Who is “Machiaveli,” the dark-web vendor that sold “Medallin cartel” cocaine by mail?
Federal investigators say it is Salim Ghulam Nabi, 24, of Spokane, Washington. Online, Nabi sold himself as something else. His LinkedIn profile calls him an “Instagram Agent and E-commerce Business Owner.” Postal Inspector P. Justin Alder of the U.S. Postal Inspection Service, who wrote and signed the affidavit filed September 24, 2026, states that Nabi “is believed to be operating as a dark web controlled substance vendor based in Spokane” under the names NiccoloMachiaveli, Machiaveli Limited and Machiaveli Ltd. In May, an undercover buyer ordered “Medallin cartel Era Ether Washed Cocaine” from the vendor’s private store and paid in Monero. The parcel held about 11 grams of white powder that field-tested positive for cocaine.
Nabi was arrested on September 23 and charged by criminal complaint the next day with distribution of cocaine and use of a communication facility in a drug felony. On October 7, a federal grand jury returned a two-count indictment, according to the court docket. The indictment itself is not public.
According to Alder’s affidavit, the vendor marketed its cocaine under the Medellín cartel’s name: the listing the undercover buyer ordered from was titled “Medallin cartel Era Ether Washed Cocaine.” The affidavit does not say where the cocaine was sourced. What it lays out in detail is one email address, four postal accounts, eight darknet markets and a parcel traced to an apartment building in Spokane.
The E-Commerce Agent
Before the court record, there was the sales pitch. Nabi’s LinkedIn profile, set in the Spokane–Coeur d’Alene area, lists two jobs, both starting in December 2019: “Ecommerce Specialist” at Shopify and self-employed “Instagram Agent.” It lists a bachelor’s degree in architecture from Eastern Washington University. It has 34 connections.
“I have just started getting into the role of being an e-commerce business owner,” the About section reads. It promises help with Instagram advertising for small businesses and closes: “I have worked with many people who simply needed more clients and I got the job done.”
His older X account, @salimghulam1, under the name “Salim,” shows 43 posts. The newest, from November 1, 2020, advertises “Ray-Ban” sunglasses for $24.99 on a site that is not Ray-Ban’s. Posts from 2017 promote a Snapchat add-on that unlocks features “for FREE!” and a YouTube scheme: “Want hundreds of new YouTube subsribers [sic] today?” Posts from 2014 are replies about boxing and video games.
None of this is evidence of drug dealing, and neither account appears in the court record. It shows who Nabi said he was: a young man selling reach, followers and online storefronts. Federal investigators say that by November 2022 he was running a different kind of online store.
The Listing
The buy took place on May 14, 2026. Alder wrote that law enforcement “made an undercover purchase of ‘Medallin cartel Era Ether Washed Cocaine’ sold by ‘Machiavelilimited’ with Monero cryptocurrency on the MachiaveliLimited dark web private store.”
The listing invokes Pablo Escobar’s Medellín cartel, which the filing spells “Medallin.” The affidavit quotes the product name but does not trace the drugs to Colombia or describe the vendor’s suppliers. Monero, the payment method, is a privacy coin built to hide senders, receivers and amounts. The affidavit gives no wallet address.
Six days later, on May 20, investigators opened the parcel. It was a USPS Priority Mail parcel with a label dated May 15 and a return address of “A&D INC.” on North Jefferson Lane in Spokane. Inside was “a white powdery substance” that a TruNarc narcotics analyzer flagged as a “presumptive positive for cocaine.” The filing does not say whether A&D Inc. exists.
One Email, Four Postal Accounts
The trail started in Houston. Alder, a Postal Inspection Service agent since 2020, wrote that early in 2026 he learned of a Homeland Security Investigations case in Houston into a vendor known as NiccoloMachiaveli, Machiaveli Limited and Machiaveli Ltd. Those accounts, he wrote, were associated with an iCloud email address in Nabi’s name.
That address unlocked the rest. A search of USPS business records turned up four Postal Service accounts registered to Nabi, each carrying the same iCloud address and the same 509 area-code phone number. The accounts list four apartments, two in Spokane and two in Spokane Valley.
Alder later identifies two of them as Nabi’s homes. An apartment on East Magnesium Road in Spokane is “believed to be the primary residence of NABI.” He holds a two-year lease there, from August 2025 to August 2027, and USPS records show he gets mail at that address.
Eight Markets, Thousands of Orders
Alder reviewed posts on Drughub, Dark Matter, the Dread forum and the MachiaveliLimited store itself. Those posts, he wrote, showed that Machiaveli “has been selling cocaine on the dark web since approximately November 2022” on eight markets: Abacus, Archetype, Bohemia, Dark Matter, Drug Hub, Incognito, M00nkey Market and SuperMarket. The vendor “has thousands of orders.”
The posts also laid out USPS shipping options and packaging that matched what investigators had seen in the mail stream. “Machiaveli is responsible for thousands of mailings from approximately 2024 through the present,” Alder wrote.
