BreachForums Outage Fuels Copycat Sites and Competing Reboot Attempts
Summary
BreachForums went offline in April 2025, prompting copycat domains and rival reboot efforts. The reported MyBB zero-day and law-enforcement involvement remain unverified; admins warned that clone sites could be phishing lures or honeypots.
Key points
- BreachForums’ .st domain and associated Telegram channels went offline around April 15–16; the article says no official seizure banner or confirmed arrests were reported.
- Former administrators later claimed a MyBB zero-day caused the outage, but who exploited it and whether law enforcement was involved remain unverified.
- Copycat domains included breached[.]fi and breachforums[.]uk; some impersonators reportedly used fake FBI seizure notices, suspicious vendor links, or paid-access demands.
- Dark Storm claimed a DDoS attack on breached[.]fi, while threat actor Rey reportedly described that site as fraudulent.
- Several groups or users proposed rebooting the forum, including efforts associated with 888, HassanBroker, and “Momondo”; the article reports doubts about some efforts’ legitimacy.
- An April 28 message attributed to the original admins denied arrests or data loss, announced a backend rewrite, and warned that copycat sites could be phishing lures or honeypots.
Article Details
- Event Type
- BreachForums outage followed by copycat domains and fragmented reboot attempts
- Impact
- The outage and proliferation of impersonation sites caused confusion in the dark web community. The article says some copycat sites may be honeypots or phishing lures, but reports no confirmed arrests or data loss connected to the April 2025 outage.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | breach-forums[.]com | Lookalike domain registered as part of HassanBroker’s BreachForums reboot attempt. |
| DOMAIN | breached[.]fi | Copycat domain described as fraudulent and associated with the BreachForums impersonation activity. |
| DOMAIN | breached[.]ws | Lookalike domain registered as part of HassanBroker’s BreachForums reboot attempt. |
| DOMAIN | breachforums[.]af | Domain identified as an impersonator; the article says some impersonators displayed fake FBI seizure notices or suspicious links. |
| DOMAIN | breachforums[.]uk | Domain identified as a clone or impersonation site that emerged after the BreachForums outage. |