[Back to the takedown index](https://takedownindex.org/takedowns) # Operation Tourniquet April 2022, Fraud and stolen data Led by [Federal Bureau of Investigation](https://takedownindex.org/organizations/federal-bureau-of-investigation) Verified core entry, last reviewed August 21, 2026 What was taken down? Domains raidforums.com, rf.ws, and raid.lol seized and redirected to a seizure notice; forum infrastructure taken offline.[[1]](#source-1)[[2]](#source-2) [See what happened](#what-happened) What happened to the people? Officials reported 1 charged and 1 apprehended. 1 charged and 1 apprehended named in the public record. Group accounted for: Partial [See people and accountability](#people) Did it stay down? After this action a successor service took over the same demand, first seen March 2022. The replacement was itself seized in a later action. High confidence in the link between the two. [See what happened afterward](#afterward) ## What happened US-led seizure of the RaidForums domains, a major English-language marketplace for stolen databases, coordinated with European partners under Europol.[[1]](#source-1)[[2]](#source-2) Announced April 12, 2022. **Date:** April 2022 **Target:** RaidForums, clearnet criminal forum **Activity:** Fraud and stolen data, Phishing **Operational lead:** FBI **Partners** Europol, USAO-EDVA, and 2 more[[1]](#source-1)[[2]](#source-2) - [European Union Agency for Law Enforcement Cooperation](https://takedownindex.org/organizations/european-union-agency-for-law-enforcement-cooperation), coordinator - [United States Attorney's Office for the Eastern District of Virginia](https://takedownindex.org/organizations/united-states-attorney-s-office-for-the-eastern-district-of-virginia), charging - [United States Secret Service](https://takedownindex.org/organizations/united-states-secret-service), investigating - [National Crime Agency](https://takedownindex.org/organizations/national-crime-agency), arresting **Jurisdiction:** United States, United Kingdom, Portugal, Sweden, Romania, and European Union **Outcome:** Domains raidforums.com, rf.ws, and raid.lol seized and redirected to a seizure notice; forum infrastructure taken offline. **Status:** Completed **Legal mechanism:** US seizure warrant (Eastern District of Virginia); UK arrest at US request; Europol coordination **Group accounted for:** Partial ### Infrastructure 3 domains seized. | Identifier | Recorded as | Status | Notes | | --- | --- | --- | --- | | raidforums[.]com | 1 domain | Seized, United States | Seized and redirected to a seizure notice.[[1]](#source-1) | | rf[.]ws | 1 domain | Seized, United States | Seized and redirected to a seizure notice.[[1]](#source-1) | | raid[.]lol | 1 domain | Seized, United States | Seized and redirected to a seizure notice.[[1]](#source-1) | Domains and onion addresses are shown defanged. Where the record gives a count but no identifier, the count is shown in place of one. This list carries only what appears in the cited sources. ## People and accountability Named in the public record: 1 charged and 1 apprehended. Figures count individuals named in charging documents and official statements, each person once per outcome. People alleged to be involved but not publicly identified are not counted. Reported and named. Officials reported 1 charged and 1 apprehended. 1 charged and 1 apprehended named in the public record. The two figures come from different places and are never added together. Officials publish a headline total, and this index counts only the individuals it can name from the cited record. #### Diogo Santos Coelho Founder and chief administrator of RaidForums. Current public status: Arrested, Charged, and Extradition requested. **Charging authority:** United States Attorney's Office for the Eastern District of Virginia **Main charges:** Conspiracy; Access device fraud; Aggravated identity theft **Case number:** Not established in the public record **Arresting authority:** National Crime Agency **Arrest location:** United Kingdom **Extradition status:** Extradition requested **Conviction or plea:** Not established in the public record **Sentence:** Not established in the public record **Segment:** Core operator **Sources:** [[1]](#source-1)[[2]](#source-2) **Full record:** [Everything indexed for Diogo Santos Coelho](https://takedownindex.org/people/diogo-santos-coelho) Group accounted for: Partial The founder was arrested and charged, but the forum's wider administrative staff was not publicly accounted for, and a successor forum appeared within weeks. One founder-administrator publicly charged; co-administrators and staff not comprehensively named. [See the organizations and roles behind this action](https://takedownindex.org/takedowns/operation-tourniquet/organizations) ## What happened afterward Founder arrested in the UK in January 2022; extradition proceedings to the US.[[1]](#source-1)[[2]](#source-2) March 2022 BreachForums. Ecosystem successor. Confidence: High. Seized in a later action.[[3]](#source-3) Launched by a different individual explicitly as a replacement for RaidForums, inheriting its user community, structure, and function. Operator continuity with RaidForums administration is not established. breachforums[.]is [Later action: BreachForums shutdown following administrator arrest](https://takedownindex.org/takedowns/breachforums-shutdown-following-administrator-arrest) Return class C. The class is a research grading carried in the source dataset and its scale is not published, so this page relies on the relationship and confidence values instead. [How this index handles it](https://takedownindex.org/about). ## Sources Numbered markers throughout this entry link to the source that supports the claim beside them. ### Official sources 1. [Justice Department Announces Court-Authorized Seizure of RaidForums Website](https://takedownindex.org/sources/united-states-department-of-justice-justice-department-announces-court-authorize) United States Department of Justice, April 12, 2022, Source grade P1 Domain seizures, indictment of Diogo Santos Coelho, forum scale No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher. 2. [One of the world's biggest hacker forums taken down](https://takedownindex.org/sources/europol-one-of-the-world-s-biggest-hacker-forums-taken-down) Europol, April 12, 2022, Source grade P2 Operation Tourniquet coordination, participating countries, UK arrest No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher. 3. [United States v. Conor Brian Fitzpatrick, criminal complaint and affidavit](https://takedownindex.org/sources/united-states-district-court-for-the-eastern-district-of-virginia-united-states-) United States District Court for the Eastern District of Virginia, March 16, 2023, Source grade P0 Arrest, charge, and identification of the BreachForums administrator No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher. Coverage note. - Forum hosted more than 10 billion records across roughly 530,000 registered users, which is a user population and not an operator count. - Arrest occurred 2022-01-31, more than two months before the domain seizure. Dates are kept distinct. Research context ## How this entry was checked This entry went through a dedicated source verification pass. Publisher, title, publication date, and docket numbers were confirmed against each cited source. Source review: Verified core Sources cited: 3 Research cutoff: August 20, 2026 Last reviewed August 21, 2026 See also [About the Internet Takedown Index](https://takedownindex.org/about) Related entries - [Cyclops Blink disruption](https://takedownindex.org/takedowns/cyclops-blink-disruption) - [RSOCKS proxy botnet disruption](https://takedownindex.org/takedowns/rsocks-proxy-botnet-disruption) - [Hive ransomware infiltration and seizure](https://takedownindex.org/takedowns/hive-ransomware-infiltration-and-seizure) Report updates or corrections Help keep this record accurate. [Submit feedback](https://takedownindex.org/about#corrections-and-updates)