Duo Charged for Selling Betting Accounts

~2 min read | Published on 2024-01-31, tagged ArrestedFraud using 391 words.

Two men were charged for participating in a conspiracy to sell login credentials of accounts at a fantasy sports and betting website.


According to court documents, 19-year-old Nathan Austad, alias "Snoopy," and 21-year-old Kamerin Stokes, alias "TheMFNPlug," were allegedly part of a scheme that resulted in the theft of approximately $600,000 from 1,600 DraftKings accounts.
Investigations by the FBI into a credential stuffing attack against DraftKings led the investigators to Joseph Garrison. Garrison was arrested on May 18, 2023.
Conversations recovered from Garrison's phone Led the investigators to a fraud shop under the domain snoop.fo. The shop sold accounts for multiple sites including, DraftKings. The shop also provided its customers with instructions on how to cash out the funds in the accounts.
The investigators acquired the IP address used to register the Cloudflare account associated with the fraud shop from Cloudflare. Information acquired from Apple revealed that the IP had also been used to access an account registered to Austad.
The investigators executed a search warrant at Austad's residence on November 7, 2023, and seized several electronic devices. The investigators recovered Telegram conversations linking Austad to the sale of DraftKings accounts.


Austad was also found in possession of approximately 3,777,641 combinations of usernames and passwords as well as 116 "config" files used in credential stuffing attacks.
The investigators also recovered crypto wallets that had received $465,000 between January 1, 2021, and December 9, 2022.
On the Garrison Phone, law enforcement also recovered Telegram chats between Garrison and a user with the name “themfnplug." TheMFNPlug purchased DraftKings accounts in bulk from Garrison and sold them on his website themfnplug.io. An Instagram page under the username "them7nplug" was used to advertise the shop.


The investigators established that the credit card used to pay for the shop's Cloudflare account belonged to Stokes.
Investigators acquired information from Coinbase that revealed that an account under the username, "themfnplug" was registered to Stokes. The account had received crypto worth a total of over $1 million.
Garrison pled guilty to conspiracy to commit computer intrusion on November 15, 2023. His sentencing is scheduled for February 1, 2024.
Austad and Stokes were arrested on January 30, 2024, and charged in a six-count indictment. They were each charged with, conspiracy to commit computer intrusions, unauthorized access to a protected computer to further intended fraud, unauthorized access to a protected computer, wire fraud conspiracy, wire fraud, and aggravated identity theft.

Comments (11)


AghInG2024-02-01
f3ccd87a

How to be untraceable in the web, anybody know

Obvious answers2024-02-10
d76e5016

Don't do bad shit

PleaseAnal2024-02-02
90e3ba0f

Based, locked up in prison and owing the government millions. So cool. So brave.

lo112024-02-04
77a90225

Sometimes I never understand about these people, they sell this weird shit... they know what they are doing... but they refuse to use TOR. They use their own CC to pay for servers, they could use prepaid... They use personal Coinbase account, they could use money mule. They use telegram... surprised they werent using their "double char" instagram accounts

vans2024-02-17
d10eaa5f

Why use money mule when can use monero? also isnt telegram very secure?

Common Sense2024-02-21
30186e8d

For some reason hackers in particular are ULTRA retarded when it comes to OPSEC. They literally dont even try to hide their tracks, and use their own PC at home with no TOR, no VPN, paid for with their credit card under their real name. The podcast Darknet Diaries is a great example of this, guys commiting HUGE CRIMES and they just are waiting at home fr the police to come arrest them lmao. I think it is legit mental illness or something, i dont get it

lo112024-02-04
4f60b613

oh and for your information these account sellers as can be seen in screenshot use websites like atshop()io that log completely everything. its absolutely ridiculous.

Dickboy562024-02-06
3280886e

Can you help me on how to make my first Purchase on the Darkweb?

ricki2024-02-21
3ad799c4

make sure to use Monero, its private. Also, best to buy it with cash, check the website LocalMonero.co

fuckthepolice2024-02-06
ee23e656

this is the consequences of slipping up. How good is ur OPsec???????

HeywoodJablewme2024-02-08
ef29af7b

These fools just ask to be caught. Most of them look like they can barely start a car.