Prolific Mushroom Vendor Indicted by the Feds
~7 min read | Published on 2021-05-23, tagged Darkweb-Vendor using 1606 words.
A federal grand jury indicted six individuals for charges stemming from the sale of psychedelic mushroom analogues on the darkweb.
The defendants, James Barlow, Matthew Barlow, Ronald Brust, Jennifer Campbell, Monet L. Carriere, and Tony Du Phan sold liquid psychedelic mushrooms in nine milligram vials for approximately $20 each on a darkweb marketplace under the username TRIPWITHSCIENCE. The co-conspiratyors were active on marketplaces from November 2013 to April 2021.Customer Raid
According to court documents, the investigation began after law enforcement raided the home of someone who had purchased illicit substances from TRIPWITHSCIENCE (TWS). The drug buyer seemingly cooperated with investigators and provided them with information about the vendor.
The vendor operates primarily on Monopoly, Televend, and Cannahome. In the past, the vendor sold the same products through most mainstream marketplaces, including Empire Market, Dream Market, and Dark Market.Co-conspirator Cooperation
In October of 2020, Homeland Security Investigations Columbus (HSI), with assistance from the Drug Enforcement Administration (DEA) and the United States Postal Inspection Service identified someone in Gulf Breeze, Florida, associated with shipments linked to the TWS vendor account. The suspect had mailed TWS packages. Law enforcement executed a federal search warrant on his residence. HSI seized approximately $155,000 in cryptocurrency and cash, three firearms, and approximately 22,356 grams of 4-Acetoxy-N, N-Dimethyltryptamine (4-AcO-DMT).
During a custodial interview with investigators, the Gulf Breeze Target stated that he was not TWS but was recruited by the vendor as a reshipper to repackage and ship the vials of liquid mushrooms to the vendor’s customers. The vials were disguised with labels of fake companies, such as “Genesis Nutronics, The Natural Detox.” The Gulf Breeze reshipper stated he was paid between $4,000 and $6,000 in cryptocurrency every two weeks for his services. He stated that TWS had 1-3 “Order Men” working for him in Utah who would also mail packages of the mushroom analogue. The suspect provided LE with information that directly led to the identification of other suspects.Tony Phan
The suspect said that TWS had recommended he use a certain vendor on Alibaba.com to buy 10ML vials. A U.S. Customs and Border Protection (CBP) database query revealed that someone named Tony RN used a UPS Store Box in Memphis, Tennessee to receive similar 10ML vials as the Gulf Breeze. He received them in bulk quantities, every month. A phone number listed on one of the shipments was used to identify Tony RN as Tony Phan.
During physical surveillance of Phan’s residence, law enforcement observed him drop packages off at a Post Office. USPIS Inspectors obtained a search warrant to open at least one package. On October 29, 2020, USPIS Inspectors executed the search warrant on the package and discovered thirteen 10ML vials of brown liquid. CBP Forensics Laboratory in Savannah, Georgia tested the contents of the vials and determined the liquid to be 5-hydroxyN,N-Dimethyltryptamine, a DEA Schedule I controlled substance.
A subpoena issued to Coinbase revealed throughout the life of the account associated with Phan, Phan had received 99.87374353 BTC into the account. Records showed Phan received a total of seven one-hop transactions from the Silk Road 2.0 and Agora darkweb marketplaces. Records further showed Phan’s account regularly received varying amounts of crypto-currency, ranging from approximately $3,000 to $9,000. These received transactions occurred, on average, two times each month which aligned with the payment schedule from TWS to the Gulf Breeze reshipper.James Barlow
On October 22, 2020, HSI Columbus received data from a seized darkweb marketplace that contained 34 Bitcoin withdrawal wallet addresses for the TWS vendor account. Investigators discovered a Coinbase wallet that had received Bitcoin from TWS wallets. The account belonged to James Barlow. Coinbase showed BARLOW had sold approximately 312.99 Bitcoins through the exchange valued at $717,461.
