Underground forum

Underground forums trace their origins to bulletin board systems (BBS) and early internet relay chat (IRC) communities of the 1980s and 1990s, where hobbyist hackers and "phreakers" exchanged techniques and shared access to systems.^[5] As the web matured during the 2000s, these communities moved to dedicated forum software and grew into large, persistent platforms with thousands to hundreds of thousands of registered members. Some forums, such as HackForums, have operated continuously for well over a decade and contain tens of millions of posts. A foundational empirical study of six such forums found that, unlike conventional online social networks, the pattern of communication among members did not simply encode pre-existing social relationships but instead captured dynamic trust relationships forged between mutually distrustful, pseudonymous parties.^[2] A related study modeled the social-network structure connecting individual hackers, finding that a small number of well-connected members disproportionately shape the flow of knowledge and reputation through the community.^[6]

Several members of such forums have been prosecuted for cybercrime offences, but some individuals associated with these communities have also gone on to legitimate security careers. For example, the security researcher Marcus Hutchins, later known for helping to halt the spread of the WannaCry ransomware attack in 2017, took part in underground forums as a teenager before starting his professional career in cybersecurity.^[7]

^[8][9]

Underground forums are typically organized hierarchically. A site contains multiple boards (topic categories); each board contains multiple threads (discussion topics); and each thread contains a sequence of posts (individual messages) ordered by time, with the topic of a thread generally set by its first post.^[1] Criminologists have characterized such forums as offender convergence settings, where market, social, and learning functions overlap within a single community.^[3]

Many forums run reputation systems, escrow services, or vetting processes meant to reduce fraud between members engaged in illicit trade, since participants cannot fall back on legal recourse to resolve disputes. One influential analysis frames these mechanisms through the lens of common-pool resource governance, arguing that a forum's long-term sustainability depends on collective norms of exclusion and enforcement among its members.^[10] Some forums maintain dedicated sections for processing transaction "contracts" between buyers and sellers, recording details such as the goods or services exchanged, the payment terms, and the reputation ratings of the parties involved.^[11] Despite these mechanisms, qualitative case studies of individual forums have found that trust often remains hard to establish even among vetted members, with interactions frequently marked by suspicion and accusations of fraud.^[12]

Underground forums vary considerably in scope and specialization. Some are broad, general-purpose cybercrime communities covering many topics; others focus narrowly on niches such as account compromise, search engine optimization (SEO) fraud, video game cheating, passive-income schemes, or romance scams (sometimes called "e-whoring"), a niche examined in a dedicated study of the practice on English-language forums.^[13] Others are invitation-only and closely vetted. Darkode, described by a U.S. federal prosecutor as one of the most sophisticated English-speaking forums for criminal computer hackers, required prospective members to be nominated and vetted by existing members before admission, and was dismantled by the FBI in a coordinated international operation in July 2015.^[12] Major forums operate in numerous languages, including English, Russian, German, Arabic, and Spanish, with linguistic and cultural conventions differing across communities.^[1] Researchers have used topic-modelling methods to study these multilingual settings, including an analysis of a single Russian-English invite-only forum that examined whether its language divide splits members into distinct sub-communities.^[14]

A particularly prominent category is data leak brokerage: forums dedicated to trading stolen databases obtained through breaches, exposing material such as account credentials, payment card numbers, and other personally identifiable information. This activity was documented in some of the earliest empirical studies of underground trade.^[15] A crime-script analysis of thirteen English- and Russian-language stolen-data forums broke the underlying market into discrete stages, from the acquisition or manufacture of stolen data through advertisement, sale, and the subsequent laundering of proceeds.^[16] Several of the largest and most heavily disrupted forums in the underground ecosystem, including RaidForums, BreachForums, and LeakBase, have specialized primarily in this activity, and have often become the first point of public exposure for a major corporate data breach before the affected organization itself discloses the incident.^[17][18]

