Case 3:23-cr-00128-CVR Document 3 Filed 03/23/23 Page 1 of 1

AO 91 (Rev. 11/11) Criminal Complaint

UNITED STATES DISTRICT COURT

for the
DistrictDistrict
__________ of Puerto Rico
of __________

United States of America )

v. )
)
BRIAN LUIS VALENTIN-RAMOS ) Case No. 23-
)
)
)
Defendant(s)

CRIMINAL COMPLAINT
I, the complainant in this case, state that the following is true to the best of my knowledge and belief.
On or about the date(s) of May 2020 until March 2023 in the county of in the
District of Puerto Rico , the defendant(s) violated:

Code Section Offense Description

18 U.S.C. §§ 1030(a)(2)(c) and
1030(b)
18 U.S.C. § 2252A(a)(4)(B)
18 U.S.C. § 2252A(a)(2)(B)
18 U.S.C. § 2252A(a)(4)(B)
Conspiracy to commit fraud and related activity in connection with computers
Possession of Child Pornography with Intent to sell
Distribution of Child Pornography
Sale of Child Pornography

This criminal complaint is based on these facts:

See attached af davit.
The United States requests that defendant be detained and moves for a three-day continuance under
18 U.S.C. § 3142(f).
Approved by AUSA Jeanette M. Collazo-Ortiz

✔ Continued on the attached sheet.

’

Complainant’s signature

Christian Nieves, Special Agent FBI

Printed name and title

Sworn to and subscribed before me in accordance with the requirements of Fed. R. Crim. P. 4.1 by telephone at ________,
this ___th day of March 2023 in San Juan, Puerto Rico.

Date: 03/23/2023
Judge’s signature

City and state: San Juan, Puerto Rico Marshal D. Morgan, U.S. Magistrate Judge
Printed name and title
fi
 Case 3:23-cr-00128-CVR Document 3-1 Filed 03/23/23 Page 1 of 21

AFFIDAVIT IN SUPPORT OF CRIMINAL COMPLAINT

I, Christian Nieves, hereinafter referred to as your affiant, a Special Agent of the Federal
Bureau of Investigation (FBI), being duly sworn, state and depose as follows:

AGENT BACKGROUND

1. I have been employed as a Special Agent with the Federal Bureau of Investigation

(“FBI”) since July 2017. I am assigned to the FBI San Juan Division Cyber Crimes Investigation

Task Force. I have received training and investigated a variety of federal crimes involving cyber

intrusion and computer fraud. I have experience regarding these federal violations through my

daily investigative responsibilities and extensive training. For example, I have attended numerous

classes and trainings dealing with computer crimes and fraud, including how computer networks

operate, methods employed by criminals to infiltrate computer networks and commit other crimes,

the purpose of the intrusions, and the numerous types of fraudulent schemes that perpetrators of

computer crimes carry out after gaining access to computer networks (e.g., selling stolen credit

card information located on a compromised computer or surreptitious use of a compromised

computer for further intrusions).

2. I have conducted numerous complex investigations concerning computer crimes

and fraud, including wire and mail frauds, intrusions (i.e., gaining access to a protected computer

or computer network without permission), denial of service attacks (i.e., attempts to make a

website, computer, or device unresponsive), the use of botnets (i.e., a group of computers

controlled without the knowledge of the computers’ owners), and the use of bulletproof servers

(i.e., servers controlled by administrators who often are non-responsive to law enforcement

requests and often host illicit content anonymously). I have extensive experience reviewing

records related to computer crime and fraud, including Internet Protocol (“IP”) address logs used

1
 Case 3:23-cr-00128-CVR Document 3-1 Filed 03/23/23 Page 2 of 21

by computers on the Internet, network access logs, and security programs. I also have extensive

experience debriefing defendants, witnesses, informants, and other persons involved in computer

crime and fraud. I have personally conducted and have been involved in numerous investigations

that included the execution of search warrants involving electronic evidence and have been

involved in all phases of investigations, from inception through trial, of computer intrusions as

well as of criminal hackers.

3. The facts in this affidavit come from my personal observations, my training and

experience, and information obtained from other agents and witnesses.

4. Based on my training and experience and the facts as set forth in this affidavit, there

is probable cause to believe Brian Luis Valentin Ramos has committed violations of Title 18,

United States Code, Sections 1030(a)(2)(C) and 1030(b), (Conspiracy to commit fraud and related

activity in connection with computers), Section 2252A(a)(4)(B) (Possession of Child

Pornography), Section 2252A(a)(2)(B) (Distribution of Child Pornography), and Section

2252A(a)(3)(B) (Sale of Child Pornography). Therefore, I respectfully request the Court approve

the requested complaint and issue an arrest warrant for Brian Luis Valentin Ramos.

5. This affidavit is intended to show merely that there is sufficient probable cause for

the requested arrest warrant and does not set forth all of my knowledge about this investigation.