The Coinbase subpoena results showed Barlow had vanity wallet address 1Bar1ow5zwy47N5ZkRLhvaWvVYFKT8xg8q on the account. Through cryptocurrency analysis tracing, investigators learned that 1Bar1ow5zwy47N5ZkRLhvaWvVYFKT8xg8q shares private keys with vanity address 1TWS1XtNX9pwjWJSxnRarqiZhYWRHoUWs. Investigators believe this address is associated with TWS.
While conducted crypto-currency analysis on the bitcoin wallet addresses listed in the Coinbase subpoena for BARLOW, investigators discovered five direct transactions, from November 20, 2013, to September 2, 2014, between Barlow and “TripWithScience’s” darknet withdraw wallets. Investigators commonly observe darknet vendors withdraw their drug proceeds directly into their accounts when they first begin selling on the darknet.
A U.S. Customs and Border Protection database query of international parcel seizures revealed three possible seizures associated with Barlow. One of those seizures was 113 grams of 4-Acetoxy-N, N-Dimethyltryptamine (4-AcO-DMT) addressed to Jim Barlow. The other two were 105 grams of 3,4-Methylenedioxymethamphetamine (MDMA) addressed to a James Barlow and 1,416 grams of Gamma Hydroxy Butyrate (GHB) addressed to an “Adam Businger” at James Barlow’s residence.
Barlow, at his Vegas address, was listed as the manager of the company Nutra HQ at a P.O. BOX in Las Vegas, Nevada. A CBP database query of international shipments showed Nutra HQ had received three international shipments. Two shipments contained a grinding machine and 2500 10ML plastic bottles. The third shipment to Nutra HQ contained 2500 plastic bottles and was sent from the same shipper who sent 10ML bottles to the Gulf Breeze reshipper.Monet Carriere
Further crypto-currency tracing conducted on wallet addresses belonging to TWS that were received from seized darkweb marketplace data showed that a second Coinbase account had received bitcoin from TWS. Results from a subpoena served to Coinbase revealed the account belonged to Monet Carriere. The account showed Carriere had received 334.47112423 BTC. The Coinbase account had also sent money to several noteworthy companies, including Capsule Connection, LLC, Freund Container, Spice Jungle, LLC, and 22 purchases from USPS.com. Total purchases from USPS.com equaled $21,184.
A subpoena served to Capsule Connection, LLC revealed Carriere was associated with six orders of bulk “Gelatin Capsules”. The size and shape of these capsules matched capsules sold by darknet vendor PerfectShrooms, according to the criminal complaint.Matt Barlow, Jenni Campbell
On November 30, 2020 Spice Jungle LLC was issued a subpoena for the account history associated with Carriere, James Barlow, Nutra HQ, and any customers using the shipping addresses associated with the co-conspirators. The Spice Jungle LLC subpoena revealed numerous orders, totaling $8,429,51, associated with Carriere, James Barlow, Matt Barlow, Jenni Campbell, and Nutra HQ.
A subpoena issued to Coinbase revealed Matthew Barlow created an account on February 21, 2018, and Campbell was listed as being associated with the account. Throughout the life of the account, Matthew Barlow and Campbell’s account received 22 BTC.
In a verification picture Matthew Barlow had provided Coinbase, investigators noticed multiple USPS Priority Mail shipping boxes stacked on a cabinet in the background. These boxes matched the boxes of suspected drugs being sent from the Salt Lake City, Utah area to Phan and the Gulf Breeze reshipper.
In January 2021, HSI Columbus received electronic results from a search warrant issued to Google for records associated with [email protected]. In the records, images showed containers and bags of mushrooms with the cartoon scientist icon used by TWS and the script “u/TripWithScience” written underneath. Multiple images showed a step-by-step alcohol extraction of psilocybin mushrooms. Metadata in the images showed they were taken at an address in Las Vegas, Nevada. Images were found of mushrooms growing on a substrate. In the images, the words “PerfectShrooms” with cartoon mushrooms were printed on a piece of paper next to the growing mushrooms. The metadata of both images showed they were taken on November 15, 2020, near the same address in Las Vegas, Nevada.Ronald Brust
A clear web search of the Las Vegas address showed the residence was occupied by Ronald Brust. Brust co-owns the business Illuminated Couture and Good-To-Glow with James Barlow.
