
Case 1:17-cr-20648-RNS Document 1 Entered on FLSD Docket 09/01/2017 Page 15 of 17
w hich began on h4ay l0, 2015 and ended on Decem ber 22, 2016. f'O xyM onster's'' posts
responded to custom er com plaints,provided tips on staying anonym ous on the dark w eb and
On A ugust 29, 2017, agents view ed toxyM onster's'' D ream M arket vendor
profile. This tim e, the vendor profile stated that he w ill also ship to the U nited States. The
vendorprofilenow had 70 verified salesand stilllisted the same Dream M arketstafftip jar
bitcoin w alletand he w as lastonline on August29,2017.
39. In sum ,6r xyM onster''know ingly participated the Dream M arket conspiracy not
only as a vendor,but also,in a leadership and organizational roll as a senior m oderator and
adm inistrator.
40. After observing the bitcoin ''tip jar'' advertised by toxyMonsyter,'' agents
conducted analysis of the incom ing and outgoing transactions from that bitcoin address and
Open source data revealed that VA LLERIU S has lnstagram and Tw itter accounts.
A gents com pared the w riting style of '6oxyM onster''on D ream M arket fonlm while in Senior
13
Case 1:17-cr-20648-RNS Document 1 Entered on FLSD Docket 09/01/2017 Page 16 of 17
M oderatorrole to the writing style ofV A LLER IU S on his public Instagram and Tw itteraccounts.
A gents discovered m any sim ilarities in the use of w ords and punctuation to including:the w ord
posts.
42. On A ugust 31,2017,VA LLER IU S travelled to the United States forthe firsttim e
his anivalatA tlanta InternationalA irportconfinned his identity as tto xyM onster.''On his laptop
and a PGP encryption ke/ entitled ''OxyMonster'' which matched that advertised as
E6oxyM onster's''on D ream M arket.
6Persons who are involved w ith Dark W eb narcotics trafficking utilize public key encryption to
com m unicate w ith other purchasers and sellers on the m arketplace in order, for instance, to
provide inform ation such as a shipping address.lf the m essage w as not encrypted,it w ould be
visible by the adm inistrators of the D ark W eb m arketplace, and by law enforcem ent, if the
m arketplace server w as ever located and seized.Public key encryption allow s the sender of a
m essage to encryptthatm essage using a long and unique passcode know n as a public key,w hich
the recipient of the m essage publicly provides to anyone w ishing to com m unicate w ith them .
Thatm essage,in tum ,can only be decrypted by the recipientusing a corresponding private key
know n only to them .The m ostcom m only used encryption is thatknow n as Pretty Good Privacy
(PGP)encryption.Almosta1lDark W eb marketplacevendorprotilesadvertiseapublicPGPkey
for thispup ose;the PG P key,therefore,doubles as a unique fingerprintvisible across dark w eb
platform s.
14
Case 1:17-cr-20648-RNS Document 1 Entered on FLSD Docket 09/01/2017 Page 17 of 17
C ONCLIJSION
43. Based on the foregoing,probable cause exists thatG alV A LLERIU S,did,atleast
fentanyl,m etham phetam ine,LSD ,and oxycodone in violation of Title 21, United States Code,
Section 846.
A .
A U STIN D .LO VE,SPECIA L A G EN T
DRU G EN FOR CEM EN T A DM INISTR ATIO N
JON A H GO O DM A N HO N OR AB LE
UN IT STA TES M A G ISTRATE JU D GE