Nevada Woman Allegedly Tried to Hire a Hitman on the Darkweb

A woman from Fallon, Nevada, allegedly tried to hire a hitman on the darkweb to kill her ex-husband.

A jury indicted Kristy Lynn Felkins, 36, of Fallon, Nevada, for a single count of Using Interstate Commerce Facilities in the Commission of Murder-for-Hire. Court documents indicate that Felkins had attempted to hire a hitman through a darkweb murder-for-hire site. As many readers of this site will know, all documented onion services offering murder-for-hire services are scams. A single fraudster known as “Yura” controls many of the sites, including Besa Mafia, Crimebay, Cosa Nostra International Network, and Camorra Hitmen.

Court documents include the details of Felkins’ plot to have her ex-husband murdered. A source provided federal investigators with copies of messages between Felkins and the administrator of the fraudulent murder-for-hire site. The source in this case is known to law enforcement and many researchers; information provided by the source has been used in dozens of similar murder-for-hire cases involving one of Yura’s websites. Here is how Homeland Security Investigations (HSI) Special Agent Aron Mann, a member of the Northern California Illicit Digital Economy Task Force (NICDE), described the informant in the criminal complaint:

In or about January 2019, an individual not acting on behalf of the government (referred to herein as the “CS-1”) provided information to federal law enforcement agents pertaining to a murder-for-hire website which operated on the dark web (referred to herein as “WEBSITE-1”). Between in or about August 2018 and October 2018, CS-1 used a program to scrape from WEBSITE-1 messages between the site’s administrator (“ADMIN”) and its users. CS-1 was also able to identify the Bitcoin addresses associated with the payments made for acts of violence. In early 2019, CS-1 provided law enforcement with the contents of these scrapes of WEBSITE-1 and continues to provide information about WEBSITE-1. CS-1 provided this information to law enforcement without any promise of pecuniary gain or judicial consideration for any pending criminal case in the United States. Law enforcement has found the information provided by CS-1 to be reliable and has corroborated this information.

Investigators learned that an individual using the moniker “KBGMKN” had attempted to hire a hitman through the undisclosed murder-for-hire websites. We know the site was one of the sites created by Yura since the informant has historically provided law enforcement with information from Yura’s other sites. Yura’s sites have regularly been nearly identical copies of his previous sites, rendering all of them vulnerable to the same exploit used by the feds’ source.

The user KBGMKN registered with the now-defunct murder-for-hire site using the email address “ejggb133@sigaint.com.” Investigators later learned that the names of Felkins’ children, in order of birth, are Eme[redacted] Jay[redacted], and Geo[redacted]. “Thus spelling out ’ejg’,” Special Agent Mann wrote.

Yura’s sites regularly get hacked and the customer information surfaces in dumps online. At least one dump includes Felkins’ Sigaint email address. One of the dumps that includes Felkins’ email address is explicitly identified as a dump of the onion service with the address oiiuv2gwl2jhvg3j.onion. That address was associated with the now-defunct Besa Mafia hitman site.

The administrator of the murder-for-hire site and KBGMKN started discussing the hit in February 2016. KBGMKN initially showed concern about the legitimacy of the site. In one message, she wrote:

I have found many posts, some on reddit for example, that state all hit man for hire sites are scams. Some poke fun at this specific site…. Also, the [WEBSITE-1] articles really just make you look desperate ….weather it your posts or not.

Any true group fighting such a thing would not include the website address. If we use a third party escrow how do I know you won’t claim to have completed services when you really haven’t. I can deny releasing funds but you can still claim they are owed…meaning a third party must then be involved…..

How do I know you are not FBI, they do have the capability to infect ones device and trace them back to their real IP.

Just being cautious

Yura, as always, had an explanation for the negative reviews for his services:

the post on reddit saying all hitmen sites are scams, is from undercover cop [] the [WEBSITE-1] articles are not posted by us. we do not have time to post articles [] anyway, if you don’t like doing it online, you can always go in the gangs on your streets and hire a hitmen there.

we don’t force anyone using our services, we could not, and we do not want to[] You can even buy some cheap laptop just for this job, or declare that your laptop has been stolen, paste some duct tape on your laptop camera if you are afraid of someone hacking into your laptop, use some public wifi, and if ever caught you can say someone stole your laptop and used it to order the murder of someone you know, to frame you and to do you harm.

KBGMKN sent the administrator roughly $5,000 in Bitcoin, the home address of the victim, vehicle information, and locations at which he could be located.

In early March, the user and the administrator of the site exchanged dozens of messages about the logistics of the hit. On March 9, Yura told KBGMKN that he had arranged the hit:

Ok, we are all set.

The job will be done on monday morning; please let us know if he goes to work with any other person in the car, that you don’t want hurt, you need to tell us.

