In October 2018 a federal judge in Lexington, Kentucky sentenced Colton Grubbs, then 21, to 30 months in prison for computer intrusion crimes built on the LuminosityLink remote access tool. Brian Krebs, who reported that Grubbs sold it on a hacking forum under the handle "KFC Watermelon", printed two email addresses in his coverage of the guilty plea. Run through an email lookup and then a username search, they land on a GitHub account whose display name is Colton Grubbs and on a handle trail that starts in 2012.
Prosecutors and reporters did the unmasking in 2018. What follows is a demonstration of how far two public identifiers travel, and where they stop.
The record: a plea, a sentence and two email addresses
Two documents carry this case. Brian Krebs published the plea on July 16, 2018, with the full name, the hometown of Stanford, Kentucky, the HackForums alias and two email addresses. The first, [email protected], appears twice there. Krebs reports that the street address on the state filing for Grubbs' company turns up in the original registration records of dozens of domains, at least half a dozen of which listed that Gmail address early on, and that the Gmail address also appears in the early records of a separate domain identified as far back as 2012 as a command and control server used on the forum. The second, [email protected], came from a February 2018 Palo Alto Networks write-up that Krebs cites. That report tied the Skype account behind the KFC Watermelon persona to the mailbox, and said the mailbox had registered the site for an earlier tool called Plasma RAT in 2013. Krebs also notes, citing Europol, that sales began in May 2015 and passed 8,600 customers by mid-2017.
The second document is the sentencing press release from the U.S. Attorney's Office for the Eastern District of Kentucky, dated October 15, 2018. Judge Joseph M. Hood sentenced Grubbs on three counts: conspiracy to unlawfully access computers, conspiracy to commit money laundering, and removing property to prevent its seizure. The plea agreement put the price at $39.99 and the customer count at more than 6,000. That figure is lower than Europol's because it is what the defendant admitted, not an investigator's estimate. He forfeited 114 bitcoin, worth more than $725,000 at the time.
Everything below is presence and profile data layered on that record.
The email lookup: 15 platforms and one GitHub profile
We ran both addresses through a reverse email lookup, which checks about 175 platforms for a registered account and, on a few, returns the attached profile.
[email protected] is registered on 15 platforms. Most are plain presence flags with no profile behind them: a music streaming service, a design suite, an online course site, a newspaper, a blogging platform, a freelance marketplace and a domain registrar.
One platform returned a full profile. GitHub reports the address belongs to an account under a handle built from his first name and a number, display name "Colton Grubbs", created on August 11, 2016, with about 190 commits on record. The mailbox a journalist tied to the case resolves to a public developer profile carrying the same legal name, and it gives us a handle to search.
[email protected] is registered on 2 platforms: one live consumer Microsoft account, seen through two checks. Nothing else in the lookup knew the address, which fits a mailbox that was in use by 2013 to register the site for an earlier tool.
| Identifier | Type | Checked | Registered | What mattered |
|---|---|---|---|---|
| [email protected] | about 175 platforms | 15 | GitHub profile, display name "Colton Grubbs", and a handle to search | |
| [email protected] | about 175 platforms | 2 | live Microsoft consumer account, nothing else | |
| the handle from that profile | username | about 760 platforms | 38 | GitHub, YouTube (2014), Instagram (2013), Twitch (2013), Scratch (2015) |
| kfcwatermelon | username | about 760 platforms | 59 | mostly unrelated users of the phrase; a 2015 pair on two coding and typing sites |
The username search: the handle, then the alias
A username search on that handle returned 38 live profiles out of about 760 platforms. The GitHub hit is the anchor, and it carries the same display name the email lookup returned.
Around it sits a trail of accounts under the same handle, with the first name Colton or no name: an Instagram account joined in April 2013 with a United States location, a Twitch account from December 2013, a YouTube channel from July 2014, a Scratch account from April 2015, a code wiki account from March 2016, and a typing game account from April 2018. Three code and asset marketplace profiles share a single registration date in August 2012. A freelance marketplace profile from June 2013 matches the freelance flag from the email lookup.
The same 38 hits include people who are plainly not our subject. The X account under the same handle was created in August 2009 by someone with a different surname. A payment app, a nature logging site, a travel planner and a recipe pinning site each return the handle with a different first-and-last name attached. Colton is a common first name and the number attached to it is short, so collisions were inevitable. A handle on a platform is never proof of who holds it. The developer cluster earns a mention because an email match anchors it; the X account does not, because its display name disagrees.
