RaidForums

» see raidforums.com as it lived, on the wayback machine

~ the goodbye ~

raidforums surfaced in my reading as a name that appeared in write-ups of big consumer data breaches through the late 2010s and early 2020s. when a chain of stolen credentials showed up in have-i-been-pwned a few weeks after some retailer got hit, the mirror was usually on raidforums first. i never registered an account and never had a reason to. the forum was a threat-research subject and a criminal marketplace, and i was neither audience.

the site was founded in 2015 by a portuguese teenager, diogo santos coelho, under the handle omnipotent. he was 14 years old when he set it up. the forum sat somewhere between a discussion board about hacking tools and an actual marketplace for breach dumps. sections on the forum handled sales and requests around leaked databases and credential lists. by the 2022 shutdown the account count had crossed 530,000.

raidforums was the successor in a plain lineage sense to hackforums and older shell-lifted forums of the mid-2010s. the difference was that raidforums normalized the marketplace layer. earlier hacking forums treated the trade in stolen data as an off-forum activity you arranged over encrypted chat. raidforums moved it into the open with escrow tokens and dedicated dump sections tied to a public reputation layer. that shift is what made it the primary node in the english-speaking breach-mirror pipeline.

~ the chronicle ~

~ the breakout ~

between 2018 and 2021 raidforums became the default first mirror for any large consumer data breach. the leaked linkedin scrapes of 2021 and the leaked facebook 533-million-user set from april 2021, alongside a run of telecommunications breaches, all surfaced on raidforums within days of getting stolen. security journalists routinely credited raidforums by name in write-ups because that was where the dump had first appeared publicly.

this visibility was also what made the forum a target. every major breach mirrored on raidforums added to a growing us federal case file. coelho, who was running the forum from portugal and later the uk, kept the domain online through six or seven years of civil complaints and takedown requests. the forum used cloudflare fronting through the whole run.

~ what really happened ~

coelho was arrested in the united kingdom on 31 january 2022 in a coordinated law-enforcement operation. the arrest was kept quiet publicly until the fbi announced operation tourniquet on 12 april 2022. that same day the raidforums domains were replaced with a doj seizure banner. the operation was joint work between the fbi, the us secret service, the doj and european counterparts, extending through the uk and beyond.

the doj indictment charged coelho with six counts including conspiracy and access device fraud. the immediate practical effect on the underground was that the raidforums url pointed at a seizure notice. within a couple of months a successor forum called breached (breachforums) had launched under a different admin, pompompurin, who was himself arrested in march 2023. the breach-data marketplace has since fragmented across a series of shorter-lived successor forums, none of which reached raidforums's 530,000-account footprint.

~ what replaced it ~

raidforums professionalized the breach-data trade in a way earlier forums had not. escrow and dedicated dump sections tied to public reputation, all of it moved into the mainstream criminal workflow through the forum's 2015 to 2022 arc. what got buried when the fbi seized the domain was not the market itself, that just moved. what got buried was the specific archive of a decade of public consumer breaches sitting in one place, indexed and searchable. that archive is now split across seizure caches inside law enforcement and mirrors held by private threat-intelligence firms. no public equivalent of the raidforums index has replaced it.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »