Trisha Leffler is alive today because she did what she was told. A couple of months ago, the 29-year-old prostitute from Las Vegas was staying at the plush Westin Copley Place Hotel in downtown Boston, offering her services on the local edition of Craigslist, the hugely popular online advertising site. On 10 April, a man responded to her invitation to "spend some time with a sweet blonde" and they agreed to meet half an hour later.

Taking her standard security precautions before such assignations, Trisha met her client in the lobby, and saw nothing to worry about. They agreed a $200 fee for a one-hour session, and went up to her room. At which point, the encounter veered terrifyingly off-script.

No sooner had the door closed behind them than her client – "a tall, good-looking guy", Leffler said later – pulled out a gun and, after tying her hands, asked for her money. Her purse was in the drawer below the television, Trisha told her assailant, who took $800 in cash and $250 in American Express gift cards. Then he calmly asked for her mobile phone and erased his number from its call log, before looking for somewhere to tie her, to give himself time to get away. She suggested the door, and the man fastened her to it with plastic zip ties, sealing her mouth with duct tape. Then, bizarrely, he took a pair of underpants from her suitcase, stuffed them in his pocket and left. Within a minute Trisha managed to wrench her hands free of the ties. After waiting to make sure her attacker had gone, she called hotel security to tell them that she'd been robbed.

Download the new Independent Premium app Sharing the full story, not just the headlines

Four days later, Julissa Brisman, a masseuse and aspiring actress from New York, was staying at the Marriott Copley, virtually next door to the Westin. She too had advertised on Craigslist, and set up a meeting with a customer. But this time, when he attacked, Julissa fought back – and paid for her bravery with her life.

After beating her on the head, the man fired three shots at her, one of which passed through her heart. The victim was rushed to a local hospital where she was pronounced dead later that night – and the Boston police had a sensational murder on their hands. The near-identical circumstances of the two attacks left scant doubt that the same man was responsible, transforming a relatively mundane hotel robbery into a glossy real-life film noir, featuring call girls, upmarket hotels and an internet site where paid sex was marketed and where a killer – young, white and personable – chose his victims.

And just two days later, on 16 April, came a third attack that followed the same pattern. This one took place not in Boston but at a Holiday Inn Express in Warwick, Rhode Island, an hour or so drive south on Interstate 95. Once again the victim, a Las Vegas stripper promising "lap dances", had advertised her services on Craigslist. She too was held at gunpoint and tied up – but this time the assailant fled when her husband arrived on the scene.

The man was described as a tall white male with blond hair, and police made the connection with the two Boston hotel attacks almost instantly. By now, the case had gripped not just New England but half the country. Was there to be a new chapter in the long and gruesome history of American serial killers?

On 20 April, just four days after the Rhode Island attack, fear gave way to amazement. That afternoon, a dozen miles south of Boston on I-95, police arrested a 23-year-old medical student by the name of Philip Markoff, who – with $1,000 in cash in his pocket – was en route with his fiancée, Megan McAllister, to the Foxwood casino resort, a couple of hours away in Connecticut, where they planned to spend the night. Instead, Markoff would now spend the night in a jail cell in Boston, charged with the murder of Julissa Brisman and the armed robbery of Trisha Leffler.

The following day, he was formally arraigned in court and the city of Boston could hardly believe its eyes. There, shackled in the prisoner's chair, sat a young man in the studiedly casual uniform of affluent upper-middle-class America: a blue-and-white-striped open-necked shirt over a white T-shirt, khaki trousers and tassled moccasin shoes. Markoff was tall, clean-cut and apparently wholesome. As he entered a plea of "not guilty", he looked quintessential preppy, one of those upwardly mobile young men marked out by looks and breeding to inherit the American earth.

Each new detail that emerged at first only strengthened that impression. Markoff was the son of a successful dentist in upstate New York. His school record was without blemish. He had no record of the slightest criminal wrongdoing. At the State University of New York at Albany he had excelled, taking a degree in biology. At the time of his arrest he was near the end of his second year at Boston University School of Medicine.

Daily coronavirus briefing No hype, just the advice and analysis you need Enter your email address Continue Continue Please enter an email address Email address is invalid Fill out this field Email address is invalid Email already exists. Log in to update your newsletter preferences Register with your social account or click here to log in I would like to receive morning headlines Monday - Friday plus breaking news alerts by email Update newsletter preferences

He lived with McAllister in a $1,400-a-month one-bedroom flat in Quincy, just south of the city, in an upscale apartment block that advertised itself as a "luxurious community with all the features you've been seeking", and promised an "upbeat Boston lifestyle". His bride-to-be was an attractive girl whom he had met as a fellow student volunteer in a hospital emergency room in Albany in 2005. The picture-perfect couple were even planning a picture-perfect marriage, on 14 August, in a sunset ceremony on a New Jersey beach.