FACTS ESTABLISHING PROBABLE CAUSE

BACKGRUND AND IDENTIFICATION OF BRIAN VALENTIN-RAMOS

6. Computer hackers use “credential harvesting” to get access to victims’ usernames,

passwords, and email addresses. Credential harvesting can use a wide range of tactics, such as

phishing (sending emails or other messages purporting to be from reputable companies in order to

induce individuals to reveal personal information), malware, infected documents/attachments, and

2
 Case 3:23-cr-00128-CVR Document 3-1 Filed 03/23/23 Page 3 of 21

compromised third-party code in otherwise legitimate sites that collects personal information.

Credential harvesters often use “social engineering” techniques that involve manipulating people

in in order to gain control over their computer systems.

7. Since at least May 2020, cyber actors operating in Puerto Rico have targeted female

victims primarily in Puerto Rico with a credential harvesting and account compromise 1 scheme.

Hackers identified victims, in most cases Puerto Rican females, and by leveraging credential

harvesting emails and social engineering, the cyber hackers compromised the victim’s email and/or

social media accounts’ credentials, successfully gaining unauthorized access to their accounts.

Once they obtained access to the accounts, the cyber actors would access the victim’s private

content including nude and sexually explicit images of the victims.

8. During the investigation, FBI San Juan learned that Slay3r_r00t 2, a self-proclaimed

hacker, successfully compromised over one hundred University of Puerto Rico (UPR) user

accounts, gaining unauthorized access to students’ personal identifiable information. Slay3r_r00t

would then leverage the compromised credentials to pivot to other accounts owned by the victims

and gain unauthorized access. Slay3r_r00t would primarily target the victims’ social media

accounts, such as Snapchat, with the intention of gaining access to the female victim’s nude images

and sexual videos. Slay3r_r00t would then share the women’s private content with a Twitter

account known as NOTIPR without the victims’ consent. Notipr and later iterations of the page

would publish without authorization hacked content (nude and sexually explicit images), including

of Slay3r_r00t’s victims.

9. Since at least May 2020, FBI San Juan and the Puerto Rico Police Bureau started

receiving complaints about several online pages which were exposing nude and explicit images

1
A compromised account is an account with login details known by one or more unauthorized individuals.
2
The FBI has already identified Slay3r_r00t. See Crim. No. 22-CR-307 (SCC).

3
 Case 3:23-cr-00128-CVR Document 3-1 Filed 03/23/23 Page 4 of 21

without the victim’s consent. Most of the complainants further explained their images had been

obtained by an unknown actor hacking their social media accounts.

10. Furthermore, on or about to July 2020, Puerto Rico news outlets started reporting

on several social media pages, to include Twitter page XponiendoPR and Reddit page u/notipr,

which were exposing nude and intimate images without the victims’ consent.

11. During the course of the investigation, the FBI identified Brian Luis Valentin

Ramos to be the operator of phone number 939-XXX-4958, Twitter account NOTIPR and several

other iterations of the Twitter page including @xponiendoprr (hereafter “xponiendoprr”), Twitter

account @XponiendoPR (hereafter “XponiendoPR”), Twitter account @notixpr (hereafter

“notixpr”), Twitter account @NotiPRNudes (hereafter “NotiPRNudes”), Reddit account u/notipr

(hereafter “u/notipr”), and Telegram account NotiPR (hereafter “NotiPR”). The table below

summarizes how Brian Valentin Ramos is connected to each account used in furtherance of the

scheme.

Provider Facility Linked Account Link Account Owner

Claro 939-xxx-4958 BPPR Account 390-xxx551 Brian Luis Valentin
Claro 939-xxx-4958 PR Driver's License 65xxx91 Brian Luis Valentin Ramos
PayPal account
Claro 939-xxx-4958 Noti PR
13070616xxx40044242
Claro 939-xxx-4958 Apple iCloud Account BrianValentin
Twitter Xponiendoprr brianvalentin96xx@gmail.com BrianValentin
Twitter Xponiendoprr Apple iCloud Account BrianValentin
Twitter XponiendoPR Apple iCloud Account BrianValentin
Twitter XponiendoPR xponiendopr123@gmail.com Noti PR
Twitter Notixpr Apple iCloud Account BrianValentin
Twitter NotiPRNudes Apple iCloud Account BrianValentin
Twitter NotiPRNudes notiprnudes@gmail.com Noti PR
Reddit u/notipr Apple iCloud Account Brian Luis Valentin Ramos
Telegram NotiPR Phone 939-xxx-4958 Brian Luis Valentin Ramos
Google xponiendopr123@gmail.com brianluis96xx@gmail.com Brian Luis Valentin Ramos
PayPal account
Google notiprnudes@gmail.com Noti PR
1307061xxx940044242

