Case 1:17-mj-02572-JG Document 3 Entered on FLSD Docket 04/27/2017 Page 1 of 18

U N ITE D STA TES DIST RIC T C O U RT

SO U TH ERN D ISTR ICT O F FLO R ID A

xo. 'oysy; -J'c-

U NITED STA TES O F A M ER ICA

JO SH U A J.K ELLY ,
a/k/a,RU STO U S,''

Defendant.

CR IM IN A L C O V ER SH EET

Did this m atteroriginate from a m atterpending in the N orthern Region ofthe United
States Attom ey'sO ffice priorto October 14, 2003? Yes X No

Did thism atteroriginate from a m atterpending in the CentralRegion ofthe U nited States
Attorney's O ffice priorto Septem ber 1, 2007? Y es - X No

Respectfully subm itted,

W IFRED O A .FERR ER
U NITED STATES ATTO RN EY

BY: . p
N CISCO R.M A D L
A SSISTAN T UN ITED STATES A TTORN EY
Fla.Bar.N o.41481
99 N .E.4th Street
M iam i,Florida 33132-2111
TEL (305)961-9159
FAX (305)530-7976
francisco.maderal@ usdoj.gov
 Case 1:17-mj-02572-JG Document 3 Entered on FLSD Docket 04/27/2017 Page 2 of 18

AO 91(Rev.08/09) Cri
minalComplaint

U NITED STATES D ISTRICT C OURT

forthe
Southern DistrictofFlorida

United StatesofAmerica
casexo.l4 <;
'o ; 5 p2 -.
7-
0
JOSHUA J.KELLY,a/k/a,''USTOUS,''

CRIM INAL COM PLAINT

1,thecomplainantinthiscase,statethatthefollowing istrueto thebestofmy knowledge and belief.

Onoraboutthedatets)of 9/2016-12/2016 inthecountyof Miami-Dade inthe
Southern Distlictof Florida ,thedefendantts)violated:
CodeSection OffenseDescrtption
Ti
tle21,Uni
ted StatesCode, Conspiracyto Distribute Controlled Substances
Sections846& 841(b)(1)(c)
Ti
tle 18,Uni
ted States Code, Conspiracyto Commi
ttMoney Laundering
Sectiona 1956(h)& 1956(a)(1)

Thiscriminalcomplaintisbased on thesefacts:
SEE ATTACHED AFFIDAVIT.

W Continuedontheattachedsheet.

Complainant'
ssi
gnature

Lili
ta Infante,S/A ,DEA
Printed nameandtitle

Sworn tobeforemeandsigned in m ypresence.

o -t-, )?J.z-
, f J: Judge'
ssignature

City and state'

. Miami,Florida Jonathan G oodm an,U.S.M aqistrate Judge
Printednameand title
Case 1:17-mj-02572-JG Document 3 Entered on FLSD Docket 04/27/2017 Page 3 of 18

AFFIDA V IT
1,LILITA IN FAN TE , SpecialA gentw ith the Drug Enforcem entA dm inistration being
,

firstduly sw ol'
n,hereby depose and state as follow s:

INTRODUCTION

l am an investigative or law enforcem ent officer of the U nited States w ithin the

meaningofSection251047)ofTitle 18oftheUnitedStatesCode.Thatis, lam an officerofthe

U nited States who is em powered by law to conduct investigations of, and to m ake arrests for
,

offenses enum erated in Title 18, United StatesCode,Section 2516(1),and in Title 21,United

StatesCode,Sections 846 and 878.

This affidavit is m ade in support of a crim inal com plaint charging Joshua J.

K ELLY, aIV a, 'QU STOU S,''w ith conspiracy to distribute in narcotics in violation of Title 21
,

United States Code, Section 846, and conspiracy to launder m oney, in violation of Title

UnitedStatesCode,Section 1956(h).
I have not necessarily included in the affidavit each and every fact known to m e

about the m atters set forth herein, butonly those facts and circum stances that l believe are

sufficientto establish probable cause forthe Courtto sign a crim inalcom plaint.

