Dozens of people turn to the darknet in order to order the liquidation of an unwanted person. And inevitably become victims of fraudsters.

Chris Monteiro in his apartment in London. Photo Wired
Chris Monteiro in his apartment in London. Photo Wired

One of the main myths of the darknet is that there are real sites for the hire of killers. Supposedly, for a conditional five thousand dollars transferred in a cryptocurrency, you can order a hired killer who not only unmistakably copes with the task, but also disguises it as an accident.

Chris Monteiro, a British cyber-specialist, has spent several years debunking this myth. Once this tragedy led to the fact that he destroyed a network of fraudulent sites about hired assassins, almost became a defendant in a criminal case due to an error of the special services and helped uncover the real murder, whose roots were drawn from the darknet. The story of Monteiro told the publication Wired.

The start of the investigation and the first threats

In 2016, a system administrator at a London-based company named Chris Monteiro returned home from work every day and did his own little internet research. He was just over 30, he was fascinated by the topic of cybercrime and was most of all interested in the darknet. In his understanding, this was an ideal place for fraudsters who were hiding behind anonymity and pretentious “mystery”.

In his spare time, the Briton wrote articles for the RacioViki project, which aims to criticize pseudoscience and analyze how controversial topics are presented by the media. Along the way, he started the blog pirate.london , where he debunked the darknet myths: they also meant the legend that there you can hire a killer by paying for your order with bitcoins. Since the appearance of this rumor, the “other side of the Internet” has been replete with sites where users anonymously offered money for killing enemies, and sometimes massively threw themselves on the order of a Hollywood star or politician. However, Monteiro believes that all such sites are either joking or fraudulent.

The home page of the Besa Mafia website from which the Monteiro investigation began
The home page of the Besa Mafia website from which the Monteiro investigation began

For almost three years of studying the topic, the man did not find any evidence that at least one person was killed by the killer’s online order, or that the hired killers were working on the darknet. Monteiro painted his findings on blogs and on RazioViki , supporting it with evidence, until one day, on February 20, 2016, someone edited his article. The new version did not differ much from the previous one, not counting the postscript: “All sites for the hire of killers are fraudulent, with the exception of Besa Mafia”.

Frustrated, Monteiro explored the darknet site and became convinced that it was the brainchild of fraudsters. In broken English, the authors posed themselves as some Albanian mafia (in Albanian, “besa” means “honor”) and accepted payment by bitcoins, but the Briton quickly found holes in the security of the site. All this he told in his blog, making fun of alleged fraudsters.

A few days later, an unknown person contacted Monteiro via e-mail: he introduced himself as the administrator of Besa Mafia named Yura and asked how much the British wanted money for an “honest review” of his site.

“We are open to suggestions and will do everything possible to create the best store for personal injury services and the destruction of private property,” wrote Yura.

To demonstrate their capabilities, the unknown offered Monteiro to choose a victim that the people of Besa Mafia would beat. In addition, he promised to pay a $ 50 cyberspecialist monthly for placing the site’s banners on his blog. When the Briton refused, Yura began to threaten and announced that he would hire people to distribute articles on the Internet that would “unmask” Monteiro.

The specialist published a correspondence with a stranger on his blog, and a few days later someone left a comment there with a link to the video. At the beginning of the recording, the operator removed a sheet of paper with the appeal: “The members of the Besa Mafia gang in the darknet”, and then doused the car with gasoline and arson, holding the piece against the background of the flame.

Burn arson machine

Monteiro took the video as a threat. He contacted the London police, spoke about his activities and provided evidence of correspondence with the unknown and a video file. A few weeks after submitting the application, he was transferred to the cyber security department, but nothing came of it. The investigator simply told Monteiro that the car was not burned in the UK, so they can’t do anything.

Scheme of scam

Not finding help from law enforcement, Monteiro continued to explore Besa Mafia on his own. He registered a user account and found that each message on the platform has its own unique ID number, and if you add it to the site address, you can access the correspondence of all users.