4
 Case 3:23-cr-00128-CVR Document 3-1 Filed 03/23/23 Page 5 of 21

PayPal account
Google lanotipr@gmail.com BrianValentin
230459xxx1766165494
Google lanotipr@gmail.com brianvalentin96xx@gmail.com BrianValentin
Google lanotipr@gmail.com brianluis96xx@gmail.com BrianValentin
Account
Paypal BPPR Account 390-xxx551 Brian Luis Valentin
130706166xxx0044242
Account
Paypal 939-xxx-4958 Brian Luis Valentin Ramos
130706166xxx0044242
Account
Paypal BPPR Account 390-xxx551 Brian Luis Valentin
23045988xxx66165494
Account
Paypal brianvalentin39xx@gmail.com BrianValentin
230459881xxx6165494

12. After reviewing search warrant responses from Twitter accounts XponiendoPR,

notixpr, NotiPRNudes, and Reddit account u/notipr, all were found to possess:

x Hundreds of images, to include nude and sexually explicit images and/or videos of

Slay3r_r00t victims and direct message conversations where conspiracy to obtain nude

and sexually explicit images and videos were discussed in violation of Title 18, United

States Code, Sections 1030(a)(2)(C) and 1030(b), (Conspiracy to commit fraud and

related activity in connection with computers) as further described below;

x Public tweets by Valentin Ramos where victims, to include Minor Victim 1 3, and Minor

Victim 2 (in addition to images of Slay3r_r00t victims),4 were identified by their real

names and their nude and sexually explicit images and/or videos were made public,

and direct message conversations between Valentin Ramos and third parties in which

content, to include content of Slay3r_r00t’s victims, Minor Victim 1, and Minor Victim

2, was knowingly and willingly distributed in violation of Title 18, United States Code,

3
Minor Victim 1 is now over the age of 18 but was a minor at the times relevant to the offense
conduct.
4
This affidavit does not present evidence that Slay3r-r00t obtained the images of Minor Victim 1
and Minor Victim 2, was involved in their publication, or otherwise knowingly distributed to
Valentin-Ramos images of minors. Slay3r-r00t’s victims for which he was charged and pled
guilty in 22-CR-307 were more than seventeen years of age.
5
 Case 3:23-cr-00128-CVR Document 3-1 Filed 03/23/23 Page 6 of 21

Section 2252A(a)(4)(B) (Possession of Child Pornography), Section 2252A(a)(2)(B)

(Distribution of Child Pornography), and Section 2252A(a)(3)(B) (Sale of Child

Pornography) as further described below.

13. Puerto Rico Department of Transportation records for Brian Luis Valentin

Ramos, Social Security Number ending in 3981, Date of Birth September 29, 19, yielded the

following positive result:

x Name: Valentin Ramos, Brian Luis

x Phone Number: 939-XXX-4958
x Driver License Number: 65058xx (Puerto Rico)
14. FBI San Juan received a response to a court order from Claro Puerto Rico

containing information on phone number 939-XXX-4958. Phone number 939-XXX-4958 was

identified to be registered to an Apple smart device and associated with Claro unique account

775285617 and the registered subscriber was identified as the sister of Brian Luis Valentin

Ramos.

15. A search warrant to Apple for Brian Luis Valentin Ramos’ Apple iCloud account

confirmed phone number 939-XXX-4958 to be operated by Brian Luis Valentin Ramos and

revealed over one hundred thousand (100,000) images, to include nude and explicit photos and

videos of Slay3r_r00t’s victims, Minor Victim 1, and Minor Victim 2

16. Amongst these images were screen captures of the Twitter accounts Xponiendoprr,

XponiendoPR, notixpr, and NotiPRNudes which displayed the "Edit Profile" icon, captured the

Twitter account’s name, handle, and creation date. Based on my training and experience the "Edit

Profile" icon indicates the screen capture was taken by the page creator/owner.

17. Furthermore, Brian Luis Valentin Ramos’ Apple iCloud account Notes application

included several pre-drafted notes that contained advertising for sexually explicit content, to

6
 Case 3:23-cr-00128-CVR Document 3-1 Filed 03/23/23 Page 7 of 21

include that of Slay3r_r00t’s victims and Minor Victim 1, for sale between $20 and $50 USD

depending on the victim. The advertisement in the Notes application listed Telegram account

@NotiPR as the contact for further details. Additionally, Brian Luis Valentin Ramos’s Apple

iCloud account keychain, saved username and passwords, included credentials for Reddit account

u/notipr.

18. FBI San Juan identified Brian Luis Valentin Ramos’ phone number, 939-XXX-

4958, and email account brianluis96xx@gmail.com, created using the same machine cookie5 as

email brianvalentin96xx@gmail.com (identified as the email account associated with Twitter

account xponiendoprr), were linked with Brian Luis Valentin Ramos’ Banco Popular de Puerto

Rico (BPPR) account:

x Account: XXX-XX7551
x Opened On: 05/28/2020
x Account Name: BRIAN LUIS VALENTIN
x Account Type: Checking
x Phone numbers: 939-XXX-4958 / 787-XXX-9435
x Email Address: Brianluis96xx@gmail.com
x Social Security Number: XXX-XX-3981
x Physical Address: BO [REDACTED]. Cabo Rojo, PR 00623

19. Furthermore, Brian Luis Valentin Ramos’ BPPR account and phone number, 939-

XXX-4958, were found to be linked with PayPal account xxxxxxxx0044242, email

notiprnudes@gmail.com, and PayPal account xxxxxxxxx65494, email lanotipr@gmail.com.

