AI
A Dark Web Assassination Marketplace Finds a Researcher
Chris Monteiro, a darknet investigator, was cataloging dark web myths on RationalWiki in 2016 when a Romanian IP address vandalized his Wikipedia entry. The vandal claimed one assassination site was real and linked to it. The site, styled after 1990s clip art, offered murder-for-Bitcoin: fill out an order form with the target’s name, address, photo, and pattern-of-life details, then pay. When Chris published his conclusion that the site was a scam, someone torched a car and filmed it as a warning.
Four Vulnerabilities That Handed Over the Entire Site
Chris placed a test kill order targeting Bob the Builder to access the messaging system. Message IDs in the URL incremented sequentially. He wrote a Python script, iterated every ID, and exfiltrated all messages without randomizing a single number. He then found an Apache misconfiguration exposing open directories, including a folder where the administrator had accidentally uploaded a screenshot of his own desktop. SQL injection gave Chris a web shell and remote code execution. An unused mailing component stored the admin’s email and password in plain text.
Yura’s Clearnet Funnel and Dark Web Franchise
The site’s operator, known as Yura, solved a client acquisition problem with a clearnet hitman-for-hire comparison site. SEO’d to rank above the New York Times for the query “hire hitman,” it steered searchers past competitors and into Yura’s own dark web marketplace. He franchised his codebase to other operators, ran a fake escrow service, and operated a scam-as-a-service side business. He also ran a disinformation campaign claiming police pressure was shutting him down, generating social proof that murders were actually being delivered.
Building the Kill List in Secret
Chris built a data exfiltration engine that ran secretly inside the site for years. A cron script intercepted new orders daily, pushed them to an AWS data lake, and fed an investigator database. The resulting kill list included a hit in Amsterdam for $2,000, one in Paris for $1,100, and a $14,000 order in Slovakia. Every failed hit came with an upsell: more bitcoin would make the next attempt succeed. Miller and a team of local journalists tracked down targets and warned them face to face during COVID lockdowns.
Who Was Ordering and What the Police Found
The perpetrators were not career criminals. Kelly Harper, a hospital administrator in Wisconsin, paid $2,200 to kill her estranged husband Travis. Christopher Pence, a Microsoft IT security technician and father of 16 children, paid $16,000 to kill his adoptive children’s biological parents. Ron Ilg, a neonatologist who ran a charity for women in addiction, paid $60,000 to have his wife Jennifer kidnapped and forcibly addicted to heroin. A pink post-it note in a thumbprint-locked safe in his house listed his username, SCAR 215, and password, Mufasa. He is in prison.
175 Disclosures, 32 Arrests, and 2,000 Cases Still Open
Over three years, Miller and Monteiro disclosed 175 paid kill orders to the FBI and law enforcement worldwide. Cases reached courts in Nevada, Canberra, Tampa, and Galicia. So far: 32 arrests, 28 convictions, 180 years of prison time. Romanian raids in late 2022 by DHS and Romanian counterterrorism eventually locked the team out of the site. But Chris intercepted more than 2,000 messages total. Hundreds of orders have not been traced, not received crypto analysis, and have not reached law enforcement. Miller is asking the DEF CON community for help.
Notable Quotes
I mean, this is astonishingly insecure Carl Miller · ▶ 8:29
there’s a non-zero chance he is. Carl Miller · ▶ 12:08
I’m having an ugly divorce. Elena · ▶ 22:40
Key Takeaways
- An IDOR on sequentially numbered message IDs exposed every kill order on the site.
- Yura SEO’d a clearnet comparison site above the New York Times to funnel clients to his dark web marketplace.
- 175 of the 2,000+ intercepted kill orders were disclosed, producing 32 arrests and 28 convictions.
About the Speaker(s)
Carl Miller is a technologist, journalist, and writer. He founded the Centre for the Analysis of Social Media at Demos and the information integrity lab CASM Technology. He is a Visiting Fellow at the Department of War Studies, King’s College London, a Senior Fellow at the Institute for Strategic Dialogue, and a Senior Research Fellow at RAND Europe. He wrote The Death of the Gods: The New Global Power Grab, which won the Transmission Prize. He co-wrote and hosted the podcast Kill List, which reached number one in seven countries and was named the Guardian’s best podcast of 2024.
Chris Monteiro is a dark web investigator, ethical hacker, and systems administrator for a major company based in London.