The statements contained in this aftidavit are based upon m y investigation,

inform ation provided by other sw ol'n 1aw enforcem ent officers and on m y experience and

training as a federalagentand the experience and training ofothcrfederalagents.

PROBABLE C AUSE

This application stem s from an ongoing clim inal investigation into drug dealers

operating on crim inal online m arketplace w ebsites, including a w ebsite know n as the V alhalla

M arket.
Case 1:17-mj-02572-JG Document 3 Entered on FLSD Docket 04/27/2017 Page 4 of 18

ln the course ofthis investigation, Ihave learned thatthe V alhalla M arketwebsite

isone ofmany TheOnion Router(t4Tor'')network ortidark web''criminalmarketplaces The .

Valhalla M arketis designed to prom ote the anonym ous sale ofillegalitem s, such asnarcotics,in

exchange for Bitcoin and other, peer-to-peer crypto-currencies (also known as, virt
ual
currencies).
A s set forth in m ore detailbelow ,probably cause exists that K ELLY is trafficking

in narcoticsand laundering in theproceedsofhisactivitiesusing the Bitcoin and the dark web, in

conspiracywiththeunknownadministratorts)oftheValhallaMarket.
A .TH E TO R N ETW O R K A N D TH E RD AR K W EB''

8. The lnternet is a globalnetw ork ofcom puters and other devices. Devices directly

colm ected to the Intenzet are identified by their unique IP address. This num ber is used to route

inform ation betw een devices. Generally, whcn one device contacts a second device, the tirst

devicemustbe directed to the IP addressofthe second device. M oreover,w hen the firstdevice

contactsthe second device,the firstdevice providesitsown IP addressto the second device, so

that the second device know s w here to direct its response. A ccordingly, the tw o connected

devices (forinstance,ahome computer and the www.google.com website selwer)know each

other's IP address.

9. Thetypicaluserm ay notknow theIP addressofawebsiteshe visits. Typically,a

user will type the dom ain name of the website- which comm only corresponds to a plain -

language nam e for the w ebsite, c.g., w ww .google.com - into the Uniform Resource Locator

(EURL'')baratthetop oftheirwebbrowsers.ThisdomainnamewillbetransmittedtoaDomain
Name System (ttDNS'') server,which then translates the domain name into the appropliate
num ericalIP address,and thereby allow sthe userto connectw ith the requested w ebsite.
Case 1:17-mj-02572-JG Document 3 Entered on FLSD Docket 04/27/2017 Page 5 of 18

H ow ever, if a user know s of a unique IP address for a particular website,

generallylthe user can type that IP address directly into the U RL bar and accessthe website in

thatm anner.

ln addition,publicly available databases can be easily searched to obtain the IP

addressforany known URL and the registered ownerand location ofany IP address. Thus,w ith

additionalinquiry,mostany URL orIP addresscan be traced to itsownerand physicallocation.z

Thisisproblematic foranyoneconducting crim inalactivity on theinternetand wishing to remain

anonm ous.

B.U ser A nonym ity Provided by the T or N etw ork

12. The Onion Router (Tor)network is a specialnetwork of computers distributed

around the world designed to concealthe true IP addresses of the users of the netw ork. Every

com m unication sent through Tor is directed through num erous relays w ithin the network and
-

wrapped in a layer ofencryption ateach relay- such thatthe end recipientofthe com m unication

hasno w ay oftracing the com m unication back to itstnle originating IP address.