20. During the course of the investigation, payments for access to nude and explicit

photos and videos of victims, to include nude and explicit photos and videos of Slay3r_r00t’s

5
A cookie is a piece of text that a Web server can store on a user's hard disk. Cookies allow a
Web site to store information on a user's machine and later retrieve it.
7
 Case 3:23-cr-00128-CVR Document 3-1 Filed 03/23/23 Page 8 of 21

victims and Minor Victim 1, were found to have been made via Brian Luis Valentin Ramos’

"ATH Movil" account, associated with phone number 939-XXX-4958, and via PayPal using email

lanotipr@gmail.com and email account notiprnudes@gmail.com.

21. On August 28, 2020, as part of an ongoing conversation, Brian Luis Valentin

Ramos, using Twitter account XponiendoPR, exchanged messages with Twitter ID ending in

003778 where Brian Luis Valentin Ramos sold and distributed nude and explicit photos and

videos of victims, to include Minor Victim 1’s content.

22. Brian Luis Valentin Ramos provided email account lanotipr@gmail.com to

receive the payment via PayPal. Twitter ID ending in 003778 sent an image as proof of payment

which captured a PayPal transaction for one hundred and twenty US dollars ($120.00) sent to

“Brian Valentin”.

23. On January 20, 2023, FBI San Juan obtained and served a 45-day prospective data

Search Warrant on Claro for Brian Luis Valentin Ramos’ phone number 939-XXX-4958.

24. As of March 5, 2023, Call Detail Records (CDRs), with cell site information,

revealed the two most frequent cellular towers utilized were 20041 and 20001. Both cellular

towers’ coverage area includes the vicinity of Calle C, Aguadilla, Puerto Rico.

25. As of March 8, 2023, Brian Luis Valentin Ramos’ Telegram user “Noti PR”,

associated with phone number 939-XXX-4958, was still actively communicating with members

of several telegram groups including groups used to exchange illegally obtained nude images.

8
 Case 3:23-cr-00128-CVR Document 3-1 Filed 03/23/23 Page 9 of 21

CONSPIRACY TO COMMIT FRAUD AND RELATED ACTIVITY IN

CONNECTION WITH COMPUTERS

26. By analyzing the Twitter direct messages obtained through search warrants, the FBI

learned Brian Luis Valentin Ramos worked with others including “Slay3r_r00t “to “hack”

accounts. Valentin Ramos advertised the possibility of purchasing or exchanging female nude

content with others to include content of Slay3r_r00t’s victims.

27. On July 22, 2020, as part of an ongoing conversation, Brian Luis Valentin Ramos,

using Twitter account XponiendoPR, exchanged several messages with Twitter ID ending in

0067328 where Brian Luis Valentin Ramos discussed hacking female social media accounts to

gain access to their private content, and exchanged the content with others. The following is a

summary translation of some of the messages sent and received by Brian Luis Valentin Ramos

which were in Spanish:

Twitter ID ending in 0067328: "Hey, I want you to hack two SC which will fill you up with
content”
XponiendoPR: "I don’t hack but I know someone who hacks"
XponiendoPR: "I send the user and he gets it done”
28. On July 23, 2020, as part of an ongoing conversation, Brian Luis Valentin Ramos,

using Twitter account XponiendoPR, exchanged several messages with Twitter ID ending in

987842 . The following is a summary translation of some of the messages sent and received by

Brian Luis Valentin Ramos which were in Spanish:

XponiendoPR: "I asked for lali’s snap to be hacked”

XponiendoPR: "I think they are going to hack Lali’s snap"
XponiendoPR: "it’s very hard but I asked a friend who is a hacker to see if he can get from
the ones you sent me”

9
 Case 3:23-cr-00128-CVR Document 3-1 Filed 03/23/23 Page 10 of 21

29. From December 20, 2020, to March 2, 2021, Brian Luis Valentin Ramos, using

Twitter account notixpr, engaged in direct message conversations with Twitter account ending in

144658. The following is a summary translation of a message sent by Brian Luis Valentin Ramos

which was in Spanish:

Notixpr: "I sell my content because it was obtained via hacking making it exclusive"

30. On March 24, 2022, Brian Luis Valentin Ramos, using Telegram account

@notipr, discussed owning account Xponiendoxpr and conspiring with Slay3r_r00t. The

following is a summary translation of some of the messages sent and received by Brian Luis

