156: Kill List

I used to live and work in Las Vegas.

What a town that is.

I'm so glad that I got out of there.

It's like I had a hole in my pocket all the time, and I could never find where it was.

Anyway, I was playing craps one day.

This is where you throw the dice.

It's a big table.

And this

frail old man came up and he was playing too.

And he was betting big.

He was getting wild with his money, having a good time.

And I was rolling the dice and he was making money off of my dice roll.

So he was liking me.

And we started chatting it up.

But there was this dude behind him, him, a big guy, not a muscular man, but a guy who probably loves cheeseburgers, if you know what I'm saying.

And I asked him, hey, man, you want to get in on this game?

I got a hot roll going.

And he didn't say anything.

And the old guy turns to me and he says, oh, don't mind him.

He's my bodyguard.

And I was like, oh, really?

This guy is your bodyguard?

And then the old man told me something that surprised me.

He said, yeah, but I don't actually pay him to protect me if there's actually a fight.

And I was like, what?

what?

You don't pay him to rescue you out of anything?

No, no, I can't afford that kind of bodyguard.

This guy just stands next to me.

And if something goes down, he knows he doesn't need to step in.

And I'm like, well, hold on a second.

Why are you paying someone to stand next to you?

And he said, to be my bodyguard.

And I was like, no, but he's not guarding you though.

And the old man said, yeah, but no one knows that.

Everyone sees him next to me and they don't mess with me because he's there.

And I was like, does that work?

And he said, yep, I haven't been robbed yet.

These are true stories from the dark side of the internet.

I'm Jack Reeseider.

This is Darknet Diaries.

This show is sponsored by Delete Me.

DeleteMe makes it easy, quick, and safe to remove your personal data online at a time when surveillance and data breaches are common enough to make everyone vulnerable.

Delete Me knows your privacy is worth protecting.

Sign up and provide DeleteMe with exactly what information you want deleted, and their experts will take it from there.

DeleteMe is always working for you, constantly monitoring and removing the personal information you don't want on the internet.

They're even on the lookout for new data leaks that might re-release info about you.

Privacy is a super important topic for me.

So a year ago I signed up.

Delete me immediately got busy scouring the internet looking for my name and gave me reports of what they found.

Then they got busy deleting things.

It was great to have someone on my team when it comes to protecting my privacy.

Take control of your data and keep your private life private by signing up for Delete Me.

Now at a special discount for my listeners, get 20% off your Delete Me plan when you go to joindeleteme.com/slash darknet diaries and use promo code dd20 at checkout the only way to get 20 off is to go to joindeleatme.com slash darknet diaries and enter code dd20 at checkout that's joindeleatme.com slash darknet diaries code dd20

This episode is sponsored by my friends at Black Hills Information Security.

Black Hills has earned the trust of the cybersecurity industry since John Strand founded it in 2008.

Through their anti-siphon training program, they teach you how to think like an attacker.

From SOC analyst skills to how to defend your network with traps and deception, it's hands-on, practical training built for defenders who want to level up.

Black Hills loves to share their knowledge through webcasts, blogs, zines, comics, and training courses all designed by hackers.

For hackers.

But do you need someone to do a penetration test to see where your defenses stand?

Or are you looking for 24-7 monitoring from their active SOC team?

Or maybe you're ready for continuous pen testing, where testing never stops and your systems stay battle-ready all the time.

Well, they can help you with all of that.

They've even made a card game.

It's called Backdoors and Breaches.

The idea is simple.

It teaches people cybersecurity while they play.

Companies use it to stress test their defenses.

Teachers use it in the classroom to train the next generation.

And if you're curious, there's a free version online that you can try right now.

And this fall, they're launching a brand new competitive edition of Backdoors and Breaches, where you and your friends can go head to head hacking and defending just like the real thing.

Check it all out at blackhillsinfosec.com/slash darknet.

That's blackhillsinfosec.com/slash darknet.

I think it was like, man, it was like seven years ago at this point that I was told, I need to get Chris Montero on the show and talk about what he found.

So, of course, I slid into his DMs and acted all cool and stuff.

Hey, man, I heard you're deep into the web.

He's like, can't talk about it.

Too sensitive right now.

So I was like, okay.

And I followed up a year later.

But again, he didn't want to talk.

And he's like, no, I'm done with that.

I walked away from that.

And then maybe like another two years after that, I asked him again.

And this time he's like, the police are investigating this.

We're going to have to wait.

Then I think another time he told me there are threats against him.

So he needs to stay low for a while.

And it's just been one of those stories that the longer it goes on, the more intrigued I am by it.

And I really hoped one day I could talk with him.

And now, now Chris Montero is ready to talk after seven years of waiting for him.

And I can't wait to finally hear what he has found on the deep, dark web.

Okay.

Yeah, I'm Chris Montero.

I'm a cybersecurity professional.

Up until now, the main thing I know about Chris is that he spends a lot of time on the darknet.

Basically, the anonymous side of the internet that you need a special connection to get into.

And this seems to be where Chris feels comfortable.

Well, I wouldn't say I lurk at that interest in it because I don't, I really try not to do it anymore.

But

back in 2015, 2016, I

did a bit.

I got very into things.

As I'm sure you and your listeners know,

one of the things that web's well known for is the dinette markets, where you can buy drugs and stolen data.

And but there's also loads of urban legends and nonsense and scams out there.

And so in 2015, 2016, I was really into writing for Wikipedia, writing definitions for what dark web means, what deep web means,

what a history of dark net markets, how does it instigate with tour, what are the police doing, what are the academics saying about the commerce, and ultimately about the scams.

So I...

There was a time where I was very into documenting cybercrime, which I don't recommend.

I mean, there's crime, and then there's cybercrime, but then there's dark web cybercrime.

And the stuff that happens over there, well, it all has this veil of secrecy, you know?

And so the stories we hear that come out of there are a little bit more brutal and ugly than a normal cybercrime story.

And trying to keep up with all the ugliness that goes on there, it's rough on your soul.

I mean, starting out, okay, he was learning about the darknet drug marketplaces and how they worked, and he became an expert in that whole world.

I went a bit too far.

