Feds: NJ Man Attempted to Hire a Hitman on the Darkweb
In a statement from the U.S. Attorney’s Office in New Jersey, prosecutors accused John Michael Musbach, 31, of hiring a hitman in an attempt to kill one of his teenage victims. According to the statement, Musbach found and contacted a site advertising murder for hire on the darkweb. He paid the site administrator $40,000 in Bitcoin to carry out the hit.
Musbach, in 2015, developed an online relationship with a then 13-year-old. Investigators learned that Musbach and the 13-year-old had exchanged sexually explicit videos and photographs of themselves. In March 2016, Atlantic City police officers arrested Musbach on child pornography charges. In late 2017, Musbach pleaded guilty to endangering the welfare of a child by sexual contact. He received a two-year prison sentence and a lifetime on parole.
In January 2019, Homeland Security Investigations (HSI) in Newark, New Jersey, received information from a source about an onion service that advertised contract killings. Although law enforcement did not include the name of the website in the court documents, many readers will recognize the site after reading the advertisement on the site’s homepage:
“If you want to kill someone, or to beat the shit out of him, we are the right guys. We have professional hitmen available throughout the entire USA, Canada, and Europe and you can hire a contract killer easily. Most of our gang members are drug dealers but they do contract killing when they are short on cash. No undercover cops here. No risks of getting caught, because we are professional killers: We don’t ask you for your name, we don’t want to know who you are or where you live… You pay in Bitcoin to escrow, and money is held in escrow until the job is done.”
A screenshot of the Besa Mafia Homepage
Besa Mafia is the site Musbach allegedly used to hire a hitman. Besa Mafia was one of the many fraudulent murder for hire sites operated by a fraudster known as “Yura.” Besa Mafia is no longer active but Yura has no shortage of nearly identical sites that advertise the same services.
HSI’s source provided investigators with some of the private conversations between the administrators of Besa Mafia and the site’s customers. The source—someone with experience providing law enforcement with information about Yura’s customers—had hacked the site and scraped private conversations. Included in the scrape was a conversation between the site’s administrator and an individual using the username “agentsai.” HSI later identified “agentsai as Musbach. The majority of the conversation provided by law enforcement is available below:
| Sender | Message |
|---|---|
| agentisai | Hey there, I am in south NJ and need a handgun with ammo because I lack the ability to obtain one myself legally. How would getting this work and how much would it cost? |
| agentisai | Alternatively to a gun order, I could place a hit order. However, the target would be 14.3 Is that an acceptable age or too young? I can budget up to $20k for the order. |
| Admin | Hello, Yes, 14 years old is acceptable. We have gang members to do the hit; however the price is about 18500. This should be in your budget, please add order using the order page and add 40 bitcoin to your account. The bitcoin will remain into your account until the job is done. Let me know. |
| agentisai | Ok will do thanks. I got half of it in my wallet now: But my Coinbase purchase limit is $10,000 so I have to wait until tomorrow to finish. Will let you know once that’s done |
| Admin | Hello, Ok. Please notice that all incoming bitcoins to our customer wallets are mixed through our bitcoin mixer; because of this you might notice a short delay of a few minutes up to a few hours for the bitcoin to show up in your account balance. let me know when done |
| agentsai | Hello I have transferred the remaining btc to the wallet. Once the balance shows up here, I will place an order with all the details. |
| admin | Hello, We received your new order information. Please add Bitcoin to your personal Wallet on your account and we will assign a hitman to your job. If you have any questions or need any information please reply to this message. Please login daily to your account on [WEBSITE], to view replies. from us and updates on your job, Looking forward to hear from you. Yura CyberTeam admin . . . |
| admin | Hello, Ok. The bitcoin should be visible in your wallet shortly. please place your order and let me know |
| agentsai | Hello, A little worried I haven’t heard anything. There’s three days left. Please keep me posted on how things are going and do the job within he next three days. If it’s not possible, please let me know and I will withdraw the bitcoin. Thanks. |
| admin | Hello, Yes, the day has been picked. The hitman is there to do the job, I will keep you posted soon |
| agentisai | Great, sounds good thanks. I look forward to the update. |
