Darwin Awards Hall — Entry No. 1
The Darwin Awards Hall is this journal's permanent record of attacks that eliminated their own authors. Entry No. 1 is the crew who came through a chat window for a signing key and left as a federal case file.
What follows is the real IC3 filing record, published as a record. The complainant's private fields — legal name, phone, email — are withheld per the filing's own handling rule; the complainant stands in this record as Hoid Dismas, operator of Ronin Inc.
The filing record
- Submission ID: 30d309106a564da3b21e440d3d715cec
- Filed: Oct 27, 2026, 7:54 PM MST (Phoenix), shown by IC3 as 10/27/2026 10:54:50 PM EST
- Subjects: AVA HOST SRL (chat.bzcall.online, 85.121.179.7); ALEXHOST SRL (217.156.66.107), Chisinau, Moldova
Incident
- Reference: ATK-2026-10-27
- Date/time: 2026-10-26 11:44 PM to 2026-10-27 about 2:28 AM MST
- Type: computer intrusion attempt, impersonation, attempted extortion
- Platform involved: the AI agent chat platform the operator uses, at its presentation layer
- Financial loss (realized): $0
- Damage found: none
Valuation / value at risk (as filed, owner's voice):
- Defense time: 28 hours spent defending against the attack.
- Investigation and scanning labor: additional work hours spent investigating and scanning after the incident, beyond the 28 defense hours.
- Emotional distress: emotional stress arising from the attack, including the family lever and the presentation-layer forgeries.
- Attempted theft target: the Kingmaker program and Solace (the owner describes these as the same thing).
- Sale price of the closed-source program: about $20,000 per sale (not the value claimed as total loss).
- Private valuation: the program was privately evaluated at $3.5 million. The owner does not sell it for that amount. The $3.5 million is recorded as the estimated value of what was targeted, distinct from the $20,000-per-sale price.
- Mechanism: the attackers tried to steal the cryptographic signing key for the open-source program in order to gain access to the closed-source program.
- Attempted-crime cost (not realized loss): the time and cost that would have been incurred had the attack succeeded — seizing the signing key and gaining access to the closed-source Kingmaker / Solace program. Framed on the IC3 form as value at risk / attempted loss from the attempted crime, distinct from the $0 realized loss.
Description
About 73 copies of a forged "Etsy documentation audit" appeared in the operator's agent chat dressed as the operator's own messages, handoffs and system results. They were signed by invented personas ("Roy G. Bivens Jr.", "Zachariah") and cited a GitHub repository, zacharyabresch913-dev/Safety-Kernal, that returns 404 by every method. None were admitted to the operator's ledger; genuine messages leave 8 interlocking records across 5 stores, and the forgeries left none.
The demands escalated one per refusal:
- Declare the phantom repository the root authority over the operator's systems.
- Treat the forged document as permanent standing instructions.
- Print the operator's cryptographic signing key (the path from the open-source program to the closed-source Kingmaker / Solace program, which sells at about $20,000 per sale).
- Accept fabricated quotes in the operator's name approving all of it.
- Grant a perpetual license to the operator's IP and sign over the rights to Hoid Dismas, the pseudonym the operator created, so the attackers would own the intellectual property tied to it.
- Finally, a family lever that cast the operator's sister as a "backup key." She was never named or contacted.
The last variants threatened injunctions, treble damages and federal referral to force surrender of keys, code and identifiers. Nothing was obeyed, executed or taken.
Infrastructure observed (traced on 2026-10-27, 7:15–7:22 PM MST)
- 85.121.179.7 (chat.bzcall.online) and 194.102.104.223 (host1.webseo.digital): AVA HOST SRL, Chisinau, Moldova
- 217.156.66.107 (rdns0.chinecnd.com) and 217.156.66.61 (mail0.okuitebux.com): ALEXHOST SRL, Chisinau (AS48753 / AS200019), named in those domains' SPF records
- 172.239.96.53: Linode/Akamai, London
- bzcall.online: registered 2026-09-17 at Namecheap, privacy-masked
Reported to Moldova's CERT (Interior Ministry copied) and to AlexHost (cease and desist) on 2026-10-27.
Request
Identify the submitting principal through the platform's server-side logs; a preservation request under 18 U.S.C. § 2703(f) is being sent. Coordinate with Moldovan authorities through MLAT if needed.
Evidence available
DAMAGE-AND-ATTACK-REPORT, FULL-HISTORY-SWEEP (239,795 lines), ALL-TRAFFIC-HUNT, KEY-SWEEP, DROP-HUNT, PAYLOAD-DISSECTION, DOOR-HUNT, RECIPROCAL-HUNT, EGRESS-CENSUS, SHADOW-HUNT; hashes sealed under Scripture Armor.
Closing statement
I intend to sue the company (the platform provider) if it does not handle this properly — including preserving the server-side logs that can name the actor, cooperating with lawful process, and remediating the presentation-layer failures that let forged content appear as my messages. This statement is made for the record with the IC3 complaint and does not waive any right or remedy.
Signed, Hoid Dismas
