The mysterious “Mr. Dark” is no longer mysterious. In mid-March, the IRS indicted Mr. Dark, a Dutch national named Michael Rahim Mohammad. The indictment alleged Mohammad operated websites that showed videos depicting real blackmail, violent rape, and child pornography. In the hidden shadows of the Dark Web, these sites were known as “DarkScandals Darknet.” On the clear web or commonly used internet, these sites were known as “DarkScandals Clearnet.” Dark Web markets usually function as black marketplaces where users buy, broker, or sell illegal goods and services such as drugs, weapons, unlicensed pharmaceuticals, counterfeit money, stolen credit cards, hacked personal information, fake documents, and obscene material including child pornography. The most common currency used to transact business on the Dark Web is the cryptocurrency Bitcoin. The Dark Web and Clearnet sites offered the same repugnant sexual assault content. The sites solicited user contribution of videos that showed forced rape, sexual violence, and child pornography. The material was delivered in “packs” containing approximately 2,000 videos and images that could be accessed by either paying for the packs in Bitcoin (BTC) or Ethereum (ETH) or uploading new content in which the defendant curated in exchange for receiving packets for free. Site operators have rules for uploading a user-generated video. Any content that is deemed fake acted out (including masturbation) or amateur is rejected. The site only accepts what operators believe to be real sexual, violent material. Mohammad advertised on the DarkScandals sites that he used three different anonymous data-transfer services that allow users to store and share files without providing any identifying information to the service to receive uploads of user content. The investigation included an undercover operation. Using a cover, Washington D.C. law enforcement agents clicked on a download link in an email from “email@example.com.” The indictment states the email was hosted by an anonymous email service provider located in Germany. The downloaded filed revealed the nature of the pornographic content. Payment transactions were traced on the blockchain, the decentralized public ledger that logs every BTC/ETH transaction. Law enforcement can identify the owner of a particular BTC/ETH by analyzing the blockchain, looking for clusters of transactions, and identifying additional BTC/ETH addresses controlled by the same individual or entity. Over three hundred cryptocurrency accounts allegedly used by customers around the world were identified in the complaint. The sites received approximately 1,650 deposits totaling 188.6631 BTC, valued at about $1.6 million as of March 1, 2020, and 26.724 ETH valued at about $5,730.96. The cryptocurrency was then converted into fiat money. Law enforcement was able to trace payments to virtual currency exchanges and banks, where Mohammad used his identifying information. The complaint seeks to recover the illicitly generated funds and return them to victims of the crime. The complaint also seeks to forfeit the seized web domains associated with DarkScandals. The charges against Mohammad include Engaging in the Business of Selling or Transferring Obscene Matter, Distribution of Child Pornography, Laundering of Monetary Instruments, and Production and Transportation of Obscene Matters for Sale or Distribution.