Researching Hitman Scams on the Dark Web

Earlier this year, the European Union police agency Europol, working alongside Italian police, arrested a man suspected of hiring a killer on the dark web. The suspect allegedly paid roughly $10,000 worth of Bitcoin to have his ex-girlfriend killed. Authorities quickly traced the transaction, found the provider where he had purchased the cryptocurrency, and ultimately identified the suspect. The suspect’s ex-girlfriend remained unharmed. 

Although most murder-for-hire sites on the dark web are likely scams, people keep trying to solicit contract killers. “Despite frequent media reports of arrests, the number of ads for hitman services on the dark web has stayed relatively constant,”  said Thomas J. Holt, a Director and Professor in the School of Criminal Justice at Michigan State University. 

Holt, whose research focuses on hacking, malware, and other cyber crimes, co-authored a research paper looking into about two dozen of these adverts between 2018 and 2019. Since then, he says there hasn't been a noticeable change in the number of hitman adverts on the dark web. "Some of the sites themselves are up and down anyway, just as you might expect with the dark web […] but nothing today would suggest there's been a wholesale closure of these markets."

As the researchers collected ads from open web forums, shops, crypto markets, and the dark web, it quickly became clear that most of them must be fake. "You'd find these hitmen advertisements, mostly as shops, or occasionally in crypto markets, but they overwhelmingly just seemed like they can't be real," Holt  said. "If I were a scammer or a criminal, this seems like excellent passive income, where you put the ad out, and even if only one person pays you every three months, you could be making $2,000 to $10,000, depending on how much you charge to do nothing."

“The most surprising finding during the research was that the pricing of the dark web sites reflected real-world prices for contracted violence,” Holt said. "The little bit of [available] research tells us that most contracted violence occurs, because someone obliquely knows a person who has been to prison or has some type of military training, or ties to crime in some way, shape, or form, and that that relationship enables the person to pay them to engage in violence.And admittedly, it's usually not a lot of money."

The scammers would usually use language suggesting that they have ties to the mafia, criminal backgrounds, or prior military experience. The ads wouldn't go into much detail but often draw the line at hurting kids or animals. "Beyond that, [the scammers say] they'll do whatever you pay them to do. So that kind of fits with what little is known about real-world violence." The researchers didn't look into how many people solicited services through these ads, but this could be done by looking at the cryptocurrency wallets associated with a shop or website,” Holt said.  Similar  to how Europol investigated the case in Italy. 

“Another useful starting point for investigations can be email addresses or other contact information,”   Holt said. "Those are easy points of connection for further analysis to use any little anecdotal information or artifacts within an ad for additional research." 

In one instance, an email address from one of the adverts was also found on a popular hacker forum, which raised an interesting question. "If we want to believe that these are legitimate hitmen, is it a hitman who's also a hacker? But more than likely, the easiest answer is, it's probably a hacker running a side gig to make some money," Holt said.

Most of the sites appear to be geared towards Western audiences and use the English language. "The vendors will say things like 'Our network of hitmen across Europe and North America,” Holt said. ,   "When we compare that against what we found for dark web sale items, for passports, for guns, and for identity documents, there's much more concentration on the dark web for European and broadly speaking North American audiences, compared to the open web where you'll find any country that you can think of." 

What surprised Holt during his research was that some advertisers also indicated they sought to hire hitmen and asked for applications. "So if you wanted to share a video of yourself using firearms, or you know, anything, that would be a demonstration of your capacities, then you needed to send it to them, basically applying for a position with them,"   Holt said. "That to me was really fascinating because it begs the question, if we assume that all of these are scams from the start, what would an individual running the site do with the person's contact information and whatever material they send to them? Is that a point of potential blackmail? [...] Or is it really just a point of humor for the individual running the site, just a gag that they can look at from time to time and laugh at?" 

In most cases involving (pretend) assassins hired on the dark web, the clients end up being the ones arrested. Holt suggested this could be because it is simply easier to prosecute them. Another reason could be the vendors or scammers are based in a different jurisdiction. 

"From a criminal intent standpoint, it seems far easier to arrest the potential customer because they are overtly seeking a service to do harm to another person,"  Holt said. He  further added, “  The payment would also suggest a clear intention to cause another person harm.”In 2016, a case involving the scammers behind a fake hitman service reportedly admitted in private messages that they were passing on tips to police, hoping to get a lesser charge if arrested.

"We receive orders to kill people from all over the world; however, our site is fake, and we don't have any hitmen. We forward the orders to police departments where the targets are located," one of the messages read. Scammers alerting the police may result in the overall benefit that the crime has not taken place and the intention of the customer can be used to support a criminal charge, such as conspiracy to commit murder. However, there is a very real risk that scams of this nature actually result in increased levels of contracted violent attacks by inciting violence through the continued presence of hitman adverts online that suggests to potential customers that this activity is commonplace.

The research conducted by Holt suggests that hitmen based scams on the dark web are a consistently profitable enterprise, one that appears to be going nowhere any time soon. The advertised services demonstrate detail sufficiently similar to contracted violence in the real world, suggesting this is a well-researched scam that can fool the intended mark. Murder-for-hire scams, however, are distinct from the majority of online scams in that the victims themselves are also criminals. Whilst innocent victims of scams can pursue compensation as the victims of crime, hitmen scammers can avoid the risk of paying out compensation to victims when caught. By offering illegal services, hitman scammers ensure that their victims have no legal avenues to reclaim their payments, whilst also capturing evidence of criminality that can be used as leverage if they are ever caught by law enforcement.

The general public can take solace from Holt’s research from the fact that the majority of hitmen services offered on the dark web appear to be scams. Individuals attempting to contract violence through these digital services are far more likely to end up out of pocket financially and at risk of blackmail or imprisonment than they are finding an actual hitman online.