Our man will wait him at the address of work, and when seeing him will shot him as soon as he gets down from the car; but if he is not alone bullets can hurt the other person as well.

Our person will shot several times in chest and head and run; if there is someone important with him that does not need to be hurt please let us know, so the shooter is careful to hit only him Take care

On March 16, 2016, KBGMKN asks about the status of the hit. The admin states that “the hitman is in position [] he was unable to do the shooting yesterday because he didn’t saw the target.” The next day, KBGMKN provided the hitman with the victim’s home address.

Investigators identified the victim using the information provided by KBGMKN.

More time passes without the hit taking place. Yura provides endless excuses for the multiple failures. KBGMKN does not see through his act.

On March 20, 2016, the admin told the customer that “the hit will require a sniper because VICTIM-1 has not been seen alone and the hitman doesn’t want to leave witnesses behind.” The admin requests an additional $4,000 from KBGMKN to cover the cost of a sniper. KBGMKN wrote that she could not afford to spend $9,000 on the hit. In a later message, the admin tells KBGMKN that the hitman had failed yet again and asked for “the reason for the murder.”

KBGMKN responds:

I do stand to get money from this but that isn’t the reason behind my motivation…. This man mentally, physically, sexually and emotionally abused me. I ran, and then he took my children away from me. He now mentally abuses my children and threatens their physical well being. He is quite the snake and master manipulater…..

I know I can get the 4000 in 4-5 weeks. And right now the children are visiting grandparents so they aren’t at risk of witnessing or possibly being involved. They are safe and comfortable. My family and friends are not people to have a lot of money, and I have already borrowed from them all they can give trying to settle things with him legally with lawyers.

The money I have already sent to you was the last I had to pay the lawyers for the next battle we are up against My bank accounts are bare from running, relocating, starting over and Lawyers. [] Not to mention I stand to get his retirement, our house and possibly a large life insurance payout.

Investigators looked at the victim’s divorce paperwork which included the name of his then-wife, Kristy Lynn Felkins. The couple formerly received the divorce on January 29, 2016, only days before Felkins had reached out to the murder-for-hire site.

KBGMKN told the administrator of the site that her ex-husband would be travelling across the country to North Carolina. She asked if the hitman could kill him during his trip. In response, Yura described a ludicrous plan:

I don’t think the sniper hitman will be able to get ready and go there so fast; however if the current sniper won’t be able to do it; he will follow them to the airport and will bribe someone to find out where he is going, eventually he will buy a last minute flight with the same plane to the same location to stay with him.

He will leave his gun at the car tough, as no guns can pass through the airport gate. He will fly towards the same location, and when landed he will steal a car, he is good at it. He will steal a truck or some solid jeep, and will run him over by car, making it look like an accident

Investigators noticed that one of the cards associated with a bank account shared by Felkins and her ex-husband had been used in North Carolina instead of the usual locations in California, indicating that the ex-husband’s trip matched the trip described by KBGMKN.

In April, KBGMKN asked Yura for a picture of the hitman’s hand in front of a street sign in North Carolina. Eventually, Yura sends the requested photo, but KBGMKN pointed out that the picture “was obviously a Google Street view with a photo shopped finger added in.”

At this point, investigators identified a LocalBitcoins account as the source of the Bitcoin sent from KBGMKN to the murder-for-hire site. Felkins had allegedly created a LocalBitcoins account under the username “kl85coins.” The account name includes the letters “k” and “l”, which are the first and middle initials of Felkins’ name. Felkins was born in March 1985. “Thus, the ‘k’ and ’l’ combined with ‘85’ correspond to Felkins’ personal identifiers,” SA Mann wrote.

Note: There is currently no LocalBitcoins account with the username identified in the criminal complaint.

The name listed on the LocalBitcoins account was “Kristy L Felkins.” She registered with a Yahoo email address. The feds received a warrant for the contents of the Yahoo email account. Investigators noted the I.P. address associated with the LocalBitcoins account. During a search of the emails contained in Felkins’ email account, SA Mann viewed the full headers of an email about a listing on Craigslist. Felkins had created the listing. The email headers revealed that someone using the same I.P. as the one associated with Felkins’ LocalBitcoins account had created the advertisement on Craigslist.

Felkins was arrested and charged with one count of Use of Interstate Commerce Facilities in the Commission of Murder-for-Hire. If convicted, she faces up to ten years in prison.

The Northern California Illicit Digital Economy Task Force is perhaps most well known for investigating marijuana vendors located in California. The Task Force has a list of arrested vendors on their own onion service and has a (mostly unmaintained) account on Dread. The Task Force consists of agents from:

• Homeland Security Investigations (HSI);
• the Federal Bureau of Investigation;
• the United States Postal Inspection Service;
• and the Drug Enforcement Administration.