Hitman for hire: How the dark web contract-killer site BesaMafia was exposed by a hacker

If you believe the rumours, the dark web is full of nefarious websites that sell everything from drugs to weapons to government leaks. However, one of the most persistent legends of the underground internet is the existence of legitimate hitmen-for-hire services.

Now, for the first time, this murky underworld of requests for murder, beatings and assassinations has been exposed for the world to see after a hacker known as 'bRpsd' breached the website of the notorious 'BesaMafia' website and leaked its contents online.

The data dump, which has been viewed by IBTimes UK, contains user accounts, personal messages, so-called hit orders and a folder marked 'victims' that contains nearly 200 images. The leak, uploaded in three separate archives, also holds email addresses, hashed passwords, usernames and user IDs belonging to over 300 registered accounts. Two of the leaked files, in .CSV format, contains 38 hit orders and nearly 3,000 personal messages sent between budding customers and the website's administrators.

While the website's legitimacy is up for debate, the existence of the Albian Mafia is not. Currently operating across the globe – including Albania, the US, UK and a number of EU countries. The group is said to conduct a range of illegal activities including the trade of weapons, drugs and even human trafficking. The mafia uses the term 'Besa' which roughly translates to 'trust'.

On the dark web, the group is generally considered to be one of the more viable hitmen-for-hire operations and many people claim to have used its many 'services'. Visiting the website BesaMafia, using the anonymous Tor browser, you will find a rudimentary layout and the full range of 'services' offered by the group.

The website states: If you want to kill someone, or to beat the sh*t out of him, we are the right guys. We have professional hitmen available through the entire USA, Canada and Europe and you can hire a contract killer easily. Most of our gang members are drug dealers but they do contracted killing when they are short on cash."

The dark web-based gang claims that prices for murder start at $5,000. "If you need ex-military trained hitmen with a sniper rifle on buildings, they are available from $30 000," it states.

Strangely, the hacker responsible never fully publicised his breach – and while the hack reportedly took place last month, it only came to light after being reported by Risk Based Security (RBS). "While such breaches may happen frequently, they rarely see the light of day," RBS stated in a blog post.

Murder for hire

Upon analysis, IBTimes UK found the trove of leaked data contains a number of interesting messages between the website admins and wannabe hitmen, a slew of people requesting murder-for-hire and even refund requests – showing that even underground hard-men have to occasionally do paperwork.

While it remains difficult to verify the legitimacy – or the seriousness – of the customer requests, many are specific, gory and show intent to cause harm in the real-world.

One customer wrote: "Beat him up badly so there will be bruises and some blood but, don't do anything else. Target is about 173 centimetre tall and fat, but can fight back fiercely so use surprise attack before he can react. Target usually takes a walk during night or late evening."

Another said: "Man who you are supposed to kill is about 172 centimetre tall, little muscular and he is 28 years old. He lives alone and home address is [redacted]. Mostly is with a woman or playing games in his home. Goes out probably around 3pm-8pm when woman gets back home from the work. They probably also meet during weekends so it might be best chance to kill the man when he's with a woman. Don't harm the woman if possible."

Another to the point request stated: "I want her dead. That is the 13 bitcoins, if it can look like an accident then you can have the rest."

The documents reveal that, if true, Besa has a unique method of testing wannabe hitmen applications by forcing them to perform a criminal 'task' on camera. As noted by RBS, one task includes stealing a car, setting it on fire and showing a personal message to the website's admins.

One similar video was since found uploaded to YouTube:

However, the leaked dataset reveals evidence the website is a scam set up to catch criminals or members of the public who are plotting murder. In one correspondence that appears to be between one admin and an FBI agent, it is confessed the website is a honeypot-style operation.

"We are a team of computer programmers living in Europe, and we made this website as a honey pot for criminals, to fight crime and criminals," the message stated. "We receive orders to kill people from all over the world, however our site is fake and we don't have any hitmen. We forward the orders to police departments where the targets are located. [redacted]@gmail.com is one of our emails on google, we use it to send notifications of hit orders to police."

Another message that appeared to be from an FBI contact said: "Have [redacted] contact us regarding information relating to a possible hit on an individual in Watauga, Tx. We have information that was forwarded to us by the Irving, Tx police department. Can you provide us with the customer's intent, his contact information as well as his validity in meeting your fake hitmen."

Nevertheless, the legend of this underground website is likely to persist. Indeed, following the data breach, the debate has raged over whether or not the service is a scam. "Besa Mafia is real mafia and real hitmen. I used them to beat someone up and they did a very good job," said one user – who should probably delete their internet history, pronto.