Valentin Ramos, which were in Spanish:

notipr: “Those who know, know that I started when I had Slayer root by my side.”
notipr: “He was talented”
notipr: “I had 14k in my page”
Telegram User A.: “What happened to him”
notipr: “He quitted”
notipr: “He was my hacker”
notipr: “I hacked all of their Snaps”
notipr: “I still come out in the news”
Telegram User A.: really? hahaha
notipr: “Look me up”
notipr: “we were xponiendoxpr”
notipr: “the baddess page in all PR”
notipr: “we expose them all”
notipr: “even with their ig”
notipr: “cb no one reaches that level”
notipr: “to come out in noticentro”
notipr: “I am not bragging but damn”
notipr: “but they were on me”
notipr: “I had to stop making myself pages for some time”

10
 Case 3:23-cr-00128-CVR Document 3-1 Filed 03/23/23 Page 11 of 21

notipr: “the minute I created a new page they would shut it down because of the snitches”
Telegram User M.D.: “The one that buys the content gets to do whatever he wants with
them, share them etc they already bought them sooo if they don’t want for that to happen
for people to share their content then don’t make onlys if they want to make money then let
the ones that pay enjoy”
notipr: “yea but I was different jajaj”
notipr: “I had a really talented dude one my side that was called slayer root and that wlb
[slang insult that loosely translates to cocksucker] would hack even snapchat”
notipr: “from all the exclusive”
notipr: “he would tell me “upload them with their profile””
notipr: “That’s why I went with the name Xponiendo PR”
notipr: “Thanks to that fucker jaja”
31. As previously indicated, the FBI’s investigation corroborated that Slay3r_r00t

would target the victims’ social media accounts, such as Snapchat, with the intention of gaining

access to the victim’s nude images and sexual videos. Slay3r_r00t would then share the victim’s

private content with NOTIPR.

32. Based on my training and experience, I know Snapchat is a company headquartered

in California whose servers6 are located outside of Puerto Rico. Therefore, the conspiracy to gain

unauthorized access to victims’ Snapchat account was in violation of 18 U.S. Code §

1030(a)(2)(C).

33. During the course of the investigation, the FBI learned that Brian Luis Valentin

Ramos’ conduct of publishing intimate picture without the owner’s consent caused substantial

emotional distress to these victims.

6
Snapchat servers are in several locations in the United States, including Seattle, Washington, and abroad in the
United Kingdom and Canada. They are accessible by users in Puerto Rico and worldwide. As such, Snapchat servers
are “protected computers” as defined in 18 U.S.C. § 1030(e)(2)(B) because they affect interstate and foreign
commerce and communication.

11
 Case 3:23-cr-00128-CVR Document 3-1 Filed 03/23/23 Page 12 of 21

34. At least seven (7) of Slay3r_r00t victims whose images were exposed by that Brian

Luis Valentin Ramos were interviewed by the FBI. All expressed how having their nude and

explicit images exposed in Twitter account NOTIPR, and several other iterations, significantly

impacted their self-esteem. Furthermore, having their images published via Tweets that also

included the victims’ social media profile and real name also impacted their life and relationships.

The interviewed victims described the effects as:

x “felt violated, vulnerable, exposed and afraid”

x “deeply ashamed which resulted in depression and anorexia”, and “was deeply affected
and ashamed which resulted in attempts to take my own life”.
POSSESSION, DISTRIBUTION AND SALE OF CHILD PORNOGRAPHY

35. After reviewing Twitter’s return and the Apple iCloud return, FBI San Juan

identified that Brian Luis Valentin Ramos knowingly and willingly, possessed, and distributed

Child Sexual Abuse Material (CSAM) in violation of Title 18 United States Code, Section 2252A.

As part of the scheme, prior to distributing the nude and explicit photos and videos, Brian Luis

Valentin Ramos would request for consumers to provide proof of payment by sending him a

screenshot of the payment.

36. FBI San Juan interviewed Minor Victim 1. She indicated that,

37. Sometime in July 2020, Minor Victim 1 had learned that her nude private images

were posted on Twitter account XponiendoPR. After learning her images had been exposed, she

visited Twitter account XponiendoPR using her personal Twitter account, where she was able to

confirm that two (2) of her explicit images were posted in a Tweet. The images, taken by her when

she was 17 years old, were of herself fully naked. The explicit images of Minor Victim 1 were

kept in her password protected “My Eyes Only” folder in her Snapchat account and they were not

public. Minor Victim 1 knew about XponiendoPR, its multiple iterations like NOTIPR, and the

12
 Case 3:23-cr-00128-CVR Document 3-1 Filed 03/23/23 Page 13 of 21

accounts’ malicious activity prior to her images being posted. Minor Victim 1 sent a direct message

to Twitter account XponiendoPR pleading for the images to be taken down and advising that the

images were of her as a minor. Brian Luis Valentin Ramos, using Twitter account XponiendoPR,

replied indicating the images would be taken down because she had asked nicely.