| admin | Hi,There is a small problem; the assigned hitman got arrested for cocaine possession while he was near the place. We have an other hitman ready to do the hit, but he saith this is an important person and he asks for an difference of $5000 Can you get the difference exchanged to bitcoin and deposited to your account, for the new hitman to do your job? He is better than the one who got arrested for cocaine; he can do it tomorrow on 20 05. If not, as soon as the assigned hitman is out, he will do the job. He won’t be long, as his cocaine possession was not a large quantity let me know |
| agentsai | Hello, Bummer. :( I can get the $5,000 extra but there is a $1,000 daily bank account purchase limit. Can the other guy do the hit tomorrow, I will give him the 40.64 BTC then and follow it up with the remainder once I get it transferred? I can provide a screenshot of the money in the bank account if need be. |
| agentsai | Hello, Actually, I can do the same thing I did previously which is wire money to coinbase tomorrow and then on Monday I will be able to convert the extra $5,000 and transfer it to here. Would the hitman be willing to perform the hit tomorrow for the 40.64 and remainder on Monday? Again, I can provide a screenshot of the account balance if need be, But that’s as fast as I can get the extra money I’m afraid. Thanks. |
| admin | I asked the hitman, he saith he can do the job once I confirm the amount is in your personal balance; he is afraid that you might not send the additional bitcoin after the hit is done, and since you are anonymous, he could not be able to track you down to get it. Maybe you can cash the money out and exchange bitcoin for cash; on sites like localbitcoins.com ? There are many traders who can trade bitcoin for cash Let me know |
| agentsai | Hello, I’m afraid I cannot find any source of bitcoin this short notice. I have checked localbitcoins.com, and while there are people who will sell there, they are all offline for the day. I also found a potential website that may give me a quick turn around on the coins, but they too are closed for the day. I think that up to this point I have been very honest and shown that I do have the money I say I do and deposit it as soon as I can. However, Bitcoin is a bit difficult to obtain and transfer short notice. I’d really like for this transaction to end on a positive note, and I have a vested interest in this being a success. To that end, Icompletely intend to do all I can to ensure I have the $5,000 in bitcoin >by end of Monday if not tomorrow. However, given the variables at play I cannot guarantee that I will have the Bitcoin by tomorrow despite my best efforts. I understand the concern of me not paying, although that is absolutely not my intention. When I originally came here, my first inquiry was for a gun which would’ve involved some sort of personal information being provided I imagine. As such, to complete the job tomorrow, as collateral would it be acceptable for me to provide my name and address so that were I to walk off with the money I could be tracked and/or hit myself? I absolutely will do everything to get the $5,000 by end of Monday. But I’d still like this job to be completed within the timeframe originally agreed on. As such, can you please let me know if the collateral previously mentioned will be acceptable in return for the job being completed tomorrow? If it is not, I suppose I will cancel the job and withdraw what bitcoin is currently here. But, I’d much rather have the job done and everyone paid and happy just as soon as is possible. Thanks and sorry for the long reply |
| agentisai | Hello, I may be able to get the bitcoin afterall in time for the hit tomorrow afternoon. Is there a cutoff? Thanks |
| agentisai | Hello, Sorry, last update…My localbitcoins.com contact fell through. Will my suggestion of providing name and address as collateral while I get bitcoin via coinbase by end of Monday work in exchange for the hit taking place today (Friday) or should we just cancel this hit and I’ll withdraw the 40.64 bitcoin? Thanks. |
| agentisai | Hello, I’m afraid that this won’t work out given the circumstances. I’ve tried submitting the withdraw form but haven’t seen anything specific happen. Can you please cancel the hit and send the 40.64 BTC to 1D1tDDFtbhqeYqVXaaxxUSjqmHenTBZdbU? Thanks |
| admin | Hello, You sent a lot of messages in a short time, and we are going through several improvements and updates on the website, this is why the withdraw option was not working. It will be working soon, when we finish the update. Regarding cancelation, sure, we can cancel and send you the bitcoins. However, if you have a other date when our hitman can do the hit, we would be happy to do it, even if the kid travels to a different location we can assign a different hitman there, to find him Let me know |
| agentsai | Hello, Sorry things didn’t work out. Thanks for the offer of trying some other time but I think I’m done for now. Please send the 40.64 BTC to 1D1tDDFtbhqeYqVXaaxxUSjqmHenTBZdbU. Thanks |