Um,

and

as

I was then, and today I am a self-proclaimed expert on darknet markets and the dark web, uh, I started debunking scams.

Um, there are many dark web scams, or there were people saying, oh, there are secret fights of deaths between midgets, there are uh, there are AIs which have escaped and will answer you anything, there are rooms you can go to and you can participate in a live stream of murder in so-called red rooms.

This is nonsense.

This is all rubbish.

But people don't care because it's so difficult to talk about cybercrime and the dark web that, you know, people on YouTube and on the internet must make up shit for their own entertainment and no one's interested in the real answers.

So I found the niche where I was going to start writing about

all of these fake phenomena in depth with citations and original research and aggregate of research as possible.

And I did that.

And one of the ones I covered, just one of many, was

hiring a hitman on the dark web.

Well, I thought to myself, I know how all this works.

I know how reputation systems work with dark markets.

I know how escrow works.

I know how the web of trust between the sites work and how you find them.

So it should be very easy to find out what if

such a website is fake or real.

And so I found, I was documenting them and I found a slightly more sophisticated website, which again was, that was, looked like a darknet market.

You could register, you could apparently hire a hitman and you could pay money for escrow and get someone killed.

And it was just like a darknet market, like Silfro or something like that.

So we looked into this hitman for hire site deeper.

And yeah, he sniffed it out pretty easy that it's just a scam.

No actual hitmen are here who you can hire to kill someone for you.

It's just a myth to be able to hire a hitman online.

So he took his findings and wrote it up.

At the time, he was writing articles on Rational Wiki.

And this is a place that debunks conspiracy theories and explains when something is pseudoscience or real.

So he writes an article there saying, yeah, hitmen for hire sites on the dark web, they're all scams.

Don't believe it.

I had my Rational Wiki article vandalized by an IP in Romania saying that, oh, yes, the dark web hitman sites are scams apart from Bessimathia, which is real.

And like, what?

You can't edit my wiki page.

That's not cited stuff.

You can't do that.

And so it began.

And that message was from the person we know as Yura.

Okay, so this edit explicitly said the dark web hitman for hire site, Bessamafia, is not a scam.

You can actually hire a hitman there.

Well, this, of course, drew Chris's attention.

Naturally, he goes there to investigate it further.

He's never even heard of this site before, Bessamafia.

Yes, Besa Mafia Mafia is a hitman's the highest site.

You know, this site is run by some organized criminal gangs.

It's just like a real dartnet market.

You can't get scammed.

There's mediation.

And instead of buying drugs, you can buy murder.

And I spent a lot of time dealing with this.

Yeah.

So your first take on it, or even like your first day of looking at it, did you think this did look legitimate?

No.

Again, I had spent over a year at this time documenting the history of real dark net markets, darknet commerce,

dartnet navigation.

I knew very easily that this website was a scam.

You know, there was plenty of tales beyond that.

But again, I knew it wasn't a scam.

So I just, but I thought, you know, whatever.

I'll write a blog post about it.

It's a bit interesting that someone's made a hitman of a higher scam site, but it actually like make it look like a market and made it look real.

So I wrote a blog post about it and saying how this website is fake and it has like stock photographs on it and bad spelling and doesn't make sense.

And yeah, there you go.

I'd add it to my body of research on dino scams.

Job done.

What's I thought?

The administrator of Bessamafia, his name is Ura, was quite interested in the reputation of his site.

So much so that he paid people to promote the site, where there would be Reddit posts about the site, blogs being made, and other freelancers hired to just drum up business for the site.

So if you googled the site, you'd see all these positive reviews of the site.

But then there was this one blog that Chris wrote about how that site specifically is a scam.

So I had pissed off the site administrator.

So he asked for a true and honest interview with me.

He contacted me via my blog.

And I said, sure, why does a scammer want to interview me about, you know, why the site is fake?

What's that about?

And yeah, we went back and forth.

And he was saying the site is real.

I would shut him down.

He would count with some flimsy evidence.

I would unpick it.

He would get aggressive.

I would show that as a sign that he doesn't know what he's doing about.

And

he tried to pay me off.

And

this escalated to the point.

I'm like, yeah, this guy is just...

dig himself a hole.

His scam is trying to persuade me,

at the time at least, authority on.NET scams that his site's not a scam.

It's not going to work.

And yeah, so I published that whole exchange on my blog.

I thought that's all right, you know, debunked another site, got some first-hand evidence, done some done some journalism, even.

And there you go, thought that'd be end of it.

This is when the narrator comes in and says, it wasn't.

The site administrator, Euro, was not happy with this post and was on a mission to get Chris to remove it.

And if an interview with him didn't persuade Chris, then they're going to have to take it to the next step.

And if you think about it, what kind of persuasive tactics could a hitman for hire site try next?

Yeah, you got it.

Intimidation.

The administrator hired someone to make a video to threaten Chris.

And so Chris gets a message from someone with a link to a video.

And Chris watches the video.

It starts out on a piece of paper.

And written on that piece of paper is Chris's blog's website, pirate.london.

That's the website address.

And then they burn the piece of paper.

And then the camera changes to a car being set on fire and it's engulfed in flames.

And like basically torching a car in order to intimidate me.

So in order to say, look at us, we're real criminals.

We have people in the field.

We can trivially commit acts of violence.

Don't fuck with us.

And

I was very confused by this because this was a scammer.

This was a scam site.

There were no hitmen.

There were no criminals.

So I thought there was just, it's just a scam to steal money.

And now I'm getting a video of a burning car.

And

yeah, I would say and then it got weird.

Did it feel intimidating to you?

Did you feel like, wait a minute, this is, maybe I should just back down from this whole thing?

I mean, I was a bit intimidated.

Yes, I was intimidated.

But you bear in mind, at this time, I'm making myself really into the hobby of being the darknet scam debunker guy.

I was anything, I was drawn in more by this.

I was like, what is going on?

have i pissed off the mafia is this website real but it can't be real so if it's not real how are they getting people to torch cars and they'd have torched some other cars for some other people on the internet who had who had um disrespected them as well so it was a whole it was a whole thing going on so i got really i was uh yeah i i was intrigued but i had to go on

Chris decides to play it safe though, and he hires a lawyer and he informs the police about this threatening video.