38. The FBI identified that on July 22, 2020, Brian Luis Valentin Ramos, using

Twitter account XponiendoPR, posted a public Tweet announcing he had taken Minor Victim 1’s

nude images down because she had asked nicely. The following is a translation of the message

posted publicly by Brian Luis Valentin Ramos, using Twitter account XponiendoPR, which was

in Spanish:

“I regret to inform you all that I deleted [Writes Minor Victim 1’s first name] photos, she

wrote to me via DM and asked nicely for her content to be deleted so I deleted it…”

39. However, on August 26, 2020, Brian Luis Valentin Ramos, using Twitter account

XponiendoPR, posted a public Tweet where he advertises having content for sale, to include Minor

Victim 1’s content. The Tweet included a screenshot of four female social media profiles,

including Minor Victim 1’s. The following is a translation of the message posted publicly by

Brian Luis Valentin Ramos which was in Spanish:

ᐧ The rest will be published in the page as we

"The only 4 contents that will be soldᐥ
ᐦ
๡\n\n [writes the four victims’ real names to include Minor Victim 1’s first
normally do๞
๠
๟
name]‫“پ‬
40. On August 29, 2020, Brian Luis Valentin Ramos, using Twitter account

XponiendoPR, posted another public Tweet where he once again advertises having content for

sale, to include Minor Victim 1’s content. The Tweet included four pictures of females in bathing

suits to include Minor Victim 1. The following is a summary translation of the message posted

publicly by Brian Luis Valentin Ramos which was in Spanish:

13
 Case 3:23-cr-00128-CVR Document 3-1 Filed 03/23/23 Page 14 of 21

“For those that keep asking yes we have [writes the four victims’ real names to include
Minor Victim 1 first name] content in sale… yes it is still available๞
๡޿
๠
๟ ߄”
߃
߂
߁
߀
41. On September 3, 2020, Brian Luis Valentin Ramos, using Twitter account

XponiendoPR, posted another public Tweet where XponiendoPR again advertises having content

for sale, to include Minor Victim 1’s content. The Tweet included four pictures of females in

bathing suits to include Minor Victim 1’s. The following is a summary translation of the message

posted publicly by Brian Luis Valentin Ramos which was in Spanish:

๡ [writes the four victims’ real

"The 4 content we have sold and left our customers happy ๞
๠
๟
߄ DM for info on the content ͢
names to include Minor Victim 1 first name] ޿
߃
߂
߁
߀ ͥ”
ͤ
ͣ
42. Minor Victim 1 is among numerous female victims whose name and sexually

explicit images and/or videos, obtained by furthering the credential harvesting and computer

intrusion scheme, were publicly distributed multiple times without their consent by Brian Luis

Valentin Ramos.

43. On August 2020, as part of an ongoing conversation, Brian Luis Valentin Ramos,

using Twitter account XponiendoPR, sold and distributed five (5) nude images of Minor Victim 1

for forty US dollars ($40.00) to Twitter ID ending in 277440. Brian Luis Valentin Ramos

provided email account lanotipr@gmail.com for payment via Paypal. Twitter ID ending in 277440

sent Brian Luis Valentin Ramos a screenshot as proof of payment which displayed the following:

You sent $40.00 to Brian Valentin

“The 5 nudes from [writes the first name of Minor Victim 1]”
44. After receiving the screenshot as proof of payment, Brian Luis Valentin Ramos

proceeded to send Twitter ID ending in 277440 five (5) nude and/or explicit images of Minor

Victim 1.

45. Subsequently, Brian Luis Valentin Ramos sent the five (5) nude and/or explicit

images of Minor Victim 1 to Twitter ID ending in 277440 who acknowledged receipt.

14
 Case 3:23-cr-00128-CVR Document 3-1 Filed 03/23/23 Page 15 of 21

46. Based on my training and experience, and after having interviewed Minor Victim

1, your affiant submits that the images depict Minor Victim 1as a minor, in some cases in sexually

explicit postures, and therefore constitute child pornography pursuant to Title 18, United States

Code, Section 2256. These images are described as follows:

Media 1:

Created At: 2020-08-28T04:01:14.227Z

Title: 1299195308560322564-YyHAmFk3

Description: This color image depicts a nude minor female. The female is capturing a
picture of a reflection of herself in a mirror with a smartphone held in her hand. The female’s
face is visible, and she is wearing a necklace and blue colored underwear but not wearing a
bra, therefore her breasts and nipples are visible.

Media 2:
Created At: 2020-08-28T04:01:20.504Z

Title: 1299195334808285188-O-cJ2dEC

Description: This color image depicts a minor female. The female is capturing a picture of a
reflection of herself in a mirror. The female is wearing pink colored underwear and a black
colored bra.

Media 3:

Created At: 2020-08-28T04:01:32.134Z

Title: 1299195383478972421-JTkizK3A

Description: This color image depicts a nude minor female. The image captures a fully
naked frontal picture of a female while sitting on what appears to be a bed. The bed
comforter is dark blue colored with what appears to be pink flowers. The female is wearing a
necklace and her face is fully visible, her breasts and nipples are visible, and her legs are
spread apart making her vagina visible.

Media 4:

Created At: 2020-08-28T04:02:22.661Z

Description: This color image depicts a nude minor female. The image captures a fully
naked female’s body from behind. The image captures the female’s buttocks while standing.