| admin | Hi, I am sorry to disappoint you. Unfortunattely, our site is a scam, and we pass customer and target information to law enforcement. We are able to dox the customers ( find out who they are ) by expert IP and proxy analisis and as our site uses javascript to extract personal information from the user computer. The 40 Bitcoins are lost, if you want to avoid us give your info and target info to law enforcement, please send us 20 Bitcoin – 10 000$ to the same address as before. Once we receive the additional money, we will delete your account, all messages, and all information about you and the target. If you don’t send the additional money, we will send all information to law enforcement and you might be arrested, ordering murder and paying for murder can get you in jail for a long time please do not post anything about us blackmailing you anywhere, if you do, we will immediately send your information to law enforcement. let me know |
| agentsai | Hello, Is this a joke? Please just send my BTC back. Thanks. |
| admin | No, this is not a joke. The [WEBSITE] has been hacked. We the hackers have full control over it, we infected it with malware and javascript and extracted everything from your computer. We have proofs that you ordered the murder, who you are, who the target is, and proof that you paid for it, you will be arrested unless you send us 22 bitcoin to this address 15guigVQg1SnZW2stqnK5cazTbU4aZLKo3 You have 4 days to do it, or you info is to police and you get 10 years in jail just search youtube for hiring hitmen arrested to see people arrested for hiring hitmen. |
| agentisai | Hello, Can you please provide me with the information you have on who I am? Thanks. |
| agentisai | Hello, I am a little confused as to where any javascript or malware comes into play here. When looking at the dev console, I see absolutely no requests for anything besides images. Again, if you can provide the information you have on me I’d be glad to pay you the BTC you are asking for. |
| admin | Hello, We will not provide any information to you, because we don’t know if you are the customer or not. The site suffered multiple hacking attempts, and you might not be the customer, you might be someone else logged in as him. If you are the customer, you will have to gamble on this. Either be safe, send us 22 bitcoin and we delete your account and everything, or you can gamble and let us send the info to the cops, including your details, the target, and the blockchain transactions this should be enough to get you arrested and in jail |
| admin | I am not going to go into specific details with you or technical things. It will be your call. Risk it or play it safe. Hope you purchased your bitcoins with case. The transactions on blockchain can be traced back to your original account as well, that has your full name and info on it. That along, with all your info on there, with the bitcoin transactions, and with the info here on [WEBSITE] and target info can get you arrested If the kid is a child of some influent person, you will be in jail long time Just sent the money and we delete all account and everything Let me know |
After receiving information from the source, HSI subpoenaed Coinbase for information on the Bitcoin address 1BMN3CuwtJHfcdNCG2z5iL72RwU18aZadC. The address was associated with an account belonging to a Coinbase user under the name John Musbach. The information provided by Coinbase indicated that Musbach had sent 40.64 bitcoins to the Bitcoin address listed above.
HSI executed a warrant at Musbach’s house and found evidence linking Musbach to the “agentsai” username:
- An invoice for Icloud service provided by MUSBACH’s former employer addressed to John Musbach at johnmusbach1@gmail.com, which listed several user accounts, including “johnmusbach,” “johnmusbach1,” “agentisai,” “agent_isai,” and “is-ai;”
- Numerous google searches for “agent_isai irc;”
- Twitter searches for “Agent_Isai;”
- Facebook searches for “Isainode."
They also found evidence that Musbach had searched for a variety of phrases related to his court case in 2015 and 2016. Some of the phrases are included below:
- Child grooming law
- Child grooming NYS
- How are you notified of an indictment
- Do gun shows take credit cards
- sex offender search
- Not guilty by reason of insanity
- Death by chloroform
- Where to buy chloroform
- Chemical that passes you out
- Nj gun shows
- Nys restraining order
- Get information on investigations
- Is it legal to buy a gun
- Is calcium chloride toxic
- Pa gun show
- Death by caffeine
- Poisonous hemlock
- Poisonous plant
- Kill all jews
- Full erase MacBook
- Fluoride poisoning
- 1 BTC to USD
- Coinbase
- Lookup a restraining order
- NYS are you notified of a restraining order against you
- How to buy a gun in NJ
- KKK website
- Settings_clear_browsing_data
It is not entirely clear why HSI Special Agent George Lance Herbert chose to include “KKK website” and “kill all Jews” to the list of search terms listed in the criminal complaint.
If convicted of murder-for-hire, Musbach faces up to ten years in prison, according to the U.S. Department of Justice website.