Record ID: GRP-0005
Type: Forum Staff Collective
Status: Inactive
Active Since: 2023

The highest-confidence reconstruction is that Astounding-era BlackForums was a cybercrime forum launched on the clear web under blackforums.net in April 2023, not a legacy forum stretching continuously back to the late 2010s. The strongest anchors are the domain’s observed registration date of 2023-04-09, a preserved forum screenshot showing a live BlackForums breach thread on 2023-05-10, and multiple contemporaneous threat-intelligence reports tying BlackForums to the Five Families coalition alongside ThreatSec, GhostSec, Stormous, and SiegedSec. By January 2024, analysts were already describing BlackForums as replaced by SecretForums, also associated with Astounding.

BlackForums appears to have been real but comparatively small next to bigger underground brands. Independent estimates and operator claims point to a community in the low thousands at most during its first run: a third-party traffic snapshot estimated roughly 7,845 daily unique visitors in August 2023; one 2023 review said the forum had just over 2,500 members; Telegram reposts from BlackForums claimed 1,000 channel subscribers, 700 chat members, and over 1,500 forum members. A later 2024 revival under blackforums.ru was much smaller, with 86 registered users and just over 100 posts as observed by Morado. The forum ultimately looks less like a dominant marketplace and more like a volatile, aggressively networked mid-tier ecosystem node tied into propaganda, leak distribution, and ransomware-adjacent branding.

The public footprint of Astounding is unusual because it is simultaneously visible and unstable. The clearest public identifiers are Telegram handles and channels: @Astounding in 2023 screenshots; @ReservedMemory as the “owner” contact in BlackForums channel promotions; and a currently public Telegram page for Astounding / @ReservedMemory. Astounding was publicly presented as a BlackForums founder/admin, a Five Families participant, and in one interview a GhostLocker developer and member of both GhostSec and Stormous. Those role claims should be treated as partly self-reported and therefore lower-confidence than domain and archive evidence.

• Astounding — Admin.
• Judge Holden — chat staff and temporary forum staff.
• Vadim — member of staff, provider of illicit EDR services using stolen government emails.
• Eom/Lain — member of staff.
• Helladrol — Was neither moderator nor staff permanently; except when in testing for ~1 week.

• Glorysec — One of the five hacker Families.
• SiegedSec — One of the five hacker Families.

• 2021-02 — Low-confidence linked alias BL4CK98 asks a basic PHP API question on Stack Overflow.
• 2023-04-09 — blackforums.net registration observed; BlackForums creation date listed by CSIRT KNF.
• 2023-05-10 — Preserved screenshot shows an active breach thread on BlackForums.
• 2023-05-18 — Rival forum operator exposes BlackForums hosting panel.
• 2023-07-20 — @blackforumsdotnet Telegram channel created.
• 2023-08-28 — Five Families alliance publicly announced.
• 2023-09-05 — EOM announced as a BlackForums administrator.
• 2023-11-27 — SOCRadar reports BlackForums V2.
• 2024-01 — Astounding-era transition to USDoD / BlackSec / SparrowCorp / SecretForums.
• 2024-03-09 — Astounding interviewed as GhostLocker developer and SecretForums admin.
• 2024-late summer — BlackForums revived on blackforums.ru with onion mirror and paid ranks.
• 2024-fall — Morado reports Astounding's exit and forum dormancy.
• 2025-05-20 — RansomLook records blackforums.net as down.
• 2026-05 — @ReservedMemory remains public; blackforums.ru appears unregistered in sampled WHOIS results.

• 500px breach thread on BlackForums — Preserved May 2023 forum activity showing a live BlackForums breach thread by user emo, useful as one of the clearest public anchors for the forum’s early operational period.

• BlackForums hosting-panel exposure — Rival operator publication of BlackForums hosting-panel details in May 2023, indicating hostile attention from competing forum operators and possible infrastructure exposure.

• Five Families alliance announcement — Public announcement of the Five Families coalition in August 2023, linking BlackForums with ThreatSec, GhostSec, Stormous, and SiegedSec.