15
 Case 3:23-cr-00128-CVR Document 3-1 Filed 03/23/23 Page 16 of 21

Media 5:

Created At: 2020-08-28T04:02:32.009Z

Description: This color image depicts a nude minor female. The image captures the fully
naked body of the female from behind while kneeling on what appears to be a bed. The bed
comforter is dark blue colored with what appears to be pink flowers on one side and white
outlined stars on the other. The female’s buttocks are visible, and her legs are spread apart
making her vagina and anus visible.

47. The aforementioned images of Minor Victim 1 were sold and distributed by Brian

Luis Valentin Ramos over ten times using Twitter account XponiendoPR.

48. On June 17, 2021, FBI San Juan obtained Paypal account information related to

email lanotipr@gmail.com. Paypal identified active account xxxxxxxxx65494, created on June 12,

2020, owner Brian Valentin, and associated with email lanotipr@gmail.com. Paypal provided the

following account information:

x Account Type: Personal - Verified

x Phone Numbers: 787-XXX-9435
x Phone Numbers: 939-XXX-4958
x Addresses: Brian Valentin, [REDACTED], Cabo Rojo, Puerto Rico, PR 00623
49. Paypal’s response also included the account's transactions and activities log. The

following transaction stood out as it included the following note in Spanish “The 5 nudes from

[Writes Minor Victim 1 first name]”.

Date Type Transaction ID Balance Note

Los 5 nudes de [Minor Victim
8/27/2020 Mobile Payment Received 75X8029589918092P $40.00 USD 1’s first name]

1/20/2021 Mobile Payment Received 3HP46965LC925563C $20.00 USD - - Tegram

1/21/2021 Mobile Payment Received 2GS79692XN549232N $20.00 USD telegram VIP
5/28/2021 Mobile Payment Received 2CV134513L352074T $20.00 USD Subscripción

16
 Case 3:23-cr-00128-CVR Document 3-1 Filed 03/23/23 Page 17 of 21

50. During the course of the investigation, FBI San Juan identified that Brian Luis

Valentin Ramos, knowingly and willingly, possessed, distributed, and sold nude and explicit

images and videos of Minor Victim 2, as further described below:

51. On January 19, 2023, FBI San Juan interviewed Minor Victim 2’s mother and

stepfather who confirmed Minor Victim 2 was born in July 2005 and is still considered a minor at

age seventeen.

52. FBI San Juan conducted record checks for Minor Victim 2 identified Florida

identification card C452-XXX-05-XXX-0, Social Security number XXX-XX-5296, Female, with

date of birth July XX, 2005, confirming Minor Victim 2 is 17 years old as of March 2023.

53. On July 22, 2020, as part of an ongoing conversation, Brian Luis Valentin Ramos,

using Twitter account XponiendoPR, distributed a nude image of Minor Victim 2 to Twitter ID

ending in 226753. The following is a translation of parts of the conversation, which was in Spanish:

XponiendoPR: [sent image 1286029202127499270-VStCsgQt]

XponiendoPR: “that is [writes Minor Victim 2’s nickname]”
54. Your affiant reviewed the image distributed by Brian Luis Valentin Ramos. Based

on my training and experience, the images depict Minor Victim 2 nude as a minor. Minor Victim

2 was born in July 2005 and the image was shared on July 22, 2020. Therefore, Minor Victim 2

was 15 years old at the time. The image depicts victim Minor Victim 2 in a sexually explicit

posture, and therefore constitutes child pornography pursuant to Title 18, United States Code,

Section 2256. This image is described as follows:

Created At: 2020-07-22T20:03:49.885Z

Title: 1286029202127499270-VStCsgQt

Description: This color image depicts a nude minor female. The image captures a fully
naked frontal picture of a female while seated wearing a necklace. The female’s face is fully

17
 Case 3:23-cr-00128-CVR Document 3-1 Filed 03/23/23 Page 18 of 21

visible, her breasts and nipples are visible, and her legs are spread apart, and her vagina is
visible.

55. On July 25, 2020, as part of an ongoing conversation, Brian Luis Valentin Ramos,

using Twitter account XponiendoPR, exchanged messages with Twitter ID ending in 474051

where they discuss Minor Victim 2 being a minor. The following is a summary translation of

snippets of the conversation, which was in Spanish:

Twitter ID ending in 474051: “hey brother [writes another victim’s nickname] is a minor,
she is 16 years old, and I know her”
ᦗ[eye roll emoji]
XponiendoPR: ᦔ
ᦖ
ᦕ
XponiendoPR: “[Minor Victim 2’s nickname] is 15 years old that is worse.”
56. On July 25, 2020, as part of an ongoing conversation, Brian Luis Valentin Ramos,

using Twitter account XponiendoPR, exchanged messages with Twitter ID ending in 800962

where they discuss Minor Victim 2’s being a minor. The following is a summary translation of

parts of the conversation, which was in Spanish:

Twitter ID ending in 800962: “I have [Minor Victim 2’s nickname] content”

Twitter ID 1287090629621800962: “and even one of her snapchat”
XponiendoPR: “Send them without fear”
XponiendoPR: ๞
๡
๠
๟
XponiendoPR: “If you send them I can send a reward”
Twitter ID ending in 800962: “here they go brother”
XponiendoPR: “that fucker is 15 years old”
XponiendoPR: “and she has already taken dick”
57. On July 25, 2020, Brian Luis Valentin Ramos, using Twitter account

XponiendoPR, publicly distributed an image of Minor Victim 2 where he included the victim’s

nickname as part of the Tweet.