Thanks to this, Monteiro downloaded the entire message base of the site and examined the contents. Each user filled out a column where he talked about the “target” and clarified the method of killing — for example, an extra charge was required for simulating an accident. To prove solvency, the customer had to pre-transfer the advance in bitcoins to the specified wallet of Besa Mafia moderators. After that, Yura assured clients that the task was in the process, and then he came up with excuses: the killer was allegedly arrested for road violation or illegal possession of weapons.

In such cases, the scammer offered to hire a more experienced killer, but at an additional cost. Some people paid, and Yura again came up with excuses. He never returned an advance to clients, even though it was promised in the rules of Besa Mafia, but spent it on personal needs and website promotion. For example, he paid one of the users of the resource, who introduced himself as a US Navy veteran and was looking for a job as a hitman.

At the request of the Jura, this man recorded a video with threats to Monteiro, and after that he participated in fake videos allegedly demonstrating the real murder of the people ordered. Later, these records were intentionally spread across the darknet to convince users of the reliability of Besa Mafia.

After a few days of studying, a British specialist realized that, yes, Besa Mafia was created by scammers who have no access to killers, but the list of customers is real. Dozens of people who applied to the service really wanted someone to die, and sooner or later they could take up the task themselves.

This fraudulent scheme was different; it was fundamentally different from any other scheme I came across. People using it are much more dangerous than the scammers themselves. [Here] the bad guys are the customers.

Chris Monteiro
british cyber specialist

Victory over the site and premature triumph

According to Monteiro, among the users of Besa Mafia were those who perceived the site as a joke, but the majority took their orders seriously. Someone asked to kill his wife’s lover and sell his internal organs on the black market in order to get a discount for the contract, and take the woman to Saudi Arabia and put her into slavery. A Dutchman paid 20 bitcoins (at the rate of 2016, the exact amount is not specified) for giving the murder to be an accident during a bike ride, and a person from Minnesota discussed the details of the murder of the mother of one child with Jura for four months.

Monteiro turned to a friend for help in studying the site’s data, and together they made a list of the most dangerous customers, finding out the real identity and address of some. According to the British, all this time he urged law enforcement agencies to intervene, but this did not lead to visible success. The police sent him to the National Criminal Agency of Great Britain (NCA), they ignored his requests, and other special services refused to help, explaining that this was outside their jurisdiction.

In late spring 2016, Monteiro and his partner decided to act independently. At their request, the cyber specialist under the pseudonym bRspd successfully used the exploit for full access to Besa Mafia. He obtained data on logins, passwords and email addresses of all users, including administrators, and then merged into the network. Thanks to this data, by the summer Monteiro had seized control of the site and had hacked Jura’s email on Gmail.

Stub when trying to go to the website Besa Mafia
Stub when trying to go to the website Besa Mafia

“I just wanted to prevent the operation of this operation. But it was also personal revenge. I could talk about the highest good, but it was personal, ”explained his motives to Monteiro. After gaining control of the site, the partners unanimously decided that it was time to turn off Besa Mafia. Since then, the address of the resource translates into a new page, where the Besa Mafia logo is accompanied by a stub and a message: “After six months of fraud by intruders who stole more than 100 Bitcoins ($ 65,000), the site is closed. No one has ever been beaten or killed. ”

On the night of the shutdown, Besa Mafia Monteiro and his partner uncorked a bottle of champagne to celebrate their success.

Assistance in the investigation of murder and false accusations

In January 2017, Monteiro nevertheless achieved a meeting with representatives of the National Criminal Agency of Great Britain. For more than an hour, he explained the fraudulent scheme of Besa Mafia and similar projects on the darknet, adding that Yura had discovered a similar resource called The Crime Bay. It was built on the same basis as the previous one, so the Briton still had the opportunity to read the correspondence of users.

According to the specialist, the NCA employees promised to contact him later, and from the documents they asked only the one where the list of the most dangerous killer customers was cited. The first user was listed under the pseudonym Dogdaygod – in February 2016, he appealed to Yura to kill a certain woman in Minnesota. At first, he proposed to put everything as an accident, but over time his messages became more aggressive, including the offer to shoot a woman and burn her house.