• BlackForums V2 release — SOCRadar reporting in November 2023 that BlackForums V2 had been released, marking an attempted continuation or relaunch phase of the forum.

• BlackForums transition to SecretForums — January 2024 reporting that BlackForums had ended or been replaced by SecretForums, with associated references to USDoD, BlackSec, SparrowCorp, and Astounding-linked rebranding.

• Astounding GhostLocker interview — March 2024 interview presenting Astounding as a GhostLocker developer and SecretForums administrator, useful as a public self-presentation point but lower-confidence where claims are self-reported.

• blackforums.ru revival — 2024 Telegram-announced revival of BlackForums at blackforums.ru, including an onion mirror and paid ranks, suggesting a smaller later attempt to restore the brand.

• BlackForums dormancy and staff disappearance — Morado reporting that Astounding exited, the forum became dormant, infrastructure custody was unclear, and staff disappeared.

• blackforums.net recorded down — RansomLook listing blackforums.net as down on 2025-05-20, marking a later public-status datapoint for the original domain.

The clearest domain snapshot for the main forum shows blackforums.net registered through Tucows Domains, created on 2023-04-09, expiring 2025-04-09, with privacy-protected registrant details pointing to Charlestown, Saint Kitts and Nevis, and nameservers on Cloudflare. The same snapshot showed Cloudflare MX records and a challenge page when queried, indicating that by 2023-08-29 the site was fronted through Cloudflare and actively using anti-bot protection. This is the strongest direct public evidence for registration and front-end hosting posture.

Operationally, the forum seems to have bounced between protection layers and domains. Telegram-preserved reposts from BlackForums announced, at one point, “We have switched to DDos-Guard”; later posts announced the forum had been re-released under blackforums.ru and made available via both clearnet and an onion hidden mirror, with paid subscriptions sold through the site. In the sampled 2026 whois query, blackforums.ru appeared unregistered/free, which fits the pattern of a project that repeatedly lost continuity in domains and infrastructure.

On ownership and hosting history, one important but lower-confidence claim appears in a SuspectFile interview snippet: after BlackForums went dark, the operators allegedly tried to bring it back through Njalla in Nevis, and that provider supposedly suspended it. The underlying takedown record from primary registrar data couldn't be verified, so the claim is useful mainly as a reported allegation, not settled fact. What *is* verified is that the forum suffered at least one public operational compromise when its hosting panel was exposed in May 2023.

On the legal side, the record is surprisingly thin. There were found no verified DOJ seizure banner, court filing, Lumen entry, or official takedown notice tied directly to blackforums.net. Morado notes that SecretForums later posted a message claiming FBI seizure, but also says it found no independent confirmation. The most defensible conclusion is that BlackForums was damaged more by rival exposure, churn, rebranding, operator exits, and infrastructure instability than by a publicly documented seizure of the BlackForums domain itself.

The strongest public identifier is Telegram. A 2023 CSIRT KNF screenshot shows @Astounding listed among BlackForums staff, with a bio linking @blackforumschat, @blackforumsbf, @fivefamilies, and “astounding.zip.” The same KNF material lists BlackForums administrators as Astounding, Lemonade, Eom, Herawen, Crazy, and Wiz, while later channel promotions identify @ReservedMemory as the owner and @zhadev as developer for the BlackForums Telegram ecosystem. That makes Astounding / @Astounding / @ReservedMemory the most credible public handle cluster in the record.

A surprising detail is that the user-supplied Telegram URL is publicly viewable today: t.me/ReservedMemory resolves to a channel called Astounding with 18 subscribers at the time of capture. Its preview, however, is not an orderly archive of BlackForums operations. What is visible is a short sequence of meme-like or chat-like posts and replies referencing names such as “Lain,” “potato,” and “ridgeforums,” plus conversational claims like having been hit by a train. In other words, the current channel is public, but it is not a clean documentary record of BlackForums history.

