ZeroFox Intelligence Flash Report - BreachForums Allegedly Relaunched With New Domain

Product Serial: F-2025-04-24b

TLP:CLEAR

In this Flash Report, ZeroFox researchers report on the alleged relaunch of the popular deep and dark web hacking forum BreachForums, as well as continuing speculation surrounding the previous domain's closure.

Standing Intelligence Requirements

DDW

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here

Key Findings

On April 23, 2025, ZeroFox observed an announcement posted to the allegedly relaunched BreachForums site, breached[.]fi-made by the user “Normal”, stating that the forum is “officially back online”.
Administrators of the previous [.]st BreachForums domain appear to have launched the new domain and have publicized efforts to reinstate the existing reputations of previous users.
It is likely that BreachForums will have suffered reputational damage as a result of the April 15, 2025 outage. Returning users will very likely approach the [.]fi domain with increased caution, due to circulating speculation on deep and dark (DDW) forums regarding the potential involvement of law enforcement (LE).
As of the writing of this report, ZeroFox has observed some users reporting difficulties in registering for accounts, which is likely attributed to initial launch issues. It is very likely that it will take some weeks before a fully functioning user interface is restored.