We also ran the alias itself. kfcwatermelon returned 59 profiles. Almost every display name is some spelling of "KFC Watermelon", but the bios disagree: Spanish from Argentina, Indonesian, Norwegian, a design portfolio in Singapore. The phrase is a joke, and jokes get registered by a lot of people.
Two hits stand out against that noise: a typing game account created in January 2015 and a Scratch account created in May 2015. Those are the same two platforms the developer handle sits on, in the year the record says LuminosityLink went on sale. That is a pattern in the dates, two handles the public record already associates turning up on the same two small sites in the same year. Nothing in either profile ties the accounts to one another or to a person, so it goes in the notes as a pattern worth recording, never as an ownership finding.
The chain
Read left to right: a published email address, to a GitHub profile that returns a legal name and a handle, to a username search that places that handle on a dozen consumer platforms with creation dates from 2012 to 2018. The second email address is a stub that confirms a live mailbox and nothing more. The alias branch stays separate, because nothing in our results links a kfcwatermelon account to an account in the developer cluster by name, link or picture. That link exists only in the public record.
Inside the investigation view the chain builds itself. Run the email, open the GitHub result, and launch the handle as a cross search from there. Each pivot stacks under the last, so the export preserves the path from mailbox to handle to profiles. A reviewer who sees that handle on a list of 38 profiles has a question; one who sees it came out of an email lookup on an address Krebs printed has an answer.
What the dates say
Creation dates cannot be edited after the fact, which makes them the most useful field in an export. The accounts in that cluster begin in 2012 and 2013 on marketplaces, a freelance site, Instagram and Twitch, a few years before anything in the record, which is consistent with a teenager building an online presence. The YouTube channel arrives in 2014, Scratch in April 2015, and GitHub in August 2016, more than a year into the period when the tool was on sale. The kfcwatermelon typing and Scratch accounts sit in January and May 2015, bracketing the launch Krebs reports.
Then the trail thins. On July 10, 2017, per the plea agreement Krebs quotes, Grubbs learned the FBI was about to search his apartment. Only one account in the cluster we are reporting was created after that, the typing game profile in April 2018, and because it post-dates the search it carries a squatter or impersonator hedge. Everything on the kfcwatermelon handle dated after mid-2018 (a video channel in 2024, a streaming channel in 2025, several gaming and forum accounts in between) we treat as other people who liked the phrase, or squatters who read the coverage. A post-arrest registration under a famous alias is far more likely an imitator than the person.
One account under the same handle, created in 2025, exists in the export. We are not printing it, and it carries the same squatter or impersonator hedge as everything else registered after the case: the sentence ran its course years ago, and this post is about how a 2018 record looks in public data.
What it teaches
The legal name came from a court and from a reporter who read the filings. The lookup confirmed that the mailbox in the record resolves to a developer profile carrying that name. A journalist's identifier can be stale or mistyped; here it was neither.
Persona mailboxes look different from personal ones. The Gmail address is registered on 15 platforms and one names its owner. The Live address is registered on 2 and neither says anything. Alone, the second address gives a true answer and a thin one.
Coined aliases attract company. "KFC Watermelon" made headlines because it is memorable, and dozens of unrelated people have registered it since. The only hits worth a second look are the ones whose dates and platforms line up with the rest of the trail, and even those stay hedged.
The last lesson is the one Krebs draws himself: the public filings did most of the work. A state company registration, a domain record, a Skype profile examined by a security vendor. The journalists who read that record carefully deserve most of the credit for a case study like this.
How to run this yourself
Take an identifier already published in a court document, a sanctions listing or a serious news report. Run the email first; email results are anchored to a mailbox and are the hardest to squat. Cross search any handle it returns from the result, so the pivot is recorded. Sort the username hits by display name and creation date, keep the ones that agree with the anchor, and note the ones that disagree. Export the investigation when it is done. Plans and what each includes are on the pricing page.
Limits
The searches described here read public profile pages and registration flags. They sign in to nothing and contact no one. Every identity claim traces to Krebs' July 2018 article or the October 2018 sentencing release. Colton Grubbs was sentenced in October 2018 to a 30 month term that ended years ago, which is why we chose the case. Accounts created after 2018, on either handle, were left out, and nothing here comments on anyone's activity since.