A subpoena issued to Coinbase revealed Brust possessed a personal and a business account. During the life of the personal account, Brust received 5.4995289 BTC valued at $63,117. Investigative analysis was conducted on the wallet addresses of Brust’s account. Analysis showed one three-hop transaction between a bitcoin mixer and Brust. During the life of the business account, Brust received 26.39784414 BTC valued at $37,810. Investigative analysis was conducted on the wallet addresses of Brust’s business account. Analysis showed Brust had received two four-hop transactions from the Wall Street and Hydra darkweb markets. Further, Brust received 1.38475291 BTC from a wallet which also sent funds to a second co-conspirator.
While analyzing James Barlow’s Google Drive search warrant results, investigators found photos and videos depicting James Barlow’s illicit drug use, the photos include drugs believed to be DMT, Ketamine, LSD, MDMA, and Psychedelic Mushrooms. Investigators also found a spreadsheet named TCS Accounting that appeared to show an income and expense table that included multiple transactions with descriptions regarding darkweb markets, drugs, known TWS reshipper code names, bitcoin mixing services. The spreadsheet showed an average yearly income of $211,019 in 2014 and a yearly income of $2,814,606 in 2021. The spreadsheet showed James Barlow’s value as $4,378,974 in 2020.
Investigators, using the evidence provided above, summarized the case as follows:
James Barlow is the owner of the TripWithScience and PerfectShrooms vendor accounts. Carriere began as a reshipper for TWS and later handled the ordering of precursors needed for mixing the liquid and powdered mushrooms sold by the Barlow. Investigators believe Matthew Barlow and Campbell mix the liquid mushrooms in quart bottles that they ship to Phan in Memphis, Tennessee, and Daniel Barwell in the United Kingdom. Phan then repackaged the quarts bottles of liquid mushrooms into vials and shipped them to TWS customers inside the United States. Barwell did the same thing as Phan for all TWS customers outside the United States. Brust grew psilocybin mushrooms for Barlow. Investigators also believe Brust assisted with the packaging of capsules for PerfectShrooms.
The defendants, James Barlow, Matthew Barlow, Ronald Brust, Jennifer Campbell, Monet L. Carriere, and Tony Du Phan sold liquid psychedelic mushrooms in nine milligram vials for approximately $20 each on a darkweb marketplace under the username TRIPWITHSCIENCE. The co-conspiratyors were active on marketplaces from November 2013 to April 2021.Customer Raid
According to court documents, the investigation began after law enforcement raided the home of someone who had purchased illicit substances from TRIPWITHSCIENCE (TWS). The drug buyer seemingly cooperated with investigators and provided them with information about the vendor.
TWS used a Telegram account via the Televend service.
The vendor operates primarily on Monopoly, Televend, and Cannahome. In the past, the vendor sold the same products through most mainstream marketplaces, including Empire Market, Dream Market, and Dark Market.Co-conspirator Cooperation
In October of 2020, Homeland Security Investigations Columbus (HSI), with assistance from the Drug Enforcement Administration (DEA) and the United States Postal Inspection Service identified someone in Gulf Breeze, Florida, associated with shipments linked to the TWS vendor account. The suspect had mailed TWS packages. Law enforcement executed a federal search warrant on his residence. HSI seized approximately $155,000 in cryptocurrency and cash, three firearms, and approximately 22,356 grams of 4-Acetoxy-N, N-Dimethyltryptamine (4-AcO-DMT).
During a custodial interview with investigators, the Gulf Breeze Target stated that he was not TWS but was recruited by the vendor as a reshipper to repackage and ship the vials of liquid mushrooms to the vendor’s customers. The vials were disguised with labels of fake companies, such as “Genesis Nutronics, The Natural Detox.” The Gulf Breeze reshipper stated he was paid between $4,000 and $6,000 in cryptocurrency every two weeks for his services. He stated that TWS had 1-3 “Order Men” working for him in Utah who would also mail packages of the mushroom analogue. The suspect provided LE with information that directly led to the identification of other suspects.Tony Phan
The suspect said that TWS had recommended he use a certain vendor on Alibaba.com to buy 10ML vials. A U.S. Customs and Border Protection (CBP) database query revealed that someone named Tony RN used a UPS Store Box in Memphis, Tennessee to receive similar 10ML vials as the Gulf Breeze. He received them in bulk quantities, every month. A phone number listed on one of the shipments was used to identify Tony RN as Tony Phan.
