Notes

the April 2026 Dark Web Issue Trend Report summarizes the Major Issues that occurred on the deep web and dark web. due to the nature of the sources, some of the information is difficult to fully verify.

Major Issues

• BreachForums continued its relaunch with a new domain and repeated operational update announcements.
• at the same time, impersonation forums such as PwnForums appeared, and BreachForums issued warnings and updates on the progress of Data recovery. Claims of Knox’s control also emerged, leading to confusion over who was running the operation.
• The T1erOne forum continued to solicit attacktech content despite the outage, holding an attacktech writing contest and an open call for researcher-only access accounts. Ransomware as a Service (RaaS) criminal operations such as HYFLOCK, ShadowByt3$, and Gunra were also observed.
• The XSS forum moved to the new domain after the old domain was suspected of being a honeypot (a trap site for surveillance or control by law enforcement).
• DarkForums was found to offer a free XMPP (XMPP, a distributed messaging protocol that supports encrypted communication) chat server for its community.
• The infrastructure IPs of Rehub Forums and certain cybercrime forums were exposed, as well as new domain registrations related to LeakBase.
• a new dark web marketplace, Amazon Market, has emerged, and earlier this month, Threat Market was launched.
• a new leak site, ShadowByt3$, was identified.

Conclusion

this month’s dark web trends include BreachForums’ repeated reactivation and confusion of impersonation forums, T1erOne’s specialization in attack technology and strengthening of RaaS connections, the emergence of new markets and leak sites, and the exposure of multiple forum infrastructures. in particular, the risk of personal information and account information theft by accessing fake forums, the expansion of the RaaS ecosystem, and the operational instability of major forums were presented as key risks.