Duo Charged for Selling Betting Accounts
Two men were charged for participating in a conspiracy to sell login credentials of accounts at a fantasy sports and betting website.
According to court documents, 19-year-old Nathan Austad, alias "Snoopy," and 21-year-old Kamerin Stokes, alias "TheMFNPlug," were allegedly part of a scheme that resulted in the theft of approximately $600,000 from 1,600 DraftKings accounts.
Investigations by the FBI into a credential stuffing attack against DraftKings led the investigators to Joseph Garrison. Garrison was arrested on May 18, 2023.
Conversations recovered from Garrison's phone Led the investigators to a fraud shop under the domain snoop.fo. The shop sold accounts for multiple sites including, DraftKings. The shop also provided its customers with instructions on how to cash out the funds in the accounts.
The investigators acquired the IP address used to register the Cloudflare account associated with the fraud shop from Cloudflare. Information acquired from Apple revealed that the IP had also been used to access an account registered to Austad.
The investigators executed a search warrant at Austad's residence on November 7, 2023, and seized several electronic devices. The investigators recovered Telegram conversations linking Austad to the sale of DraftKings accounts.
Austad was also found in possession of approximately 3,777,641 combinations of usernames and passwords as well as 116 "config" files used in credential stuffing attacks.
The investigators also recovered crypto wallets that had received $465,000 between January 1, 2021, and December 9, 2022.
On the Garrison Phone, law enforcement also recovered Telegram chats between Garrison and a user with the name “themfnplug." TheMFNPlug purchased DraftKings accounts in bulk from Garrison and sold them on his website themfnplug.io. An Instagram page under the username "them7nplug" was used to advertise the shop.
The investigators established that the credit card used to pay for the shop's Cloudflare account belonged to Stokes.
Investigators acquired information from Coinbase that revealed that an account under the username, "themfnplug" was registered to Stokes. The account had received crypto worth a total of over $1 million.
Garrison pled guilty to conspiracy to commit computer intrusion on November 15, 2023. His sentencing is scheduled for February 1, 2024.
Austad and Stokes were arrested on January 30, 2024, and charged in a six-count indictment. They were each charged with, conspiracy to commit computer intrusions, unauthorized access to a protected computer to further intended fraud, unauthorized access to a protected computer, wire fraud conspiracy, wire fraud, and aggravated identity theft.
According to court documents, 19-year-old Nathan Austad, alias "Snoopy," and 21-year-old Kamerin Stokes, alias "TheMFNPlug," were allegedly part of a scheme that resulted in the theft of approximately $600,000 from 1,600 DraftKings accounts.
Investigations by the FBI into a credential stuffing attack against DraftKings led the investigators to Joseph Garrison. Garrison was arrested on May 18, 2023.
Conversations recovered from Garrison's phone Led the investigators to a fraud shop under the domain snoop.fo. The shop sold accounts for multiple sites including, DraftKings. The shop also provided its customers with instructions on how to cash out the funds in the accounts.
The investigators acquired the IP address used to register the Cloudflare account associated with the fraud shop from Cloudflare. Information acquired from Apple revealed that the IP had also been used to access an account registered to Austad.
The investigators executed a search warrant at Austad's residence on November 7, 2023, and seized several electronic devices. The investigators recovered Telegram conversations linking Austad to the sale of DraftKings accounts.
Austad was also found in possession of approximately 3,777,641 combinations of usernames and passwords as well as 116 "config" files used in credential stuffing attacks.
The investigators also recovered crypto wallets that had received $465,000 between January 1, 2021, and December 9, 2022.
On the Garrison Phone, law enforcement also recovered Telegram chats between Garrison and a user with the name “themfnplug." TheMFNPlug purchased DraftKings accounts in bulk from Garrison and sold them on his website themfnplug.io. An Instagram page under the username "them7nplug" was used to advertise the shop.
The investigators established that the credit card used to pay for the shop's Cloudflare account belonged to Stokes.
Investigators acquired information from Coinbase that revealed that an account under the username, "themfnplug" was registered to Stokes. The account had received crypto worth a total of over $1 million.
Garrison pled guilty to conspiracy to commit computer intrusion on November 15, 2023. His sentencing is scheduled for February 1, 2024.
Austad and Stokes were arrested on January 30, 2024, and charged in a six-count indictment. They were each charged with, conspiracy to commit computer intrusions, unauthorized access to a protected computer to further intended fraud, unauthorized access to a protected computer, wire fraud conspiracy, wire fraud, and aggravated identity theft.