58. Subsequently, your affiant reviewed the image posted by Brian Luis Valentin

Ramos. Based on my training and experience, the images depict Minor Victim 2 nude as a minor.

18
 Case 3:23-cr-00128-CVR Document 3-1 Filed 03/23/23 Page 19 of 21

Minor Victim 2 was born in July 2005 and the image was published on July 25, 2020. Therefore,

Minor Victim 2 was 15 years old at the time. The image depicts Minor Victim 2 in a sexually

explicit posture, and therefore constitutes child pornography pursuant to Title 18, United States

Code, Section 2256. This image is described as follows:

Image ID: 1286892701514977281

Created At: Sat Jul 25 05:15:04 +0000 2020

Description: This color image depicts a nude minor female. The minor female takes a
picture of her exposed vagina and anus while bending over and looking at the camera. The
female’s face is fully visible, her right nipple is visible, her legs are spread apart, her anus is
visible, her vagina is visible, and her left hand is spreading her labia apart. The image contains a
colored soap bottle. The minor has tattoos on both hips.

59. On January 21, 2021, Brian Luis Valentin Ramos, using Twitter account notixpr,

publicly distributed, via a Tweet, a video of Minor Victim 2 where he included the victim’s

nickname as part of the Tweet.

60. Subsequently, your affiant reviewed the image posted by Brian Luis Valentin

Ramos. Based on my training and experience, the images depict Minor Victim 2 nude as a minor,

as Minor Victim 2 was born in July 2005 and the image was published on January 21, 2021,

therefore Minor Victim 2 was 16 years old at the time. The image depicts Minor Victim 2 in a

sexually explicit posture, and therefore constitutes child pornography pursuant to Title 18, United

States Code, Section 2256. This image is described as follows:

Tweet ID: 1352278594492506112

Created At: Jan 21 15:35:15 +0000 2021

Description: This color video file depicts a teenaged nude female. It appears to be a self-
recorded video capturing the front side of the female while seated fully naked with her legs
spread exposing her vagina. The female is wearing a gold-colored necklace with a gold-colored
cross, and her face, breasts, nipples and vagina are visible. The female proceeds to spit on her
vagina and starts rubbing her clitoris for approximately 20 seconds. The female then proceeds to
pick up a pink and white colored sex toy, rubs the sex toy against her clitoris and then places the

19
 Case 3:23-cr-00128-CVR Document 3-1 Filed 03/23/23 Page 20 of 21

sex toy in her mouth. The female then rubs the sex toy against her clitoris and then introduces the
sex toy into her vagina and starts masturbating.

61. During the investigation, the FBI found Brian Luis Valentin Ramos published and

distributed the aforementioned video and images of Minor Victim 2 over twenty (20) times via his

Twitter and Reddit accounts.

62. All the images mentioned herein were mailed, or shipped, or transported using a

means or facility of interstate or foreign commerce and/or affecting interstate or foreign commerce,

by electronic means such as by a computer.

(INTENTIONALLY BLANK)

20
 Case 3:23-cr-00128-CVR Document 3-1 Filed 03/23/23 Page 21 of 21

CONCLUSION

63. Based on the facts as set forth in this affidavit, your affiant believes that since at

least May 2020, and at least until on or about March 8, 2023, Brian Luis Valentin has been

conspiring with others, to include Slay3r_r00t, to gain authorized access victims’ nude and

sexually explicit content. Brian Luis Valentin has also knowingly and willingly possessed and

distributed Child Sexual Abuse Material (CSAM).

64. Based on the forgoing, there is probable cause to believe Brian Luis Valentin

Ramos has committed violations of Title 18, United States Code, Sections 1030(a)(2)(C) and

1030(b), (Conspiracy to commit fraud and related activity in connection with computers), Section

2252A(a)(4)(B) (Possession of Child Pornography), Section 2252A(a)(2)(B) (Distribution of

Child Pornography), and Section 2252A(a)(3)(B) (Sale of Child Pornography).

I declare under penalty of perjury that the foregoing is true and correct to the best of my

knowledge this 23 of March of 2023.

Christian Nieves
Special Agent
Federal Bureau of Investigation

Sworn and subscribed to before me pursuant to FRCP 4.1 at ________ by telephone this ___ day
of March 2023 in San Juan, Puerto Rico

___________________________________
Marshal Morgan
United States Magistrate Judge
District of Puerto Rico

21