In what appears to be an official move by its registrar, the popular hacking site RaidForums lost its official URL and is now mirrored at another location.
RaidForum is well known for containing a number of databases from high-profile breaches including leaks from Clubhouse, Facebook, and Mashable. The forums allowed users to download these databases for small donations rather than the thousands or hundreds of thousands of dollars requested by many hacking groups.
The site’s DNS record shows that raidforums.com is now on ‘clientHold.’ This means the registrar could be cracking down on the site.
The sites admins posted the following info:
Our main domain raidforums.com was temporarily deactivated aka placed on a “clientHold” due to certain governments reporting content to the registrar, this has never happened before and it only happened because we have recently moved registrar temporarily. We moved to a registrar known as NameSilo temporarily because we decided to move away from our old CloudFlare account and make a brand new one with strengthened opsec, the issue with this is that you can only transfer a domain every 60 days meaning that we were unable to transfer our domain back to CloudFlare straight away and have to wait till the end of October to do so. What caused an issue is that NameSilo received a report from a certain government which caused them to deactivate our domain until this was resolved, and they don’t exactly want us with their registrar which is understandable so now we are forced to use a mirror (rfmirror.com) until we can move our main domain back to our old registrar.
I just want to note that we are no longer deactivated on our main domain but we received orders from our registrar to not provide our content via that domain, we are instead redirecting all traffic to the mirror temporarily until the end of October unless something else happens. Someone asked why I didn’t use RF.WS as our mirror domain, this is because this domain is registered with the same registrar, and transferring a “premium domain” to another registrar is difficult and would require a day or two, time that I didn’t want the website to be down for.
The “attack,” if it can be considered that, affected the site directly and could be governmental retaliation or crackdown. The site is still available should you want to download 20 million Facebook records or the like, although we wouldn’t recommend it.