A picture of products from TWS posted by a Reddit user.
During physical surveillance of Phan’s residence, law enforcement observed him drop packages off at a Post Office. USPIS Inspectors obtained a search warrant to open at least one package. On October 29, 2020, USPIS Inspectors executed the search warrant on the package and discovered thirteen 10ML vials of brown liquid. CBP Forensics Laboratory in Savannah, Georgia tested the contents of the vials and determined the liquid to be 5-hydroxyN,N-Dimethyltryptamine, a DEA Schedule I controlled substance.
A subpoena issued to Coinbase revealed throughout the life of the account associated with Phan, Phan had received 99.87374353 BTC into the account. Records showed Phan received a total of seven one-hop transactions from the Silk Road 2.0 and Agora darkweb marketplaces. Records further showed Phan’s account regularly received varying amounts of crypto-currency, ranging from approximately $3,000 to $9,000. These received transactions occurred, on average, two times each month which aligned with the payment schedule from TWS to the Gulf Breeze reshipper.James Barlow
On October 22, 2020, HSI Columbus received data from a seized darkweb marketplace that contained 34 Bitcoin withdrawal wallet addresses for the TWS vendor account. Investigators discovered a Coinbase wallet that had received Bitcoin from TWS wallets. The account belonged to James Barlow. Coinbase showed BARLOW had sold approximately 312.99 Bitcoins through the exchange valued at $717,461.
TWS advertised 'all natural' liquid shrooms.
The Coinbase subpoena results showed Barlow had vanity wallet address 1Bar1ow5zwy47N5ZkRLhvaWvVYFKT8xg8q on the account. Through cryptocurrency analysis tracing, investigators learned that 1Bar1ow5zwy47N5ZkRLhvaWvVYFKT8xg8q shares private keys with vanity address 1TWS1XtNX9pwjWJSxnRarqiZhYWRHoUWs. Investigators believe this address is associated with TWS.
While conducted crypto-currency analysis on the bitcoin wallet addresses listed in the Coinbase subpoena for BARLOW, investigators discovered five direct transactions, from November 20, 2013, to September 2, 2014, between Barlow and “TripWithScience’s” darknet withdraw wallets. Investigators commonly observe darknet vendors withdraw their drug proceeds directly into their accounts when they first begin selling on the darknet.
A U.S. Customs and Border Protection database query of international parcel seizures revealed three possible seizures associated with Barlow. One of those seizures was 113 grams of 4-Acetoxy-N, N-Dimethyltryptamine (4-AcO-DMT) addressed to Jim Barlow. The other two were 105 grams of 3,4-Methylenedioxymethamphetamine (MDMA) addressed to a James Barlow and 1,416 grams of Gamma Hydroxy Butyrate (GHB) addressed to an “Adam Businger” at James Barlow’s residence.
Barlow, at his Vegas address, was listed as the manager of the company Nutra HQ at a P.O. BOX in Las Vegas, Nevada. A CBP database query of international shipments showed Nutra HQ had received three international shipments. Two shipments contained a grinding machine and 2500 10ML plastic bottles. The third shipment to Nutra HQ contained 2500 plastic bottles and was sent from the same shipper who sent 10ML bottles to the Gulf Breeze reshipper.Monet Carriere
Further crypto-currency tracing conducted on wallet addresses belonging to TWS that were received from seized darkweb marketplace data showed that a second Coinbase account had received bitcoin from TWS. Results from a subpoena served to Coinbase revealed the account belonged to Monet Carriere. The account showed Carriere had received 334.47112423 BTC. The Coinbase account had also sent money to several noteworthy companies, including Capsule Connection, LLC, Freund Container, Spice Jungle, LLC, and 22 purchases from USPS.com. Total purchases from USPS.com equaled $21,184.