One Dread post went further. It “encourages customers to buy directly from him (as opposed to via a third-party marketplace)” by writing to machiavelilimited@protonmail.com. Going direct cuts out the market’s commission and its escrow. It also left a trail. “This email address is also registered to NABI,” Alder wrote. A footnote gives the source: “Per Apple, Inc. records obtained via Grand Jury Subpoena.”
The Parcel and the Apartment
On May 19, the test parcel was scanned as “Accept or Pickup” at or near Unit 302 of the same North Jefferson Lane building printed on its return label. Investigators call that unit the Jefferson Address.
Alder ties the unit to Nabi three ways. Washington Trust Bank records show an account associated with him making monthly rent payments to “Jefferson Alley.” Avista, the regional utility, has served him at the address since December 2025. Agents have watched him travel there “on multiple occasions.” The filing calls it “one of the residences associated to NABI.”
The postage tells a second story. It was bought through Shippo, an online label service, on an account registered under a different name and a Proton Mail address. The affidavit does not say whether that name belongs to a real person. Shippo records show the account “has created postage for numerous parcels.”
The link back to Nabi is an IP address. On May 11, Alder wrote, the same IP address used to log in to the Shippo account tracked a USPS parcel sent from California to Nabi at the Magnesium Road apartment.
From Complaint to Indictment
The criminal complaint, sworn by Alder, charges Nabi with two crimes on or about May 20, 2026: distribution of cocaine under 21 U.S.C. § 841(a) and (b)(1)(C), and use of a communication facility in a drug felony under 21 U.S.C. § 843(b). The first carries up to 20 years in prison; the second, up to four years.
The paperwork is not perfectly consistent. The affidavit’s opening paragraph cites a different theory, “Attempted Possession with Intent to Distribute Cocaine” under § 846. Its conclusion and the complaint both cite distribution. Paragraph 6 also misspells the iCloud address it searched, and paragraph 14 drops a digit from the Shippo account number.
Alder swore to the complaint by telephone on September 24, and Magistrate Judge James A. Goeke signed it electronically. The magistrate docket shows Nabi was arrested the day before, appeared in court on September 24 and was assigned the Federal Defenders of Eastern Washington. The government moved to detain him.
On October 7, the grand jury returned an indictment on “counts 1 and 2,” with a forfeiture notice. The docket lists an arraignment on October 8, a detention hearing on October 13 and a scheduling order on October 16. The case, United States v. Nabi, No. 2:26-cr-00130, is assigned to Judge Rebecca L. Pennell. The indictment’s text is not on CourtListener, so its exact charges are not public.
Nabi is 24, The Spokesman-Review reported. He declined the paper’s request for a jail interview.
What the Open Record Adds
OctoProbe started from a handful of identifiers: Nabi’s name, three email addresses, the phone number listed in the affidavit, and his LinkedIn and X handles. From those seeds, its searches built a graph of 104 identifiers and 175 links in under ten minutes of run time.
One public handle still answers, and it appears to be the vendor’s own. A Telegram account at t.me/machiavelilimited, display name “MachiaveliLimited,” resolved on October 21, 2026. It carries the same name as the MachiaveliLimited dark-web store described in Alder’s affidavit, and the OctoProbe investigation attributes the handle to Nabi. The affidavit itself does not mention Telegram.
How This Story Was Reported
This report is built on two public court records: the six-page affidavit of Postal Inspector P. Justin Alder and the one-page criminal complaint, both filed September 24, 2026, and retrieved from CourtListener’s RECAP archive. Docket events come from CourtListener’s pages for the magistrate case and the criminal case. The OctoProbe investigation seeded the filing’s identifiers and ran four expansion rounds; no new rounds were run for this report. Residential street numbers, the phone number and USPS account numbers are omitted.
Frequently Asked Questions
Who is Machiaveli Limited?
It is a darknet cocaine vendor persona, also called NiccoloMachiaveli and Machiaveli Ltd. In a federal affidavit, Postal Inspector P. Justin Alder says investigators believe Salim Ghulam Nabi of Spokane ran it and sold on eight markets from about November 2022.
What is Salim Ghulam Nabi charged with?
A September 24, 2026, criminal complaint charges him with distribution of cocaine and use of a communication facility in a drug felony. A grand jury returned a two-count indictment on October 7; its text is not public.
Is the cocaine tied to the Medellín cartel?
Per Postal Inspector Alder’s affidavit, the vendor sold it as “Medallin cartel Era Ether Washed Cocaine,” the name on the listing the undercover buyer ordered from. The affidavit does not say where the cocaine came from or describe any other connection to the cartel.
How did Nabi present himself online?
His LinkedIn profile calls him an “Instagram Agent and E-commerce Business Owner” and lists Shopify and Eastern Washington University. An older X account under his handle posted discount sunglasses ads and subscriber schemes. Neither account appears in the court record.
How did investigators connect the persona to Nabi?
Through email. The persona’s accounts traced to an iCloud address on four USPS accounts in Nabi’s name, and Apple records tied the vendor’s Proton Mail address to him. A test parcel was scanned near an apartment he allegedly rents.
