Operation Tourniquet
Verified core entry, last reviewed August 21, 2026
What was taken down?
Domains raidforums.com, rf.ws, and raid.lol seized and redirected to a seizure notice; forum infrastructure taken offline.[1][2]
See what happenedWhat happened to the people?
Officials reported 1 charged and 1 apprehended.
1 charged and 1 apprehended named in the public record.
Group accounted for: Partial
Did it stay down?
After this action a successor service took over the same demand, first seen March 2022. The replacement was itself seized in a later action. High confidence in the link between the two.
See what happened afterwardUS-led seizure of the RaidForums domains, a major English-language marketplace for stolen databases, coordinated with European partners under Europol.[1][2]
Announced April 12, 2022.
- Date
- April 2022
- Target
- RaidForums, clearnet criminal forum
- Activity
- Fraud and stolen data, Phishing
- Operational lead
- FBI
- Partners
- Europol, USAO-EDVA, and 2 more[1][2]
- European Union Agency for Law Enforcement Cooperation , coordinator
- United States Attorney's Office for the Eastern District of Virginia , charging
- United States Secret Service , investigating
- National Crime Agency , arresting
- Jurisdiction
- United States, United Kingdom, Portugal, Sweden, Romania, and European Union
- Outcome
- Domains raidforums.com, rf.ws, and raid.lol seized and redirected to a seizure notice; forum infrastructure taken offline.
- Status
- Completed
- Legal mechanism
- US seizure warrant (Eastern District of Virginia); UK arrest at US request; Europol coordination
- Group accounted for
- Partial
Infrastructure
3 domains seized.
- 1
- domain seized
- 1
- domain seized
- 1
- domain seized
| Identifier | Recorded as | Status | Notes |
|---|---|---|---|
| raidforums[.]com | 1 domain | Seized, United States | Seized and redirected to a seizure notice.[1] |
| rf[.]ws | 1 domain | Seized, United States | Seized and redirected to a seizure notice.[1] |
| raid[.]lol | 1 domain | Seized, United States | Seized and redirected to a seizure notice.[1] |
Domains and onion addresses are shown defanged. Where the record gives a count but no identifier, the count is shown in place of one. This list carries only what appears in the cited sources.
- 1
- charged
- 1
- apprehended
Named in the public record: 1 charged and 1 apprehended.
Figures count individuals named in charging documents and official statements, each person once per outcome. People alleged to be involved but not publicly identified are not counted.
| Person | Role | Current public status |
|---|---|---|
| Founder and chief administrator of RaidForums | ArrestedChargedExtradition requested | |
|
||
Diogo Santos Coelho
Founder and chief administrator of RaidForums. Current public status: Arrested, Charged, and Extradition requested.
- Charging authority
- United States Attorney's Office for the Eastern District of Virginia
- Main charges
- Conspiracy; Access device fraud; Aggravated identity theft
- Case number
- Not established in the public record
- Arresting authority
- National Crime Agency
- Arrest location
- United Kingdom
- Extradition status
- Extradition requested
- Conviction or plea
- Not established in the public record
- Sentence
- Not established in the public record
- Segment
- Core operator
- Full record
- Everything indexed for Diogo Santos Coelho
Rows expand to show charging authority, case identifiers, custody status, and sources.
Group accounted for: Partial
The founder was arrested and charged, but the forum's wider administrative staff was not publicly accounted for, and a successor forum appeared within weeks.
One founder-administrator publicly charged; co-administrators and staff not comprehensively named.
Founder arrested in the UK in January 2022; extradition proceedings to the US.[1][2]
-
March 2022
BreachForums. Ecosystem successor. Confidence: High. Seized in a later action.[3]
Launched by a different individual explicitly as a replacement for RaidForums, inheriting its user community, structure, and function. Operator continuity with RaidForums administration is not established.
breachforums[.]is
Later action: BreachForums shutdown following administrator arrest
March 2022
BreachForums. Ecosystem successor. Confidence: High. Seized in a later action.[3]
Launched by a different individual explicitly as a replacement for RaidForums, inheriting its user community, structure, and function. Operator continuity with RaidForums administration is not established.
breachforums[.]is
Later action: BreachForums shutdown following administrator arrest
Return class C. The class is a research grading carried in the source dataset and its scale is not published, so this page relies on the relationship and confidence values instead. How this index handles it.
Numbered markers throughout this entry link to the source that supports the claim beside them.
Official sources
-
[1]
Justice Department Announces Court-Authorized Seizure of RaidForums Website
Domain seizures, indictment of Diogo Santos Coelho, forum scale
-
[2]
One of the world's biggest hacker forums taken down
Operation Tourniquet coordination, participating countries, UK arrest
-
[3]
United States v. Conor Brian Fitzpatrick, criminal complaint and affidavit
Arrest, charge, and identification of the BreachForums administrator
- Forum hosted more than 10 billion records across roughly 530,000 registered users, which is a user population and not an operator count.
- Arrest occurred 2022-01-31, more than two months before the domain seizure. Dates are kept distinct.