It seemed inconceivable that this bridegroom-to-be could indulge in the week-long spree of violence that had turned him into the most famous murder suspect in the country. "Philip is a beautiful person inside and out," his fiancée declared the day he was arraigned, "he could not hurt a fly." In the view of his lawyer, John Salsberg, the whole thing was a case of mistaken identity.

For how could this apparently impressive young man be the individual whom Daniel Conley, the Boston district attorney, described as "a cold-hearted predator, a man who is willing to take advantage of women – to hurt them, to beat them, to rob them" (and, it would appear, to kill them)? For the Boston police and in newspaper headlines across the country, Markoff was now "The Craigslist Killer" – even though by mid-June he had not been formally indicted by a grand jury, let alone convicted of any crime.

If prosecutors are to be believed, he was breathtakingly callous, a criminal with ice in his veins who, having robbed one woman, killed another and then, two days after that murder – according to one unofficial timeline of events – staged a third attack on 16 April, even as he returned from winning $5,300 in a session at Foxwood casino. In her interview with CBS, days after Markoff's arrest, Trisha Leffler, the first "Craigslist" victim, described her assailant as having "a very calm demeanour ... like he's done it before, like he knew what he was looking for."

And maybe there were clues. Markoff might have appeared affluent, but in fact he had run up debts of $130,000 in student loans. That sum, while large, is not especially unusual for medical students, given the long and costly training they require, in a country where such borrowing is almost the norm. But it appears that unlike many other middle-class students, he received no aid from his parents. Court records list his financial status as "indigent", unable to pay his lawyers.

For some school and college friends, initial astonishment was tempered by memories of Markoff's fondness for gambling, at which he might lose substantial sums and then stay up late into the night trying to win the money back. Others recalled his occasional tendency to drink heavily (but is that so unusual for a student?), while others remembered how he could be awkward and intense, making jokes that sometimes fell embarrassingly flat. Mostly though, they ascribed these small vices to an ambition to succeed. There was nothing to suggest the cynical double-life that prosecutors alleged – at least until a flood of leaks from police investigators and witnesses set out to fill in the gaps.

If certain details of the case are to be believed, Markoff was not the master criminal that his cool suggested. A more practised operator would have realised, for instance, that phone records could not be wiped away simply by removing a number from a mobile phone's call log, or that visits to internet sites could be erased from a hard-drive memory merely by hitting the delete key. The "Craigslist Killer", moreover, seems to have taken little trouble to disguise himself from the security cameras ubiquitous at hotels. TV stations and newspapers ran grainy pictures of a tall man in a jacket and baseball cap looking much like Markoff, as he was leaving the hotels shortly after the attacks. In one, he seemed to be sending a text message or peering at his BlackBerry.

Almost certainly, these phone and computer records enabled police to make so quick an arrest – the sort of speedy arrest of a suspect in a high profile-crime, a cynic might also note, that can do wonders for the reputation of a city police department or a district attorney seeking re-election. In the meantime, unnamed "law enforcement officials" let other titbits slip.

A search of Markoff's Quincy apartment turned up a gun (said to have been hidden, deliciously, in a hollowed-out copy of Gray's Anatomy) which preliminary data showed to match the weapon used to kill Julissa Brisman. Allegedly, fingerprints matching those of Markoff were found at one of the crime scenes on the plastic restraints and duct tape. According to one report, the search of the apartment also yielded 16 pairs of women's underpants, including two that had belonged to his known victims.

This last find in particular inevitably fuelled speculation that a serial killer was at work. If so, however, the killer's modus operandi was unusual. There has been no suggestion that whoever committed the crimes is a sexual psychopath – like the glib and handsome Ted Bundy, who murdered at least 30 women during the 1970s. Rather, prosecutors argue the motive for the attacks was simple robbery, to pay for Markoff's gambling habit. From that perspective, the use of Craigslist made perfect sense for a criminal calculating that women who offered "erotic services" in the seedy netherworld of classified online ads would be unlikely to make a fuss. There, however, the perpetrator miscalculated, and badly. Trisha Leffler went to the police, while Julissa Brisman resisted so vigorously that robbery turned into murder.

Faced with complaints by state attorneys-general that it was operating a de facto prostitution network – not to mention threats of direct legal action after the murder – Craigslist, which boasts 50 million users every month, has now dropped the "erotic services" category, replacing it with a strictly scrutinised "adults-only" section, whose postings will be individually reviewed by a Craigslist employee before they appear. But the new format may not be that different, if a glance at the Washington DC edition last week, with lines such as "Sweet Blonde Petite Bombshell" and "100% Real, 100% Exotic, 100% Reliable", is any guide.