Astounding’s role claims broaden beyond BlackForums, but confidence drops because many of them are either mediated by CTI firms or self-reported in interviews. Analyst1 described Astounding as the founder/admin of BlackForums and the person who later posted a timeline explaining BlackForums’ evolution into SecretForums. Morado describes Astounding as a serial forum operator with ties to USDoD, Baphomet, and ShinyHunters, and as a developer associated with Stormous and GhostSec ransomware projects. Cybertechwiz’s March 2024 interview goes further, quoting Astounding as a “21-year-old developer and privacy freak,” a founding member of the Five Families, former owner of BlackSec, and a developer on GhostLocker. Those latter personal-role claims are best treated as self-description, not independent verification.

One probable linked account deserves mention, with caution. A public Hack Forums search snippet for profile BL4CK98 displayed “Telegram: @astounding” and “Discord: BL4CK98#5818,” and the same BL4CK98 handle appears on Stack Overflow in February 2021 asking a very basic PHP rate-limiting question. This is suggestive of handle reuse and fits the image of a young forum developer learning web mechanics in public, but it does not prove that BL4CK98 and Astounding are the same person. It is a plausible linked alias, not a confirmed identity match.

BlackForums’ thematic core was stolen data, leaks, malware-adjacent commerce, and cross-promotion with hacktivist/ransomware groups. Resecurity described it as a forum focused on data breaches whose dumps overlapped with Ransomed.vc victim material. Morado’s direct observation of the 2024 revival found sections for databases, verified leaks, stealer logs, exploits, tools, and malware source code. SOCRadar likewise described the forum as a place where cybercriminals exchanged stolen data, marketed malware, and collaborated on attack strategy, while CERT-EU noted that SiegedSec used an account on blackforums.net to share leaks and solicit donations in cryptocurrency.

Community size is best described as fragmentedly evidenced and probably modest. A third-party August 2023 snapshot estimated about 7,845 daily unique visitors and ranked the site around 402,135 globally, but that figure is only an estimate. A December 2023 review said BlackForums remained comparatively small with just over 2,500 members. Operator-linked Telegram reposts claimed 1,000 subscribers in the channel, 700 members in the chat, “over 1.5k members” on the forum, and 1.9k registered UIDs. Those figures do not perfectly align, but together they point to a forum that was active enough to matter while still far below the very largest breach forums. By contrast, Morado saw only 86 registered users during the 2024 revival, which suggests that the comeback never recovered the original scale.

Technically, BlackForums was built on XenForo—or at least publicly claimed to be. One preserved Telegram post says, almost defensively, “ps we use xenforo,” while discussing a leaked table name and registered user counts. The interface visible in preserved screenshots matches a modern commercial forum stack rather than a custom-built board, and the forum added an unusually heavy set of monetized/gamified features: credits, an item shop, lottery, bank, trading system, wagers, VIP+ subscriptions, and ad placements sold by Astounding directly over Telegram. Public navigation and promotions also confirm visible modules such as Wagers, Shop, User Upgrades, and a bookiebyte event page.

Moderation and governance look inconsistent and opportunistic rather than principled. Morado reports that the 2024 revival did not allow Russian leaks, not out of ideology but because staff and domain exposure made Russian state attention undesirable. The same article says users could buy VIP, legendary, and even moderator roles, with one moderator role priced at $250; it also notes that BlackForums offered to restore users’ prior ranks from BreachForums if they produced proof. Public Telegram posts reinforce the impression of a rough, unserious culture: there were scam warnings, juvenile jokes, and at least one post using an ethnic slur in a sales solicitation. The result was a forum that tried to look like a scalable marketplace while behaving like a quarrelsome Telegram-native clique.

The forum’s most consequential controversy was its integration into adjacent ransomware branding. BlackForums promoted GhostLocker and later announced a new partnership with BloodForge, framing a new organization called The Brotherhood and selling limited slots for a ransomware program. Even aside from the criminality, this appears to have worsened the forum’s structural fragility: ecosystem overlap made BlackForums more visible to rivals, more dependent on Telegram theater, and more vulnerable to collapse when Astounding or close developers disengaged. That helps explain why the project reappeared under new domains and names but never stabilized.

Record created: 2026-05-16.