I'm like, okay, fine, Mr.

so-called Hitman, the the higher site on the dark net, what's going on with you?

So

rather than just browsing the website at this point, I thought, well, okay, I will register on the website and see how it works.

So

I registered as Booty McBoatface because it was 2016 and Voting McBoatface was cool.

And I took out a hit on Bob the Builder, the lovable children's character, on the website.

And I thought, well, okay,

it's okay.

The website seems to have a logging system it has an ordering system it has a messaging system has some and whatnot also seems quite functional there's like it's you know got the trappings of a dart net market so

I thought to myself that's

that's weird

but I looked at my order for taking out Bob the Builder you know

and I looked at the address bar and I saw that there was an ID in the address bar

at the end it's like message ID equals one 123.

I thought,

okay, so that's the message ID.

I wonder if I change the message ID to something else.

Change it to 122.

And I got someone else's messages.

121, I got someone else's messages.

What?

He could see other users' messages?

Okay, I have opinions.

First, let's talk about this vulnerability.

I would call this URL parameter tampering.

I think that sounds cool, right?

To tamper with a URL.

And that's where you just change part of the URL to like one number different or something to see if you can see someone else's data.

But I think the official term is insecure direct object reference.

One user should never be able to access another user's private data, such as private messages like this.

Yet here, it sounds like it was incredibly simple to do.

A more complex approach might be that you have to go into the cookies and change which user you are.

And then the site thinks you're a different user without actually validating that.

But this wasn't even that hard.

You just changed one number in the URL.

This vulnerability is number one on the owasp top 10 vulnerabilities which falls under broken access control but i want to point out something else here just because you're on the dark web just because you're on a site that is supposedly very illegal does not mean it's actually secure You would think if this site was actually a place to hire a hitman, that the utmost extreme privacy would be put in place.

But it wasn't, not even close.

The site was a total joke as far as security and privacy goes.

And I want you to keep that frame of mind.

Whenever you're dealing with anything with sensitive data, your doctor, your lawyer, your bank, your tax advisor, they should all be using the utmost private way of communication.

But their systems aren't always secure or private.

And I just want you to think about that.

If a site should be secure, like a Hitman for Hiresight or your therapist,

maybe it's not.

Just like in the case of this.

Oh, and it's kind of hilarious that Chris is basically hacking into this site, since it might technically be illegal for him to do that.

But what is the owner of the site going to do?

File a police report and say, hey, man, someone hacked my Hitman for hire site.

So it seems like a safe thing to do.

Anyway, this was a huge discovery for Chris, to be able to read any message on the site that other users were sending to the administrator.

So he quickly quickly put together a little script to enumerate through all these message IDs and to save them all into a spreadsheet so he can go through and read all the messages on this Hitman for Hire website on the dark web.

Yeah.

So I've downloaded

over 100 messages at this point.

The website's only been operation for a few months here, but I've downloaded all the messages.

And

I

I'm getting my mind blown here because I'm seeing messages not just like messages from me voting at Boatface.

There are are some trolls and some spamming there, but there are people and they're giving names, addresses, follow-up times, where to meet them, phone numbers,

talking about alibis, talking about timings, negotiating payment, negotiating further payment.

And I'm reconstructing these on my local machine from all the messages and I'm starting to sort them out and see what's going on.

And what I realize is that yes, there's some crap going on the website, but there's a subset of people who are using the website, or so they think, to get people killed and to arrange arrange money to get people killed.

And,

well, that's what it looked like to me at least.

Well, hold on here.

These messages are a bit alarming, haunting, even.

A user wants a certain person dead and lists their name, address, phone number, place they work, pictures of them, Facebook account, and how and when to do the murder, so that this person has a good alibi.

Not only that, but money is actually being sent to pay for this.

This is chilling.

I've mostly been completely unable and unwilling to engage in these cases emotionally because

they are really bad.

I mean,

you know, I mean,

I'll quickly give a story of one

case which is concluded in news now.

There is a case where someone paid $20,000 to kill at the time a 14-year-old boy in New Jersey.

Interestingly enough, I never had the full details on that until it went to court.

It turned out it was

an online groomer who was

grooming this 14-year-old over the internet and having to show pictures and whatnot.

And when he told his parents, the guy was like, oh, shit, I'm going to get in trouble here.

I better have him killed.

So not only was this young boy abused, he was almost killed by this guy.

An online groomer put a hit on his victim for telling his parents and then paid $20,000 to have this boy killed.

Whoa, whoa, whoa.

And Chris can see the Bitcoin wallet address in the chat messages and is confirming that, yeah, in fact, money did get sent to the site for this.

This just got way more serious and went deeper than he realized.

Chris was thinking about getting help from someone.

I met Carl in,

was it like late 2016 or so?

Carl, how did that go?

Yes.

Yes, we met in late 2016, just before Christmas.

Not a meeting that is easy to forget.

It was in a pub in central London, and it was really busy and crowded.

And I'd not met Chris before, and kind of mutual friends of ours had kind of put us in contact.

And I was kind of roving around trying to write a book about power in the digital age, which sounds about as vague as it was at that point in my mind.

Carl was looking for a good story and was interested to hear what Chris was working on.

I'm Carl.

I'm a writer and journalist.

Carl and Chris talked.

Carl was very interested in this, but Chris had a hard time making the connection in his head that the words written in those messages are from real people.

I mean, he's in the business of debunking things online, you know?

And you see so many threats online today.

It's hard to put your finger on something and say, this is a real threat from a real person, but then ignoring so many other things.

I mean, gosh, how many times have we all heard, Jack, if you come into the house one more time with mud on your shoes, I will kill you?

All right, maybe it's just me, but you get my point.

You hear threats to life all the time in our everyday language.

But on top of that, the dark web is an anonymous place, so people really run their mouth on there thinking they're private and no one's ever going to know who it was.

And so, Chris wondered if these were real threats or not.

And he made a good point.

So, at the end of the meeting, Carl had a clear idea of what to do next.

