Researcher Exposes Dark-Web Hitman Scam and Tracks Threats to Victims

Summary

Chris Monteiro exploited an access-control flaw on the Besa Mafia scam site, exposing messages about paid murder orders. He and journalist Carl Miller shared information with police and sought to warn people named in the orders.

Key points

• Monteiro identified Besa Mafia as a fraudulent hitman-for-hire site and said its administrator, Yura, sought to intimidate him after he exposed the scam.
• Changing message IDs in a URL let Monteiro read other users’ private messages. He scripted the collection of messages and later accessed administrative pages.
• The messages included identifying details of people targeted in apparent murder orders and records of payments. Monteiro shared a prioritized list of cases with the National Crime Agency.
• Stephen Allwine was convicted of murdering his wife, Amy, after paying the site to have her killed. The speakers criticized how authorities handled the earlier warning.
• Monteiro and Miller tried to warn people named in orders and work with police. After phone calls often failed, they enlisted local journalists to make contact.
• Monteiro said he lost access to private messages in 2023. He said the site continued to operate and that he was still investigating older orders.

People