1The serverorvirtualserverwith a particular IP address can hostmultiple websites in which

,
case entering thatparticular IP address w ould notdirect a user to a single w ebsite. H ow ever,if
an IP address is associated w ith a single website, entering the IP address as described above
w ould directthe userto thatparticularw ebsite.
2Plivate individuals operating hom e computers usually do notown and registertheirow n IP
address; instead,they subscribe to broadband accounts w ith ISPS, such as Com cast or A T& T,
which inturn assign orleaseanIP addresstothem (thesubscriber).Nevertheless, the IP address
can usually be traced to its assigned userata given pointin tim e using the ISPS recordsofw hich
subscriberwasassigned which IP address and w hen.
Case 1:17-mj-02572-JG Document 3 Entered on FLSD Docket 04/27/2017 Page 6 of 18

In orderto accessthe Tornetwork, anyone can simply download the Torbrowser

software and use it to access the intem et. The user simply inputs a w ebsite IP address or UR L

into the Torbrowserand the Torbrowserautomatically encryptsand routesthe com munication

through severalrelays and then outto the destination so thatthe destination w ebsite can only see

theIP addressofthelast(orexit'')relayandnottheIP addressofthedeviceactuallycolmecting

to the destination website.

By w ay of illustration, in a standard internet com m unication, w hen a person

connectsto a w ebsite,thatw ebsite can see thatpersons IP address:

lI
l
Pome Comptlter wsN,
w-.google.
wom
'
:I23.4.
$6.789

In this illustration of a standard internet connection, the w ebsite w w w .google.com can see the

homecomputerIP address(123.456.789)and,ofcourse,theuserofthe home computerknew

the U RL,and therefore the IP address, ofw ww .google.com ,w hich the user had to type into his

browserto connectto thewebsite in the firstplace. Thus,each users'IP address is know n to the

other,and theownerand location ofboth can laterbetraced.

15. Sim ilarly,any person m onitoring the intenzet traffic at a point betw een the two

would see the connection between IP 123.456.786 and w w w .google.com and know that those

two devicesw ere com m unicating.

Case 1:17-mj-02572-JG Document 3 Entered on FLSD Docket 04/27/2017 Page 7 of 18

On the other hand,in the case of a Tor netw ork com m unication, w hen a person

connects to a website, the traffic is encrypted and routed through m ultiple relays, and that

w ebsite cannotsee thatpersonsIP address:

TorRelay l
lP:00l.1 I-(J0l

Hom eCompater
1P'
.123.456.139
$:,
Max.googre-com
TorRelay 2
lP:1 1.6(2.66)

TorRelay 3
IP;(
/):.90:,
903

In this illustration of a Tor netw ork connection, the website w ww .google.com cannot see the

homecomputerIP address(123.456.789),
.instead itonly seesthe IP addressofthedevice itis
directly connectd to,the third (ortexif')Torrelay,with IP address003.003.003,which IP
address cannotbe traced back to the hom e com puteruser.

ln addition,any person m onitoring the intenzcttraftic ata pointbetw een the hom e

computer and www.google.com and would not know that those two devices were

com m unicating. lnstead, depending on the m onitoring point, that person would only see thc

directconnectionsbetweenthehomecomputerandfirst(orGGentry'')Torrelay,between thefirst
and second, or second and third Tor relays, orbetween the third (or%
exif')Torrelay and
ww w .google.com .

18. A s w ith a standard intenw tconnection, the user m ust have known the U RL or IP

address ofthe website in order to have directed a connection to itthrough the Tor network.
Case 1:17-mj-02572-JG Document 3 Entered on FLSD Docket 04/27/2017 Page 8 of 18

A ccordingly,although the IP addressofthe user is hidden from the w ebsite, theIP addressofthe

w ebsite m ustbeknown to the user- the anonym ity is only one-w ay.

The Tor netw ork addresses this problem through a feature known as 'hidden

SCrVices.''

C .H idden Services:W ebsite A nonym ity Provided by the Tor N etw ork

To achieve true,tw o-w ay anonym ity, the Tor netw ork also enables w ebsites to

operate inside the network in a m anner thatconceals the tnle IP address of the com puter server

hosting the w ebsite. Such hidden services'' operating on Tor have com plex w eb addresses
,

generated in a com puter algorithm , ending in .onion.''Unlike a standard U RL , there is no w ay

to retrievea websiteserver'stnzeIP addressfrom its.onion Tor address alone.