Other recurring categories of forum content include the sale or creation of forged identity documents, such as fake driver's licenses and passports, which are often advertised alongside related fraud services such as synthetic-identity kits. Weapons and illegal drugs are also discussed and advertised. The actual transactional trade in physical contraband such as drugs and firearms, however, is more commonly associated with dedicated dark web marketplaces, such as AlphaBay, than with discussion-oriented forums. The two types of site remain closely related: they frequently share infrastructure or escrow systems, and are sometimes hosted on the same domain or used interchangeably by participants.^[19] Dread, a Reddit-style Tor-based forum, is a notable example of a discussion forum that sits at this overlap, hosting drug-related discussion, vendor reviews, and marketplace announcements alongside more conventional hacking and cybercrime content.^[20]

Carding forums, a subtype dedicated to payment-card fraud, have also been studied comparatively; an analysis of five such forums found substantial variation between them in accessibility, membership growth, and the concentration of trading activity among a small number of highly active sellers.^[21]

Anonymity and pseudonymity

Anonymity is central to the operation of most underground forums, since the activity they host is frequently illegal. Forums hosted as Tor onion services rely on Tor's onion routing to hide both the physical location of the server and the identity of visitors connecting to it. Forums on the clear web instead depend mainly on member pseudonymity, because the server's own location and operator are usually traceable through standard infrastructure-identification techniques unless additional measures, such as bulletproof hosting, are used. Participants typically interact under persistent pseudonymous handles rather than real identities. Many forums encourage or require the use of PGP-signed messages, both to verify a user's identity across mirrors or address changes (see migration) and to encrypt sensitive communications, such as the details of a transaction, from other forum members or potential eavesdroppers.^[11] Because pseudonyms can be reused across platforms, researchers have also developed stylometric techniques to link accounts belonging to the same individual across different forums, which raises further de-anonymization risks for participants who reuse writing habits or handles.^[22]

Financial transactions on underground forums are conducted through cryptocurrency, historically Bitcoin, because of its pseudonymous nature and ease of use. However, the increasing sophistication of blockchain analysis used by law enforcement and commercial firms to de-anonymize Bitcoin transactions has driven a partial shift toward privacy-focused cryptocurrencies such as Monero on forums and marketplaces handling higher-value or higher-risk transactions.^[11]

A number of underground forums have achieved particular prominence, whether through their size, their longevity, or their role in major data breaches and law-enforcement investigations.

Hack Forums is one of the longest-running English-language hacking communities, having operated since 2007 and accumulated tens of millions of posts.^[1]

RaidForums operated from 2015 to 2022 as one of the largest forums for trading stolen databases, with more than 500,000 registered users at the time of its disruption. The forum was seized by the FBI and Europol in April 2022 in a coordinated operation codenamed "Tourniquet", and its administrator, Diogo Santos Coelho, was arrested and charged with conspiracy, access device fraud, and aggravated identity theft.^[23][24]

BreachForums emerged in March 2022 as a successor to RaidForums and became one of the leading English-language platforms for data-breach discussion and stolen-data trading. The forum has been disrupted by law enforcement several times, including the arrest of an administrator in March 2023, and was cited by the U.S. Department of Justice as a predecessor cybercrime marketplace in connection with the later seizure of the forum LeakBase.^[17]

Darkode operated as an invitation-only, closely vetted forum until it was dismantled in a coordinated international law-enforcement operation in July 2015; researchers who studied its leaked database found that its rigorous, introduction-based admission process did not eliminate persistent distrust and fraud accusations among members.^[12]

XSS (formerly DaMaGeLaB), active since 2013 and one of the two central Russian-language forums alongside Exploit, dealt in exploit sales, malware, access-broker listings, and ransomware-related services, and ran an associated encrypted Jabber server used by cybercriminals to communicate. On 22 July 2025, the forum's suspected administrator was arrested in Kyiv, Ukraine, in a joint operation led by the French police and the Paris prosecutor's office together with Ukrainian authorities and Europol, following a four-year investigation. Europol said the suspect had been active in cybercrime for nearly two decades and had made more than €7 million, mainly from advertising and facilitation fees, while also acting as a trusted third party who arbitrated disputes and guaranteed transactions between members.^[25][26]