I i kind of concluded that there was no way that i could write about any of this until the police at least had investigated whatever it was they could investigate so i i think me and chris have slightly different relationships to the police and and thoughts about them to put it mildly and i i've spent some time

embedded in a cyber crime investigations unit in a in a local police force in the UK.

And I felt like I had a pretty good relationship with them and other police and other police forces.

And so I kind of broker a meeting between Chris and the National Crime Agency.

So Chris goes to this meeting, but it's just weird from the get-go.

Oh, yeah.

So, yeah, Carl set me up this sort of super, super shady meeting with the National Crime Agency.

I'm doing this clandestine meet tier where I'm turning up to a location last minute and I'm being followed.

And, you know, it was all sort of all very hush-house, et cetera, et cetera.

But I had a successful meeting where

I outlined what I had.

I gave them a prioritized list of cases around the world, the sorts of money being paid, the jurisdictions involved, and the seriousness and said, look, I can't deal with this.

I'm just some bloke.

Can you please investigate these what looks like attempted murders around the world, or at least the ones in the US or in Europe, where, you know, where I expect you have some cess.

And the meeting was successful.

They said, great.

Yes, this is brilliant.

This is exactly the sort of thing we're looking for.

We'll be in touch.

And, you know, I have no reason to doubt the words of the people who I met.

I think they

would have probably got around to doing something eventually, and we should have been nice.

But circumstances conspired otherwise.

One of the people who was using the website back in 2016 goes under the username Dog Day God,

was trying to get someone called Amy Alwine killed.

Amy Alwine lived in Minnesota.

And somehow the FBI got the private messages that were from the Bessa Mafia website and started investigating this.

The FBI had information that someone put a hit out for Amy Alwine.

So they paid her a visit.

And when they arrived, both her and her husband were home and they sat them both down to explain the situation.

This hitman for hire website, Bessa Mafia, someone has paid them $12,000 to have you killed.

And she was shocked and had no idea who was doing such a thing.

Well, it was her husband who paid to have her killed.

The very man who was in the room when the FBI was telling her that someone is threatening to kill you.

The FBI didn't question the husband at all.

They just notified them both and left.

Her husband, Stephen Alwine, who was a deacon at his church, went on the darknet, bought some scopalamine, which causes a person to become very disoriented, and gave her a huge dose of it, and then shot her and killed her.

He then tried to stage the whole thing to look like a suicide.

And then when Amy, and I think this is really, this is the clearest evidence that they really weren't investigating this.

When Amy was reported to the police as having committed suicide, and Stephen Orwine phoned the police and said, my wife shot herself,

the investigating officer had no background,

didn't know that this order existed, didn't know, I think, that Amy had been warned, and almost closed the scene down.

Like he went to the house and he was about to declare it a suicide and about to close down the crime scene.

And it was only at the last minute he paused, felt like something was wrong, and then decided to

get the luminol out.

So a substance that allows him to see cleaned up blood and then realized the house was full of it and that Amy had been moved.

and then you know and then scopolamine was found in her blood and basically a whole tumble of additional evidence that that suggested that she had been drugged and then and then murdered.

I mean, can you imagine how differently you would investigate a suicide if you knew that someone had paid to have this lady killed?

But the FBI never informed the local police when they did their investigation.

And even after all that, they had a hard time finding evidence that Stephen, her husband, is who killed her.

It was only after they looked at his computer and found his Bitcoin wallet was, in fact, the one that sent the money to the website.

And of course, the defense attorney was trying to say, well, you only know about that transaction because you illegally hacked into the messages of that website.

So that should not be admissible to the court.

Stephen Orwein was eventually convicted of first-degree murder and is currently serving life without parole.

It was a tragic and awful event that the FBI bungled big time.

But it gets worse.

The The FBI were like, Man, what is this best on Mafia site?

What is going on there?

Who's running that?

And they wanted to take it down.

The FBI jumped into action and they, what they did, they googled a website.

And they, I, I still had to still have an ongoing feud with the guy behind the website, Eura.

He's paying a guy in India to write, write shitty blogs about me.

He's adding my name to metadata on the website.

He's really

looking to

drag my name through the mud for criticizing his website.

But I don't care because, like, who's going to believe that I'm running a website?

I'm a person.

I use my own name.

I have a blog.

I have a job.

I live in London.

I'm not running some secret murder hire for website.

You know, what sort of person would think that?

Turns out the FBI thought that.

And between the FBI, they liaised with the National Crime Agency in the UK.

And within literally, I think it's a case of hours or days

this being processed by the FBI, the NCA were breaking down my door and arresting me for running this murder for hired a website.

Chris was able to get out of his arrest, but it did affect him.

Clearly, this Euro guy is doing a lot of work to get Chris to shut up about this website and is willing to frame him or get him arrested.

Investigating this site was becoming too much of a burden.

I did take the opportunity to quit.

As having one's door broken down and being arrested for something,

which

doesn't seem to be real wood, I'm like, I'm out of this shit.

I'm done.

They've got handed over my information to the police.

I'm like, job done.

Never want to hear about the website again.

But the the more Chris and Carl thought about this, the gravity of it just started to sink in.

These are very real threats to life.

And already one person has been killed.

They had lots of time to help Amy, but they didn't.

They could have saved her life.

But they trusted law enforcement to do it instead.

And that failed.

So maybe,

just maybe they can save the next person's life.

We're going to take a short break here, but stay with us.

This dark web adventure is just getting started.

This episode is sponsored by Vanta.

In today's fast-changing digital world, proving your company is trustworthy isn't just important for growth, it's essential.

That's why Vanta is here.

Vanta helps companies of all sizes get compliant fast and stay that way with industry-leading AI, automation, and continuous monitoring.

So whether you're a startup tackling your first SOC2 or ISO 27001 or an enterprise managing vendor risk, Vanta's trust management platform makes it quicker, easier, and more scalable.

Vanta also helps you complete security questionnaires up to five times faster so you can win bigger deals sooner.

The results?

According to a recent IDC study, Vanta customers slashed over $500,000 a year in costs and are three times more productive.

Establishing trust isn't optional.

Vanta makes it automatic.

Visit vanta.com slash darknet to sign up for a free demo today.

That's vanta vanta.com slash darknet.