A subpoena served to Capsule Connection, LLC revealed Carriere was associated with six orders of bulk “Gelatin Capsules”. The size and shape of these capsules matched capsules sold by darknet vendor PerfectShrooms, according to the criminal complaint.Matt Barlow, Jenni Campbell
On November 30, 2020 Spice Jungle LLC was issued a subpoena for the account history associated with Carriere, James Barlow, Nutra HQ, and any customers using the shipping addresses associated with the co-conspirators. The Spice Jungle LLC subpoena revealed numerous orders, totaling $8,429,51, associated with Carriere, James Barlow, Matt Barlow, Jenni Campbell, and Nutra HQ.
A subpoena issued to Coinbase revealed Matthew Barlow created an account on February 21, 2018, and Campbell was listed as being associated with the account. Throughout the life of the account, Matthew Barlow and Campbell’s account received 22 BTC.
In a verification picture Matthew Barlow had provided Coinbase, investigators noticed multiple USPS Priority Mail shipping boxes stacked on a cabinet in the background. These boxes matched the boxes of suspected drugs being sent from the Salt Lake City, Utah area to Phan and the Gulf Breeze reshipper.
In January 2021, HSI Columbus received electronic results from a search warrant issued to Google for records associated with [email protected]. In the records, images showed containers and bags of mushrooms with the cartoon scientist icon used by TWS and the script “u/TripWithScience” written underneath. Multiple images showed a step-by-step alcohol extraction of psilocybin mushrooms. Metadata in the images showed they were taken at an address in Las Vegas, Nevada. Images were found of mushrooms growing on a substrate. In the images, the words “PerfectShrooms” with cartoon mushrooms were printed on a piece of paper next to the growing mushrooms. The metadata of both images showed they were taken on November 15, 2020, near the same address in Las Vegas, Nevada.Ronald Brust
A clear web search of the Las Vegas address showed the residence was occupied by Ronald Brust. Brust co-owns the business Illuminated Couture and Good-To-Glow with James Barlow.
A subpoena issued to Coinbase revealed Brust possessed a personal and a business account. During the life of the personal account, Brust received 5.4995289 BTC valued at $63,117. Investigative analysis was conducted on the wallet addresses of Brust’s account. Analysis showed one three-hop transaction between a bitcoin mixer and Brust. During the life of the business account, Brust received 26.39784414 BTC valued at $37,810. Investigative analysis was conducted on the wallet addresses of Brust’s business account. Analysis showed Brust had received two four-hop transactions from the Wall Street and Hydra darkweb markets. Further, Brust received 1.38475291 BTC from a wallet which also sent funds to a second co-conspirator.
While analyzing James Barlow’s Google Drive search warrant results, investigators found photos and videos depicting James Barlow’s illicit drug use, the photos include drugs believed to be DMT, Ketamine, LSD, MDMA, and Psychedelic Mushrooms. Investigators also found a spreadsheet named TCS Accounting that appeared to show an income and expense table that included multiple transactions with descriptions regarding darkweb markets, drugs, known TWS reshipper code names, bitcoin mixing services. The spreadsheet showed an average yearly income of $211,019 in 2014 and a yearly income of $2,814,606 in 2021. The spreadsheet showed James Barlow’s value as $4,378,974 in 2020.
Investigators, using the evidence provided above, summarized the case as follows:
James Barlow is the owner of the TripWithScience and PerfectShrooms vendor accounts. Carriere began as a reshipper for TWS and later handled the ordering of precursors needed for mixing the liquid and powdered mushrooms sold by the Barlow. Investigators believe Matthew Barlow and Campbell mix the liquid mushrooms in quart bottles that they ship to Phan in Memphis, Tennessee, and Daniel Barwell in the United Kingdom. Phan then repackaged the quarts bottles of liquid mushrooms into vials and shipped them to TWS customers inside the United States. Barwell did the same thing as Phan for all TWS customers outside the United States. Brust grew psilocybin mushrooms for Barlow. Investigators also believe Brust assisted with the packaging of capsules for PerfectShrooms.