21. This alleviates the need for a Tor netw ork user to know the tl-ue IP address of a

website.Rathertheusercan directhisTorbrow serto the .onion address,reach the w ebsite,and

neitherthe user nor the w ebsite knows the other's IP address- tw o-w ay anonp nity is achieved.

This netw ork ofanonym oususers and w ebsitesisthe r ark W eb.''

22. Crim inals have taken advantage of the D ark w eb to create w ebsites w ith online

m arketplaces dedicated to the trafficking of controlled substances and other illicit goods.

W ebsites such as ww w .deepdotweb.com m aintain an overview ofillegalm arketplaces operating

on the D ark W eb, and how -to guides such as: l-low to Buy D rtlgs O nline from Darknet

M arkets.''3

3https://ww w .deepdotw eb.coe zols/lz/3o3 uy-drugs-online-from -daru etm arkets/

Case 1:17-mj-02572-JG Document 3 Entered on FLSD Docket 04/27/2017 Page 9 of 18

D .D escription ofthe V alhalla M arket

Valhalla provides an infrastnlcture that allows buyers and sellers to conduct

transactions online,in a m anner sim ilar to w ell-know n online m arketplaces such as eBay. Like

eBay:

Valhalla functionsasan interm ediary betw een buyersand sellers. Sellers

create accounts on V alhalla to advertise their products, such as narcotics or hacked com puter

passwords,and buyers create accountsto browse sellers'products and purchase them ;in this

regard,V alhalla'sw ebsite interface is sim ilarto w ell-know n online m arketplaces,'

b. V alhalla perform s m oderator and m aintenance services, such as receiving

com plaints,providing technicalassistance,and allow ing custom ers to post review s of Valhalla

vendors. V alhalla also provides a m eans by which its users can com m unicate w ith its

adm inistratorsand operators;and

V alhalla charges a com m ission from every transaction as a percentage of

the sale price.

24. How ever, unlike legitim ate online m arketplaces, V alhalla is dedicated and

designed to facilitate the sale ofillegalnarcoticsand drug paraphernalia. Forexam ple:

a. Illegaldnlgs,such as m etham phetam ines, heroin,and cocaine,are openly

advertised and sold and areimmediately andprominently visible on the Valhallawebsite.

b. The V alhalla w ebsite is specifically designed to facilitate illegal

com m erce by w orking to ensure the anonym ity ofits adm inistrators, asw ellas ofthe buyersand

sellers who participate in com m erce on the w ebsite. The w ebsite is designed to achieve this

anonym ity prim arily by operating asa hidden service on the Tornetw ork.
Case 1:17-mj-02572-JG Document 3 Entered on FLSD Docket 04/27/2017 Page 10 of 18

To further prom ote anonym ity,purchases are m ade prim arily in bitcoin

(orothervirtualcurrency)usingValhalla'sescrow services,i.e.,abuyertransfersfundsfrom his

or her own accountor virtual-currency w allet into an V alhalla account or w allet, and V alhalla

subsequently transfersthe funds to the seller's accountorw alletupon satisfaction ofthe tenns of

sale. ln doing so, Valhalla also provides a 4tum bling'' or ttm ixing'' service which essentially

scram bles m ultiple buyer-seller Bitcoin transactions together in order to conceal the bitcoin

paym ents from buyer to seller or com m ission paym ents to the adm inistrator. Thus,there is no

directbitcoin transaction betw een the buyer and the seller.

25. The true identity of the individual or individuals w ho control and operate the

Valhallawebsite,f.c.,theadministratorts),isunknown.
E .<CU STO U S''V endor on V alhalla and O ther D ark W eb M arkets

26. Since at least O ctober of 2015, agents identified a narcotics vendor, know n as

GtU STOU S,''appearing on num erous dark w eb m arketplaces, including A lphabay, V alhalla, and

M iddle Earth. O n several occasions,DEA agents have m ade undercover online purchases of

heroin,alpha-pvp (Flakka'')and M DMA from IUSTOUS''and received the drugsvia U.S.

