Summary
This technical report details the investigation into domains associated with BreachForums, a platform for black hat hackers. Following the FBI's shutdown of the forum, the research team acquired 573 domains linked to its members. The report outlines the findings from a bulk WHOIS lookup, revealing that 249 of the domains had retrievable registrar data, predominantly registered with Namecheap and GoDaddy. The analysis also identifies 12 recently registered domains linked to the same email addresses as the IoCs, with some flagged as malicious. Additionally, the report documents the geolocation of IP addresses associated with these domains, noting a concentration in the U.S., Canada, and Germany. The investigation expands the list of IoCs to 13,484 domains, with a significant number sharing common TLD extensions, particularly .com. The report emphasizes the need for further investigations to confirm the nature of these domains and their potential threats.