Altenen is a forum specializing in financial crime, particularly "carding" (credit-card fraud), trading tools and guides for bypassing payment security alongside stolen card and identity data, and has been used as a case-study forum in academic carding-market research.^[21] In 2018, its operator, identified in press reporting as Hilmi Git, a resident of Hebron in the West Bank, was arrested by Israeli police and indicted on charges connected to running the site and a related forum, Alboraaq.com, together said to have more than 1.3 million users; Israeli authorities estimated that the sites had facilitated fraud involving more than 20,000 stolen cards and around $31 million in related money laundering.^[27] The forum has continued to operate under successor domains since the arrest.^[28]

Nulled and Cracked, two large general-purpose forums trading in stolen credentials, cracked software, hacking tools, and access to compromised accounts, were seized in January 2025 as part of a coordinated international operation, "Operation Talent", led by German federal police (the Bundeskriminalamt) with Europol and participation from the FBI and law-enforcement agencies in Australia, France, Greece, Italy, Romania, and Spain. The action seized twelve domains associated with the two forums along with related infrastructure, including the payment processor Sellix and the hosting provider StarkRDP, and led to the arrest of two suspects, including a Nulled administrator, Lucas Sohn, who was charged in the United States with access device fraud and identity fraud offences.^[29][30]

Other forums documented in security-industry reporting include Dread (a Reddit-style Tor-based discussion forum that emerged following repeated takedowns of darknet markets) and DarkForums, which grew rapidly during 2025 by absorbing much of the user base displaced by the BreachForums and Nulled/Cracked disruptions.^[20]

Whether interacting with an underground forum is legal depends heavily on the jurisdiction and on the specific nature of the interaction, rather than on the existence of the forum itself. In the United States and most other Western democracies, merely accessing the Tor network or browsing a publicly viewable underground forum is generally not, by itself, a criminal act. Legal analyses commonly draw a distinction between passive access to forum content and active participation in illegal transactions, such as purchasing stolen data or hiring services, which can expose a visitor to prosecution under statutes such as the U.S. Computer Fraud and Abuse Act (CFAA).^[31] The applicable statutes vary by the nature of the underlying activity rather than by the forum itself: trading in stolen data, credentials, or hacking tools is typically prosecuted under computer-crime statutes such as the CFAA;^[31] the trade in physical contraband documented on some forums and adjoining marketplaces (for example, illegal drugs and firearms) instead falls under separate, often more severe, narcotics-trafficking and firearms-trafficking statutes; and trade in forged identity documents falls under document-fraud and identity-theft statutes. A single forum, or even a single transaction thread, can therefore implicate several distinct bodies of law at once. Certain categories of content remain illegal to access regardless of jurisdiction or framing, most notably child sexual abuse material, which is criminalized in the United States under 18 U.S.C. §§ 2252 and 2252A;^[32] the statute defines the offense to include not only possession but knowingly accessing such material with intent to view it, and courts have applied this provision to material found only in a browser's automatically generated cache, without evidence that the defendant deliberately saved it.^[33]

The picture differs substantially in countries that restrict anonymity-enhancing technologies as a matter of policy. Russia and China have each taken measures to block or restrict the Tor network at the national level. Russia's communications regulator, Roskomnadzor, began blocking direct connections to Tor in December 2021,^[34] and China's national internet filtering system (the Great Firewall) has used deep packet inspection to dynamically detect and block even unlisted "bridge" relays since late 2011.^[35] Iran has similarly moved to block direct Tor connections, particularly during periods of political unrest, though users in all three countries can often still connect using bridges and pluggable transports designed to evade this kind of detection.^[36] In these jurisdictions, the mere act of circumventing such restrictions to reach Tor, independent of what is subsequently viewed or done, can itself carry legal risk.^[37][38]

Underground forums, particularly those reached through Tor, face a number of recurring threats to their availability and continuity, which shape both how they operate and how they are studied.