M ail,shipped to undercoverm ailboxes in M iam i, Florida.Forinstance:

a. On O ctober 14,2015,D EA agents purchased one halfofa gram ofheroin

from EEU STO U S''on the M iddle Earth M arketfor 0.2749 bitcoins.ln the description,USTOUS

stated:''HalfG ram U ncutRaw H N um ber 3.

,'
'and,

O n Decem ber 6,2016,DEA agents purchased 10 pills of alpha-pv p and

10 pills of M DM A from %CU STO U S'' on the V alhalla M arket for 0.05250935 BTC and

0.07679129 BTC respectively. ln the description for alpha-pv p, U STO U S stated: ''Blue

W recked Benz M ega Speed Press,''containing ''Ethylone, A -PV P,Hexadron and A M P salts.'' ln

8
Case 1:17-mj-02572-JG Document 3 Entered on FLSD Docket 04/27/2017 Page 11 of 18

the description forthe M DM A,USTOUS stated:''Zen Sea BlueFerraris,''containing aw esom e

com bo ofM DM A and Benzo.''

27. In both instances,thecontrolled substanceswereshipped via United StatesPriority

M ail to M iam i, Florida w ith respective return addresses in Saint Louis and Festus, M issouri.

Laboratoryresultshaveconfirmedtheitemsreferencedinparagraph (a)containedheroinandthe
itemsreferencedinparagraph (b)containedalpha-pvp andM DM A.
28. tEU STOU S'' has conducted thousands of transad ions on num erous D ark W eb

m arketplaces,including: Alphabay M arketwith atleast7,519 transactions, V alhalla w ith atleast

140 transactions, M iddle Earth M arket w ith at least 159 transactions.4 O n a1l of these

m arketplaces, 4CU STO U S'' advertised dangerous opioids, synthetic drugs and Schedule 11

controlled substances for sale, including-

. fentanyl,heroin, m etham phetam ine, alpha-pv p and

oxycodone.

4 D EA w as able to confirm that CCU STO U S'' is the sam e vendor on V alhalla and A lphabay
M arket by confirm ing that in each instance EEU STO U S'' w as advertising the sam e public
encryption key and signature. Persons w ho are involved w ith Dark W eb narcotics trafticking
utilize public key encryption to com m unicate with other purchasers and sellers on the
m arketplace in order, for instance, to provide infonuation such as a shipping address. lf the
m essage was not encrypted, it w ould be visible by the adm inistrators of the Dark W eb
m arketplace,and by law enforcem ent,if the marketplace server was ever located and seized.
Public key encryption allows the sender of a message to encrypt that m essage using a long
passcode know n as a public key,which the recipientofthe m essage publicly providesto anyone
w ishing to com m unicate w ith them .Thatm essage, in turn,can onlybedecryptedby therecipient
using a corresponding private key known only to them . The m ostcom m only used encryption is
thatknownasPretty GoodPrivacy(PGP)encryption.AlmostallDark W eb marketplacevendor
profiles advertise a public PG P key for thispum ose;the PG P key, therefore,doubles asa unique
fingep rintvisibleacrossdark web platform s.

9
Case 1:17-mj-02572-JG Document 3 Entered on FLSD Docket 04/27/2017 Page 12 of 18

Regarding Valhalla in particular,a review of EEUSTOUS'S''profile obtained on

Decem ber 5,2016 revealed thatU STOU S distributed controlled substances on V alhalla atleast

from Septem ber 2016 to D ecem ber2016.

F.K ELLY & IQELLY Business A ssociated with SCU STO U S''

30. Since the tim e of the first controlled purchase from EEU STOU S''on October

2015,D EA and other1aw enforcem entagents have been able to identify KELLY as Q4U STO U S''

by analyzing the shipping records associated w ith the dnlg package shipped to D EA via the

UnitedStatesPostalService(USPS).
31. U SPS records revealed thatthe tirst undercover drug purchase w as shipped using

postage purchased atEndicia.com ,''an online com pany w hieh allow s itscustom ersto printtheir

own stam psand shipping labels.