The police weren't completely incompetent.

Carl and Chris gave the police all the messages that they found on the site.

And this did lead the police to be able to find people who were planning murders.

And the police were arresting people and putting them in prison.

Because if you pay someone to kill someone else, that's illegal.

It's called solicitation of murder.

And you could get life in prison for doing that.

Even if you're sending the money to a scam hitman who's never going to do it, it's still illegal.

In fact, someone who got arrested in Spain tried to give that exact defense.

They were saying, this whole website was fake, so my clients should not be in trouble, but they still got put in prison.

Well, the initial idea was that me and Chris would do a...

short, sharp, nice, quick, kind of eight-week-long retrospective looking at the assassination market, which I, you know, I mean, if

I am the,

by far the least brave person talking right now, and I'm like, really not drawn to this sort of stuff.

Uh, and quite a lot of my kind of instinct was telling me not to go back into this world, and I'd only dip my toe in, like, nothing like Chris.

Um,

but I did feel like to me, it all felt that those years from 2016 onwards, like very much like unfinished business.

You know,

the site was still operating.

The person running the site was still making money from it.

And Amy Orwine had been killed.

Suddenly, Chris kind of brings us into a Zoom call and then tells us this kind of fateful discovery that he's consistently in.

He's beginning to scrape these kill orders and that the site is,

and that we're essentially going to be receiving them in near real time.

And that was then the beginning of the kill list.

Kill list is an amazing podcast that Carl made, which pretty much starts at this point right here.

With new kill orders coming in, what should they be doing about this?

Chris is the dark web hacker.

Carl is the investigator.

Ultimately, I was able to access the administration page on the website.

So this is the page the administrator uses to correspond with

the users of the website, and you scan them.

So that page can see everything on the site.

There were some other pages as well, like pages which showed payments and so on and so forth.

So once I've discovered these through technical means, I basically have a small cron job.

I'm pulling them down fully as is.

I'm actually then building parsers to parse them into a constituent component, put them into a database.

And ultimately, I'm building a web front end to

to categorize, browse, and reports on each of these cases and annotate them all, which today I have.

You know, I have it more in my window, my window to the right-hand side.

Now, I have my

Hitman analysis website where I have

all the cases in there categorized by harm, by fraud, by country, by personal information, annotated with Facebook links, address links, phone numbers, etc.

So,

but I was able to focus on getting the data legible, clean, kind of comprehensive and handing this over to Carl and the podcast team.

And so that was a good division of labour.

So

I had the technical tasks and Carl and the team had to deal with everything else.

We went to the police again, the Metropolitan Police, they did believe us.

But there were no UK cases.

They basically decided that because there were no UK cases, it wasn't their problem.

And they disclosed this kind of initial tranche of orders that Chris had compiled and handed over to us to Interpol.

And we thought about that for a while and thought that this is very likely to lead to additional bungled police investigations or no investigations at all.

They won't know who we are, the police.

We won't know who the investigating

officers are.

There'll be no way for us to exchange information.

And it will very likely lead to police officers kind of in the same way that it happened with Amy Orwine, maybe receiving some kind of warning, maybe making contact, but not in any kind of position to like effectively investigate, much less gather the evidence they need to actually get someone into

a courtroom.

Chris would read through these kill orders and sometimes try to figure out who it was that made the kill order.

So often

they'll approach with some brief information saying, hey, you know, can you do this sort of service in my location?

And the answer is always, of course, yes, we have hitman around the world, but you can do it within one week that's always the answer because it's a scam

and then they usually say then they might be some more information like oh yeah well i'm thinking of having something special can you give a message can you in this case give a can kidnapping can you uh you know say something like that and the answer is always yes yes we can do that

Often it's followed up by here's the initial order, here's the name, the address, the social media, the car they drive,

etc., etc.

Where they work, where they can be found.

Often they give a bit of information about why

they want the person killed, which usually gives them away.

Like, oh, this person should return to their husband.

It's like, yeah, I wonder who posted that order.

Or this person should

be given the message, you know,

that's for being a cheater.

It's like, ooh, I wonder who that person could be.

That has to happen sometimes.

And after the order, there's further negotiations and there's always a price.

How much should they?

Oh, it's always usually $5,000, $10,000.

But it's, you know, depending on how much money you have, sometimes there's a negotiation about, oh, how can you uh make sure you don't take the money and run?

And they say, Oh, no, you can't take the money and run because we have an escrow system.

And if the hitman were to take the money, we wouldn't give the you know, would not take the money and not to do a nude killing, we wouldn't give him the money, so that way you are safe.

But of course, the escrow system is uh you know it's designed to stop you from a high-fifth hitman scamming you like you would a dinette drug vendor scamming you.

Um, it doesn't protect you from from the site itself being a scam.

And then I mean Euro even has like dedicated third-party escrow sites which are independent or apparently independent where you can go to this independent site and you can broke your illegal transaction and a

further broker can handle handle this for you.

It's all run by him of course and of course he directs everyone to use this independent website and it all uses the same backend.

And then you go say I've put my money in the escrow system and they say, oh, I can I see we have unlocked this we've now going to send a hitman but then of course what happens is oh actually it turns out you need a higher class of hitman or you need to pay more or the hitman went there but they failed so you need to need them they make them need to pay more money or it turns out you need you know this is more complicated so you need to pay more money and this is how it goes down in general

Chris would sometimes be able to identify who put the kill order in because it might say something like, it's my wife who I want killed or something and then they have the wife's information in the kill order to easily figure out who did this so they decide to try to phone up the targets to see if they can warn them but the FBI mishap with Amy Alwine was top of their mind what if they call up someone and the person who's trying to kill them answers the phone or is listening in and it just escalates the whole thing and they get someone killed.

The plan was to try to call the person, but then get them alone so that they can tell them this information in private.

But man, how do you call someone out of the blue and try to get them to listen to the information you have, but they need to be alone first before you're going to tell them?

It sounds impossible to deal with.

But Carl gave it a try.

No, I don't want any information.

I'm trying to give you information.

Okay, well, thanks for your time anyway.

Do give me a phone back if you'd like more information.

And then he tried again.