Law enforcement takedowns

International law-enforcement operations have disrupted several major underground forums in recent years, typically through coordinated, multi-country actions that seize forum domains and backend infrastructure, replace the original website with a seizure notice, and frequently result in arrests of forum administrators. Notable examples include the 2015 dismantlement of Darkode,^[12] the 2022 seizure of RaidForums (Operation Tourniquet, led by the FBI, the UK's National Crime Agency, and Europol),^[23] the 2023 arrest of a BreachForums administrator, the January 2025 seizure of Nulled and Cracked in Operation Talent,^[29] the July 2025 arrest of the suspected XSS administrator,^[25] and the takedown of the forum LeakBase in a 14-country operation coordinated by Europol that captured the forum's full database, including private messages and member IP logs.^[17]

Such takedowns rarely eliminate the underlying community permanently; displaced members typically migrate to successor or rival forums within days to weeks,^[20] a recurring pattern that security researchers have likened to a game of "whack-a-mole".^[40] This is one reason researchers caution against treating any single forum as a stable, long-term monitoring target, and recommend tracking specific threat actors and their migration patterns across multiple platforms instead.^[4]

Distributed denial-of-service attacks

Underground forums are frequent targets of distributed denial-of-service (DDoS) attacks, originating from rival forums, disgruntled former members, or other threat actors seeking to disrupt a competitor. Such attacks can force forums offline for extended periods. In at least one documented case, downtime caused by a combination of technical outages was initially misinterpreted by the community as evidence of a law-enforcement seizure, illustrating the ambiguity that unexplained downtime creates within these communities.^[24]

Content on underground forums has several characteristics that distinguish it from more formal or curated text:

• Informal language: posts often contain slang, abbreviations, leetspeak, and grammatical irregularities.^[1]
• Deliberate obfuscation: participants may intentionally misspell or alter sensitive details, such as indicators of compromise, to evade moderation or automated monitoring.^[43]
• Mixed relevance: only a fraction of posts on any given forum concern serious criminal activity; much of the content is off-topic discussion or low-value posts, a pattern confirmed by recent large-scale content-labelling studies of millions of forum posts.^[44]
• Ephemerality: forums are frequently seized by law enforcement, voluntarily shut down, or migrate to new domains, which complicates long-term study.^[40]

Because participants on underground forums frequently discuss new exploits, malware, and attack techniques before such activity is documented in formal security reports, these forums are considered a potentially valuable early-warning source for security researchers and threat intelligence teams. Research analyzing two decades of forum and security-report data found that discussions on hacker forums preceded official security reporting for a majority of identified threat entities, particularly in earlier years, though this lead-time advantage diminished after around 2012 as forum activity faced increased law-enforcement and researcher scrutiny and threat actors moved some communication to other platforms, such as Telegram.^[4] A subsequent 2025 study proposed dynamic clustering methods to rank security events extracted from hacker-forum discussions, aiming to further reduce the manual effort required to surface actionable intelligence from high-volume forum data.^[45]

Researchers studying underground forums generally emphasize passive, read-only data collection, institutional ethical review, and data-sharing agreements that restrict redistribution, given the potential for collected data to include personal information, evidence of ongoing criminal activity, or content that could cause harm if mishandled.^[1]

To reduce the need for individual research groups to scrape forums independently, some institutions maintain curated forum datasets under controlled access. A well-known example is CrimeBB, maintained by the Cambridge Cybercrime Centre at the University of Cambridge, which aggregates data from dozens of underground forums across multiple languages, comprising tens of millions of posts collected over more than a decade.^[1] Access to CrimeBB and similar datasets is typically granted to academic researchers only after they sign an agreement intended to limit misuse. Dedicated tools, such as the POSTCOG platform, have also been developed to let non-technical researchers search and analyze such datasets without requiring direct programming access.^[54]

• Crimeware
• Cyber threat intelligence
• Cybercrime
• Dark web
• Darknet market
• Hacker culture
• Indicator of compromise
• Internet forum
• Open-source intelligence
• Virtual crime