Endicia.com records revealed thatthe Endicia.com accountused by EEU STO U S''to

ship the drugs to UC agents w as accessed from IP address 97.91.242.30 belonging to internet

service provider Charter Com m unications and used Vanilla prepaid debit cards to purchase

$9,433 worth ofpostage for shipm ents allover the United States from Septem ber 9, 2015 to

Septem ber 8, 2016. A Subpoena of Charter Com m unications revealed that the IP address

97.91.242.30 is being utilized exclusively by internet selw ice subscliber H EA DY W A REZ w ith

service addl-ess located at 1802 Broadw ay St.,Cape G irardeau, M O . A public database search

revealed thatHEA DY W AREZ isa sm okeshop businessownedby KELLY .

A search of M issouri D epartm ent of Revenue revealed that K ELLY lists the

aforem entioned HEA D Y W A REZ address ashis residentialand m ailing address on hisM issouri

driver'slicense.

10
Case 1:17-mj-02572-JG Document 3 Entered on FLSD Docket 04/27/2017 Page 13 of 18

On August 19,2016,D EA agents conducted a trash pull atthe HEA D Y W A REZ

trash bin. During the trash pull,agentsrecovered 26 pieces ofpaper with varioushandwritten

acronym s, colors and num bers, such as ttl0 yellow Benz'' ::85 X an'' k:10 O C 40 orange'' 6

D& G .'' These acronym s closely m atched 6tU STO U S'' drug listings on V alhalla M arket and

A lphabay M arket, such as, EE300m g GO LD BEN Z SPEED BA LL ,'' CCOC 40 D ark Orange

Formula#3.3(new FENT BLENDI),CCDA;

G TrioofTerrorBlueRC (cocainelike+ smallDXE)
presses,''CEW HITE D ICES XAN A X PRESS 3 BEN ZO C OM BO .'' Based on m y training and

experience,as well as the listing descriptions provided by EEU STOU S'' the acronym ttB enz''

stands for controlled substance benzodiazepine, O C 40 stands for O xycodone 40m g, 'x an''

standsforX anax.

G .Tor N etw ork Activity from H EA DY W A R EZ

35. ln order to determ ine w hether KELLY , or som e other narcotics-trafticking co-

conspirator,w asaccessing crim inal,Dark W eb m arketplaces from the HEA DY W A REZ intem et

connection,law enforcem ent began m onitoring the internet traftic to and from the IP address

associated with H EA DY W A REZ CharterCom m unicationsinternetservice.

36. A s discussed above,because ofthe anonym ity provided by the Tor network such

m onitoring w ould notrevealthe ultim ate IP address of devices com m unicated w ith through the

Tor netw ork. H ow ever, such m onitoring could reveal colm ections to com puters generally

associated withtheTornetwork asrelays(ortt-forNodes'')whicharethecomputersandservers

designated by the adm inistrators of the Tor netw ork to route com m unications through the

encrypted Tornetw ork.

For exam ple,m onitoring the IP connections of a com puter connecting to V alhalla

through Tor, w ill not reveal any specitic IP address associated w ith Valhalla. R ather such
Case 1:17-mj-02572-JG Document 3 Entered on FLSD Docket 04/27/2017 Page 14 of 18

m onitoring couldsrevealcolm ections to com puters generally associated w ith the Tornetw ork as

t6l'or N odes,''w hich are the com puters and servers designated by the adm inistrators of the Tor

network to route comm unicationsthrough theencrypted Tornetwork.

38. A com puter attem pting to connectto the Tor netw ork m ust know how to contact

a Tor N ode in order to initiate a Tor network session,and Tor N ode IP addresses are publicly

available,open sourceinformationon websitessuchas:https://exonerator.toproject.org.