There, for now, the case rests. Only when grand jury indictments are unsealed, or at a preliminary hearing set for 1 July, will it be clear whether other charges will be brought, beyond the three attacks already known (an arrest warrant was issued on 4 May against Markoff for the Holiday Inn attack, but Rhode Island authorities have said they will not press formal charges until the two Boston cases have been tried). Other victims may still be unwilling to come forward in public.

Already though, a preppy life and reputation lies in ruins. Markoff has been suspended from medical school. His wedding has long since been called off, and when Megan McAllister paid her one visit to her fiancé in prison, a week after his arrest, an engagement ring was conspicuous by its absence. She realises, according to her lawyer Robert Honecker, "that it's time to get on with her life" – even though, he added, "I believe that she still loves the man that she knows, that she knew, that she lived with."

That man, it now transpires, may be a heinous criminal who, for a while in April, terrorised a city – and continues to fascinate an entire country to this day.

Caught in the net

By Charlotte Philby

On 17 October 2007, a man admitted hacking his wife to death with a meat cleaver, after she changed her Facebook status to "single". The couple had split four days before the attack, but Wayne Forrester, 34, became enraged when his former partner, Emma, announced their separation online. The HGV driver travelled 15 miles to where Emma was staying at her sister's house, armed with the cleaver. He said: "She posted messages on the internet website telling everybody she had left me."

The serial killer Hiroshi Maeue earnt the title the "Suicide Website Murderer" after duping three members of an internet-based suicide club. Maeue, 41, made an online pact with each of his victims – a 14-year-old boy, a 25-year-old woman and a 21-year-old man – that they would end their lives together, by asphyxiation. In fact, he ended up strangling each of his victims. A court in Osaka sentenced Maeue to death by hanging in 2007.

In March 2001, Bernd-Jurgen Brandes, a 43-year-old German, replied to an internet advert calling for a slim, blond male who'd agree to be killed and eaten. The man behind the ad was a 41-year-old computer technician, Armin Meiwes, who invited his "volunteer" to his home where he apparently cut off and flambéed Brandes' penis for them to eat together, before stabbing and dissecting his victim. Meiwes was sentenced to eight years, in Germany's first ever cannibalism case.

The Swedish bank Nordea lost more than eight million kronor (around £576,000) in 2007, in the biggest internet fraud case in history. Criminals targeted the bank's customers directly: more than 250 individuals were asked to download an anti-spam program, which infected their computer with a virus that enabled the fraudsters to steal their victim's bank details. Police traced the programs to the US and then Russia, but no individuals have been charged.

On 5 November 2008, an American grand jury indicted 18-year-old Paul Schlesselman and 20-year-old Daniel Cowart on a string of charges including "threatening to kill and inflict bodily harm upon a major presidential candidate" – Barack Obama. The pair, who are from different US states, were bought together by the web-based neo-Nazi skinhead outfit the Supreme White Alliance, and met only after they'd hatched their murderous plan online. They await charges.

In October last year, a Japanese piano teacher was charged with “murdering” a character in the virtual world known as Maple Story, where subscribers spend hours developing their onscreen characters – or “avatars”. One Japanese player had spent a year “raising” his avatar when it mysteriously disappeared from screen one night. After some investigation, police found that the man’s jilted “ex-wife” - whom he’d “married” online, but never met in real life - had hacked into the game and “killed” his avatar by way of revenge, after it “divorced” her. She later faced a five year jail term or a £3,100 fine, for manipulating electronic data.

In May 2004, a teenage boy became the first person in Britain to be convicted of inciting their own murder. A year earlier, the 15-year-old had been taken to hospital with stab wounds in his chest and stomach, having – it later transpired - convinced his 17-year-old boy, whom he’d met on an internet chat-room, to stab him in order to pass a fictitious test for the secret services. John, as the “victim” was known, pleaded guilty at a court in Manchester to incitement to murder and perverting the course of justice. He was given a three-year supervision order and banned from using the internet without adult supervision. Mark, his accomplice, was given a two-year supervision order for attempted murder.

A young Palestinian woman confessed to luring an Israeli teenager to his death, via an internet chat-room, after a month-long Israeli interrogation which included depriving the woman of sleep. The woman, 25-year-old Amana Jawad Mona, initially denied any connection with the murder of 16-year-old Ofir Rahum in 2001, but later admitted persuading the youth - whom she’d met and befriended online - to meet her at a Jerusalem bus station, where he was picked up in a car, driven to the West Bank, and murdered by two senior members of the Tanzim militia.