The purpose of the unknown was Amy Allwine. Thanks to Besa Mafia’s data fusion, the FBI became interested in this woman’s story. Agents came home to a woman who lived with her husband Stephen, and reported that the unknown paid six thousand dollars in bitcoins for her death. Allwine were shocked, not knowing who could stand behind it.

Six months later, Amy passed away – her husband called the police and said that her husband had shot herself. However, the police found a connection between Stephen and Dogdaygod: there were traces of bitcoin translation, visits to Besa Mafia and attempts to buy a powerful alkaloid, scopolamine, on his computer. He was found in the blood of the victim.

In January 2017, police accused Steven Allwine of murdering his wife, pointing out the man’s connection to Besa Mafia. In February 2018, the American was convicted and sentenced to life imprisonment.

When Monteiro just found out about the arrest of the man, he was shocked. Only later did he realize that his operation helped uncover the real murder. He then wrote back to the NCA asking them to examine the remaining names on the list, and the agents promised to do this immediately. A few weeks later, in February 2017, the Briton quietly prepared dinner when the front door to his apartment was suddenly knocked out by special forces.

The policemen handcuffed the specialist, demanded the passwords from the devices and took all the equipment. Fifteen minutes after the raid, Monteiro was shoved into a police van and taken to the police station. There, an NCA agent announced that the Briton had been arrested on suspicion of preparing for the murder and being linked to Besa Mafia.

Apparently, this incident was the result of an online campaign by Jura to spread fake information about his abuser. As it became known later, he hired several people to create fake websites, which published information about the connection between Monteiro and the darknet site. In the warrant for searching the apartment of a specialist, the police just referred to one of such fake notes.

The next two days, Monteiro spent in the area, trying to prove his innocence. At some point during the interrogation, the specialist was asked why the video game Hitman (tells about the assassin) was installed on his computer, implying whether it could be an inspiration for Besa Mafia. Ultimately, the Briton persuaded investigators to study the information on his computer in more detail, rather than making hasty conclusions. On the third day he was released on bail, but all charges were dropped only in June 2017.

Results of the investigation

In early 2017, the NCA, together with the police of other countries, arrested several people who were trying to order a hitman in Besa Mafia. The site of The Crime Bay, which was managed by Yura after the closure of the previous project, was also blocked. According to Monteiro, the attacker avoided a wave of arrests and runs new darknet hiring killer sites. The last known is called Bratva Mafia.

Bratva Mafia website homepage
Bratva Mafia website homepage

As the British expert and his partners suggest, Yura works from Romania, although he pretends to be Albanian. One of the interlocutors of Wired, who spoke with the attacker, believes that he is a little over 20 years old. At the same time, an unknown person in personal correspondence hinted that he was working for the police undercover. Allegedly, after the disconnection of Besa Mafia, the FBI contacted him and offered to cooperate: he merges information about customers to them, and they do not send him to prison.

However, the programmer under the pseudonym bRspd, who helped Monteiro hack Besa Mafia in the spring of 2016, rejects the Jura version. According to the expert, the attacker intentionally invented himself to be an image of a “good guy,” but in reality he was always interested only in money.

According to Monteiro, the state of the Jura, accumulated for fraudulent activities, may exceed six million dollars.

Although there is no evidence that Yura really works for the police, partly there is a good side to his actions – if not for him, then neither Monteiro nor the police would have ever heard of Stephen Allwine and his ilk. In other words, the legend about the services of killers in the darknet, which Monteiro is so hard fighting, may have helped save someone’s life.

However, the Briton is not ready to accept such a version, pointing out that Yura incited people to kill, and did not use it to catch the criminals. As Monteiro says, his first and foremost goal in this story is to try to clear public reality from lies.

I started this for the sake of fighting fake news. I wanted to explain the [device] of the darknet, determine the facts and fiction, explain what is real and what is not. This is my highest goal – do you understand?

Chris Monteiro
british cyber specialist