39. Therefore,m onitoring the traftic ofthe IP address ofsom eone suspected ofusing

the Tornetw ork could revealconnections to IP addressespublicly associated w ith com puters and

selNers know n to Operate asTOrN odes.

40. O n January 26,2017,the DEA obtained a pen/trap order for a1l internettraffic to

and from the Charter Com m unications IP address utilized by HEAD Y W A REZ.The pen/trap

order results obtained through M arch 27,2017 reveal internet connections from the H EA D Y

W A REZ IP address to known Tor N odes and,therefore,the Tor netw ork,w hich is consistent

w ith som eone logging on to the crim inal,D ark W eb m arketplaces,such asV alhalla, through the

Tol'netw ork,from a com puterlocated w ithin H EA DY W AREZ business location.

H .K ELLY R esidence Assod ated w ith RU STO U SM

41. On August5,2016,aUnited StatesPostallnspector(USPI)informed DEA agents

thata parcelfrom Shanghai,China was destined for Joshua KELLY at 2806 Lynwood Hills

Drive,CapeGirardeau,M issouriasingle-family home(hereinafterEEKELLY Residence').From

A ugust2016 to January 2017,D EA agents conducted m ultiple surveillances of Joshua KELLY

5 This would not necessarily be the case if the person was adding an additional layer of
anonymity,such asa virtualprivate network (VPN) connection,between them and the Tor
network.

l2
Case 1:17-mj-02572-JG Document 3 Entered on FLSD Docket 04/27/2017 Page 15 of 18

atthe KELLY Residence.On August9,2016,DEA agentsconducted a trash pullatthe trash

receptacle belonging to the K ELLY Residence.Insidethe trash receptacle, agents seized m ultiple

pieces of paper with various handwritten acronym s,colors and numbers,such as 7 OC 40

O range,''3 D & G''and :G6 Y ellow Benz,''m atching CCU STOU S''drug listings and sim ilarto the

ones found previously in the trash receptacle at H EA D Y W A REZ . In addition, the trash

contained a shipping labelcreated with the sam e Endicia.com shipping accountthatwas utilized

by CCU STOU S''to m ail drugs to D EA agents. The destination nam e and address m atched the

Endicia.com records ofshipm enton August5,2016. A lso seized from the trash w ere a syringe

containing liquid TH C,m iscellaneousm ail,to include a package addressed to H EA D Y W AR EZ ,

ahandwritten note to ttloshua,''mylarbagsand vacuum sealed bagswith traeesofmarijuana.

The vacuum sealed bagsm atched the bagsthatcontained the drugsreceived by DEA agents in

the m ailfrom EEU STOU S.''

O n August 16, 2016, D EA agents conducted another trash pull at the K ELLY

Residence trash receptacle. D uring the trash pull,agents recovered a V anilla prepaid debitcard

bearing the sam e cal'd num berasthe one used by the ttU STO U S''Endicia.com shipping account

to purchase stam ps. In addition, agents recovered m ultiple pieces of paper w ith various

handwritten acronym s,colorsand numbers,such as'10 OC 40 Orange''and :t75 Xan,''m atching

'tU STO U S'' drug listings and sim ilar to the ones found previously in the trash receptacle at

H EAD Y W A REZ and the K ELLY Residence.

Other item sseized from the K ELLY Residence trash include m ultiple parcels from

China and Canada, Ziploc bags containing residue of cellulose, and an envelope containing

residue of calcium sulfate. Based on m y training and expelience, cellulose is used to

13
Case 1:17-mj-02572-JG Document 3 Entered on FLSD Docket 04/27/2017 Page 16 of 18

m anufacture pharmaceutical tablets to make tablets hard and stable,giving them EEbulk'' and

assisting in absop tion. Calcium sulfate isused as a binding m aterialfortablets.

On August 23, 2016, DEA agents conducted another trash pull at the KELLY

Residence,resulting in the seizure ofa Ziploc bag containing alpha-pvp (Flakka'')residue,

vacuum sealed and m ylar bags,receipts from HEAD Y W A REZ and K ELLY 'S bank account

depositslips.