Would we be able to arrange a time to be able to talk to you at greater length about that?

Okay.

So

you don't.

Carl was extremely nervous on these calls.

He's got the target on the phone, which is hard to begin with, but he's trying to be as sensitive as possible to avoid any further harm.

He decides to try again to be more direct.

Just I understand you don't want to work me on the story.

However, I'm actually duty-bound to say that the information that we have might relate to you being in danger.

So

I'm kind of duty-bound as a journalist to disclose it to you if you like me to.

Even if you're asking me for a survey that has something to my relationship

to the job or to professional or no, it's not a survey.

I'm a journalist.

We've come across information which indicates that you might be in danger

um i'm in danger yes

for trying to protect me keep me to face my dangers thank you okay thank you goodbye

wow

leave me to face my dangers he's not having any of it i'm very surprised by that i mean if someone phoned me up saying you might be in danger i would want to know what what it was regarding yeah

this is turning out to be a lot harder than it sounds absolutely like we we knew the whole you know we knew the whole thing was this like

ethical

like kind of minefield.

And I was really afraid that I would do something which meant that I could never live with myself again.

You know, we had this information that Chris was passing us that was unbelievably powerful.

I mean, it had the power to save lives and destroy them.

And we didn't know what to do.

We had no real frameworks.

We didn't know what the safest thing to do often was.

We were having to kind of make it up in urgency as we were going along.

And I didn't, you know, I mean, we could have made one, it's kind of easy now to kind of talk about all of this in retrospect.

But at the time, like, you don't know what's going to happen.

Like, you don't know that this call is going to turn out okay or that person's going to be okay.

And like, every single time I made that call, and remember,

nine times out of ten, they just hung the phone up on me, or they wouldn't talk, or it would be a wrong number, or something like that.

But every single time I dialed that number,

I'd be having to like work myself up into this.

I was working myself up into this kind of state of mind where I thought, well, you know, this could be the moment where I commit some like ethical,

crushing kind of

mistake that haunts me for the rest of my life.

I think it's at this point where I was listening to the kill list that I was happy that Chris was working with Carl on this story.

Like I said, I was tracking what he was working on and hoping we could talk.

And I was tapping him on the shoulder again and again for years, trying to get him to tell me the story.

But man, Carl is an amazing journalist and he has a whole team and seemingly like he has connections all over the world to try to do something about this.

And I wouldn't have done even half as good of a job as what he did on Kill List.

It's truly an amazing podcast.

As we're doing all this, making this extremely significant decision to contact the people on the kill list directly, we're increasingly actually not really behaving like journalists anymore.

Like journalists don't normally step into stories like that.

They don't normally contact victims

and

like drive stories or even create them.

They normally kind of try and be as least kind of disruptive as they possibly can.

And that's definitely not what we're doing there.

So that was also like very disorientating, like stepping like further away from

at least this kind of anchoring professional identity that I and the kind of team would have, you know, and becoming like something else and not really having a word for it.

Oh, you know, there's a word for it, Carl.

You don't want to say it.

Well, if you're going to say vigilante,

then I don't think we were ever a vigilante because

we were desperately trying to get the police to step in, like not replace them.

At least I was.

Like, we were, we were, we were handing over everything we did to the police.

So, yeah, I mean, I never thought we were vigilantes.

That wasn't the right word in my mind mind for it either.

It was like some weird gap of like being a really proactive journalist or investigator.

And you might be thinking, but Interpol is handling it.

Just let them do it.

But there's a reason that they felt it was important for them to continue to do something.

It was because

we were thinking about this disclosure route that had just appeared where Chris was passing it to us.

We were passing it to the Metropolitan Police.

They were passing it to Interpol.

And then Interpol would presumably pass it to the police forces around the world.

There was one in Switzerland, there was one in Italy, there was one in Amsterdam, you know, all over the place.

The problem with that was that we knew that Interpol would basically like denude the disclosures of any identifying information of us, and we would have no idea who the investigating officers were.

So, this kind of cut or like breach would happen.

There would be no link.

Like, they would just receive this Word document that Chris had created, plus maybe some like Bitcoin information.

They would have no way, as the Metropolitan Police did, of actually checking to see whether I was mad or not, which they genuinely did.

And we would have no way of disclosing additional information to them.

And Chris was passing over like updates all the time.

You know, these were live conversations that were happening.

So sometimes there'd be more Bitcoin and the urgency would have changed or a specific moment or time and place were being mentioned in the order, you know, which would change how dangerous we thought it was.

And we would have had no way of kind of passing that on in a reasonably swift manner to the people on the ground that could actually do something about it.

So that's why ultimately we decided that we needed to go to them directly.

And while investigating all this, they would run into news articles that would chill them to their bones.

There's many instances, many cases.

I'm sure we can touch on as many as you like, but we'll be pressed to time here.

Like, for example, there was one case where there was hiss against this young man in America and a couple, someone paid $5,000 to kill him.

Two weeks later, he's dead by gunshot, self-inflicted gunshot wound.

You know, was there insurance involved?

Was there foul play?

It's hard to say.

I won't go into too much of this, but during the course of our investigation, there was one of these major cases come through where someone paid a hell of a lot of money to have them killed.

And again, within weeks, that person was killed.

With information like that, plus all the rest information, which always gives the hideous backstories on people's story of stalking, of drugging, of coercive behavior, or marital breakdown, of relationship breakdown, of people sending death threats, people putting hidden cameras, people you know, really ruining lives.

We realized that this is, it's, it's really horrific, this stuff and I just happen to have to sneak peek into the worst of it

as does Carl and yeah it's very it's very very hard to digest and all this just adds a level of urgency to it all so I I

phone maybe a dozen people maybe two dozen over about the course of about a week maybe a bit longer

and it is dramatically unsuccessful

everyone thinks

that I know it is it really is I mean like it doesn't work everyone thinks I'm a scammer it It turns out we were solving the wrong problem.

So we thought the problem was going to be how to reach them safely over the phone, how to disclose in a way that wasn't going to like crater them psychologically.

The actual problem was that no one was going to believe me.

And so people hang up, they phone back like with their friends and they prank me and they pretend it's a big joke.

More often than not, they literally just don't pick up the phone though.

This is in the middle of COVID, remember, so people are kind of getting scam calls all the time.

um and so we change up what we do and we decide to send out local journalists on the ground um

to physically go and try to reach the people that were on the list and that that really changes things so so we it's only then really that we begin to make meaningful contact um reach people um be believed and begin to kind of develop the next phase in the kill list really which is talking to them supporting them and working with the police to try and find out who put them on the list the podcast Kill Base does an amazing job of documenting their adventure, calling people, talking with police, going to houses, talking with Eura, even.

It's a wild adventure, and you really should go and listen to it.

But one person in particular that they contacted stuck with me.

They discovered that there's this guy named Ron Ilg who paid for the murder of his wife in Spokane, Washington.

Okay, yeah, so obviously I'm the first person to see this, and um, I'm actually, I actually worked out as a dentist because not so this guy is an eonatal surgeon.

He's literally a surgeon for babies.

He's also looking to break the hands of a of a surgeon and um

it's like and he's paying something upward of fifty thousand dollars for this

uh he's got like multiple step plans of when the kidnapper should have place and taking photographs of it and how she should be made brainwashed and how she should be broken and where she should be taken taken to and how how he will get to see the information about this whilst whilst remaining at a distance.

I don't usually use this word, but it's sick and it's messed up.

And,

you know,

in his mind, when he paid that $50,000, it's very much real.

He was going to do this.

I was able to quickly work out between these identities of this woman and this surgeon mentioned that the person seemed related to them was this character called Rod Ilg.

And, you know, I said, this is the sort of information I send over to Carl and the team.

And I'm like,

this guy, they've got to do something about it.

You know, are the FBI working, helping at this point?

Are they going to do something?

Because

this is just crazy.

This is just...

I can't believe this guy is going around making his plans and like no one's taking it seriously.

That's terrible.

In addition to that, Chris is seeing that this guy, Ron Ilg, is trying to get his wife addicted to opioids, so she'll call off the divorce proceedings.

He seems extra diabolical.

Chris's subject

in the emails would normally be new payer, which would always cause my heart to sink a little bit.

But this one stood out from the very beginning for all the reasons Chris has already said.

There was a bonus structure.

I mean, the guy had literally already loaded in all the money for a whole series of things that had to happen to Jennifer,

which were all about the use of drugs and they were all about control.

And it stood out for that.

It stood out actually weirdly and grotesquely because it wasn't about a murder, which somehow made it worse.

But then it also stood out because of the amount of money, a huge amount of money had been had been paid.

It was the largest payment.

So we reach out

and get hold of Jennifer and speak to her and realize that she's in the middle of

a kind of

relationship which is leaving, which

involves Ron, who's very dangerously spiraling out of control.

He seemed to have some extremely

kind of worrying behaviours to do with control.

He'd probably been tracking her.

He'd been kind of allegedly

putting drugs into her drink.

There was another woman in the marriage that he'd kept in a septic tank under his house.

It was horrifying.

I think the septic tank was more of a kind of a,

I don't think it was a Hannibal Elector situation per se.

It was more of a temporary BDSM handle.

Well, I mean, he dressed the whole thing up as BDSM.

He dressed all of this controlling behavior up as, hey, this is just my kink.

Yeah, I mean, the woman wasn't in there the whole time.

It was part of a.

He had a dungeon, I believe, in his house.

And it was just all coming together as a man who was

really, really, really committed to controlling the women he was in a relationship with and didn't seem to be able to deal with his wife leaving.

And this was the kind of

first time the kind of FBI really kind of moved in

and kind of we could see an investigation kind of rolling out.

So Ron left for Mexico on the day that Jennifer was to be kidnapped.

Possibly as an alibi, who knows?

And when he returned, there were 10 FBI agents waiting for him in the airport undercover.

So he lands, he's immediately interviewed.

His house is being searched at the same time.

And he makes

quite a serious error.

In a thumbprint safe in his house, a safe that only he could access, there is a sticky note, and on that sticky note is both his username and the uh password for the site that Chris has been surveilling.

Okay, and the police are able to get in the safe and see that they do, they drive him to his own house, uh, and he opens a safe for them.

Yeah, um, and then so what happens to him?

Well, uh, he's um

released by the police that night.

He makes a suicide attempt, quite a serious one, as I understand it, I think that night or the next day,

and is then placed under protective.

Well, he's placed under custody and then arrested when he...

I just want to say that really upset me that he tried to kill himself.

I got into this and stopped people being murdered.

And even if horrible kill of people try and kill themselves over this, this is not what I want.

I want to make the world a better place and it's not always clear whether I'm achieving that.

Though ultimately, in this case, I think I did.

But Ron is not confessing to anything.

He's pleading innocent and is working tirelessly to try to make a case to free him.

It's a long story, and we don't have time to go into it all.

But he's now convicted and sentenced and is in prison for a pretty significant stretch.

Think of it eight years.

And it's wins like this where they can get a dangerous person put in prison that makes it all seem worthwhile.

The kill list, this whole experience has been a very difficult one.

It's had some very bleak, very dark moments, but it's also got those moments of feeling like it's really meaningful and worthwhile.

And the sentencing and conviction of Ron and Jennifer's kind of emergence from that has definitely been, for me anyway, one of those.

So it was 2020 when they started taking action on these kill orders and they've been documenting it all along.

And there's just so many cases that they researched.

I still feel it doesn't it barely scratches the surface earlier why I have it really does

the

this this current situation what's happening now with the site is it still operational or has it been shut down by the police or what there were a series of arrests in Romania which behind of the site operators or at least people affiliated with them I believe I believe the US authorities had something to do with that and following following that incident of the Romania arrests the website had underwent underwent technical changes.

It was shut down for a bit, came back again.

I intermittently lost bits of access until we reached a point now where I have almost no access.

And so I find no new cases come in for the last year and a bit.

But in that period,

we have seen basically arrests from the website.

in the US and Switzerland and Austria.

So we have evidence that some law enforcement agency other

is either cooperating with or has infiltrated the website and is making some arrests.

Of the people who run the website.