1.K ELLY R esidence # 2 lntercepted Shipm ent

45. O n Februaly 28,2017,D EA agents observed a moving truck departing the KELLY

Residenceand arriving at2053 StevensDrivein Cape Girardeau,M O ghereinafterKELLY Residence

On M arch 1,2017,D EA agents observed a vehicle registered to K ELLY parked in the

drivew ay of KELLY Residence # 2 and another vehicle registered to Jeanette K-

ELLY - KELLY 'S

m other.

47. A public utility check on the KELLY Residence revealed that a1l utilities were

changed from KELLY 'S nam e to the nam e ofthe landlord ofthe K ELLY Residence. The utilities at

KELLY Residence # 2 were registered underJeanette KELLY on Februaly 27,2017.

48. On M arch 28,20l7,H om eland Security lnvestigations agents intercepted a parcel

from Singapore destined for Jeannette K ELLY at K ELLY Residence # 2. A border search of the

parcelrevealed 2 round die m olds and 4 m etalparts for a pillpress with a letter V ,num bers 48-12,

letterA and num bers 215. A search ofpharm aceuticalm arkingsrevealed thatV 48-12 isthe m arking

used by Oxycodone manufacturerQualifestPharm on 30mg Oxycodone tabletsand the marking A

215 isused by Oxycodone m anufaeturerActavison 30m g Oxycodone pills.
Case 1:17-mj-02572-JG Document 3 Entered on FLSD Docket 04/27/2017 Page 17 of 18

49. Records from KELLY 'S personal Ebay buyer account indicate that in the past,

KELLY purchased a TDP-5 tablet press, powder m ixers and multiple die m olds for Oxycodone,

N orco,and X anax.

J.Bitcoin A nalysis

A nalysis ofK ELLY 'Sfinancialrecords revealed thatK ELLY has a bitcoin account

w ith C oinbase- a bitcoin w allethostand exchanger. K ELLY 'SCoinbase accountis linked to his

personalchecking accountand hisbusinesschecking accountunderthebusinessnam e Ligons&

K elly Enterplise.txlwc at W ood & Huston Bank. Coinbase records revealed that in the span of

three m onths from Septem ber 7th, 2015 to Decem ber 14th5 2015, K ELLY received bitcoins

equivalentto $42,161.62 from externalbitcoin addresses,exchanged them to United Statesdollars

and transferred to the aforementioned linked bank accounts. Analysisofthe bitcoin block chain

revealed thatthe majority ofthe extem aladdresses that sentbitcoins to KELLY'S Coinbase
accountbelonged to dark web m arkets,such as A lphabay M arketand AbraxasM arket.
Case 1:17-mj-02572-JG Document 3 Entered on FLSD Docket 04/27/2017 Page 18 of 18

C ONCLUSION

Based on the foregoing,probable cause existsthat:

Joshua J.K ELLY ,did,at leastfrom Septem ber 2016 to D ecem ber 2016,

conspire with the unknown administratorts) of Valhalla,to distribute controlled substances,

including a1pha-PVP,M DM A ,heroin,oxycodone and fentanylin violation of Title 21, United

States Code,Section 846.

b. Joshua J.K ELLY ,did,at least from Septem ber 2016 to Decem ber 20l6

conspire w ith the urtknown administratorts) of Valhalla, to knowingly conduct financial

transactions,in bitcoins, involving the proceeds of unlawful narcotics trafficking activities,

know ing thatthe transaction w as designed to concealand disguise the nature of the proceeds, in

violationofTitle18,United StatesCode,Sedion 1956(h)and 1956(a)(1).

Respectfully subm itted,

L1L A IN FAN T E,SPECIA L A GEN T

D RUG EN FOR CEM EN T A DM IN ISTR ATION

The contents fthij written affidavitw subscribed and

swornbeforemeon rillk,2017.

H ON OR A E J ATHA N GO O DM AN
UN ITED S A T S M A G ISTRA TE JU D GE

16