No, people are using the website.

The website continues to operate and, for all I know, continues to scam people up money and continues to enrich Romanian scammers.

You talked to the admin of the site

over chat.

What is the reason why they run this or do this?

He's just a scammer.

I believe he used to be a Carder, someone who deals with stolen financial data and whatnot, and was familiar with darknet scams.

And he told me that he saw a niche for doing believable darknet scams.

He didn't tell me, he told a persona I was interpreting, it was,

had it taken over at the time.

But yeah, he just thought there was a niche for a believable, effective darknet murder scam to be lucrative.

And he's not wrong.

There are some other sites out there doing this, but I believe he's the most successful financially, the most

search engine optimized, has the highest traffic, the highest number of users.

And considering he's been at this since 2016 and dealing with money in Bitcoin, he will be a multi-millionaire

by now.

And, you know, here's me going along, you know, basically with like legal fees and doing this in my evenings and the like It's not really

You know, it's it's it's it's been hard to keep hard to keep it up, but yeah, it's still still it's still going on

And you know people say oh, but you know, what if you get him?

Well if you get him won't it be over?

I'm like no it won't be over because I'm on the I've been on the website for years.

They delete the messages as they go along So you seize the website, you don't get years back of messages, you get very little.

I'm the only one of the years worth of messages.

So unfortunately,

there's going to be no end to it in terms of the website getting shut down.

For me, this is only over when I've actioned the remainder of the kill list.

The way that dark web websites work is that they're designed to be private.

Like you can't tell where the website is hosted or where it is in the world.

So you really need to wait for the website administrator to screw up and reveal something about themselves in order to take the thing down.

So this whole time, the only thing they can do is just keep blogging and podcasting and publishing articles about the site being a scam.

But there was no way for them or even the police to take this website down since they don't have enough information to know who's running it or where it's hosted.

Well, I think the story profoundly changed the lives of all of the people that were involved, like me, Chris, Caroline, you know, everyone it kind of it did everything i mean it it it was and is like the most for me anyway the most by far the kind of most important meaningful worrying sometimes isolated and uh disgustingly urgent work that i've ever found myself um having to do um and it started a thing back then in 2020, which is, you know, is still going now.

Like people are still going going through court cases.

People are still in danger.

It's the most important thing I'll ever work on, I'm sure.

And I really, really hope, actually, that I don't have to do anything like this ever again.

Chris has lost access to the private messages on the site in 2023, which means they haven't seen any new kill orders come in since then, which for Carl at least means he's stepped away from investigating more cases.

But Chris still feels there's old kill orders that are still worth looking into.

So he continues to make it his duty to investigate every single person who's on the list.

Again, I don't think people believe that I'm still doing this by myself.

They've rather believed some comforting truth that no one uses these websites or it's all in hand and nothing can be done.

But that's not the case at all.

There are people being murdered on the list right now who I haven't got to in time.

You know, there's probably dozens of people on the list who are dead.

And of those, half of them I could have saved.

And

I feel like people need to know this.

And

I don't know.

I would like some support in this, but

it's a difficult position I'm still in.

To date, they have seen over 900 people show up on the kill list.

And they've taken action on hundreds of them.

And for the most part, Chris does it alone now.

He sometimes hires private investigators to help him, but that's expensive.

And since his work leads to more arrests than if the police simply handled it by themselves, it uniquely positions him to do good in the world.

And he's a bit disappointed that there aren't more journalists or police that are taking him seriously, that want to work with him to help him.

But since he knows lives are at stake here and he has all kinds of information on them, he can't simply ignore it and walk away.

To follow the latest on what Chris is doing, you can visit his website, which is pirate.london.

And I should probably tell you something.

In my research for this episode, I have discovered that every single Hitman for Hire website on the internet has been fake.

Most are operated by scammers.

Some are operated by the police.

But what's more is that hitmen in general are pretty much a myth.

One of the things I did to prep for this episode was to watch the movie Hitman by Richard Linkletter.

It's based off a true story of a fake hitman.

And even in the movie, they say hitmen aren't real.

Take a listen.

You know, people feel almost disappointed to learn that hitmen don't really exist.

This idea that there are people out there at a retail level you can just hire to eliminate your worst relationship issues or facilitate some money scheme or the usual combination of both.

It's a total pop culture fantasy, but because hitmen have been a staple of books, movies, and TV for the last 50 years, good luck getting anyone to believe their existence is all a myth.

Hollywood really has planted this idea in our head that seems impossible for us to undo.

So I urge you to be skeptical of any such idea.

But I also want to say that if your relationship with someone has gotten so bad that you want them killed, you need to get out of there.

You're not acting like you, you know?

That's your emotions that have taken over.

And you won't be happy with yourself until you find peace.

You need to find yourself again.

Killing someone isn't going to give you the peace you think it will.

You need to remember what makes you happy and seek that instead of violence.

It's sometimes hard to see the light at the end of a tunnel during bad relationships or big breakups, but the future is so much brighter than you realize.

Don't let them turn you into a monster.

You're not a monster.

Dig deep and find the strength to rise above it and be that amazing person that you actually are.

A big thank you to Chris Montero and Carl Miller for sharing this incredible story with us.

I highly urge you to go find and listen to their podcast kill list.

The phone calls with the victims are incredible.

There's one lady that they call up and they tell her, hey, your life might be in danger.

And she just laughs and she's like, oh, it's probably my husband, but don't worry, he'd never harm me.

And it's just wild to hear how these people react to such news.

So go check out the show wherever you listen to podcasts and also keep up to date with what Chris is doing by visiting his blog.

Pirate.london is the website.

And hey, if you want to listen to this show, ad-free,

or if you want bonus episodes, I've got 11 bonus episodes now available for you to listen to right now.

All you got to do is go to plus.darknetdiaries.com.

That's plus.darknetdiaries.com.

This episode is created by me, the neon specter, Jackry Sider.

Our editor is the glitch guy, Tristan Ledger.

Sound design by the executable Andrew Merriweather, mixing by Proximity Sound.

Our intro music is by the mysterious Breakmaster Cylinder.

My computer is so broke, it ran out of cash.

This is Darknet Diaries.