ZeroForums: A New Chinese-Language Dark Web Forum Mimicking Established Cybercriminal Platforms

October 27, 2026

A newly emerged dark web forum known as “ZeroForums” has been identified, operating with a user interface closely mimicking established cybercriminal platforms including BreachForums and RaidForums. The forum defaults to Simplified Chinese as its primary language, with all threads and posts displayed in Chinese by default, though users retain the ability to switch the interface to English.

Figure 1: The Chinese language darkweb forum, “Zeroforums”

DarkOwl has been actively monitoring ZeroForums since its emergence, tracking the forum’s growth, content, and associated infrastructure in close to real time. The forum’s promotion and sharing of alleged data leaks and breaches across both its on-platform subforums and associated Telegram channels has been captured through DarkOwl Vision, ensuring early identification and indexing of any alleged breach material distributed through this emerging platform.

Figure 2: The “Zeroforums” was monitored since very early stages of its emergence by DarkOwl

Domain and Infrastructure

Public WHOIS records indicate that the forum was created on August 28, 2026. The forum employs Cloudflare CDN (Content Delivery Network) to mask its real IP address, a common operational security measure among dark web forum operators. However, despite apparent attempts to apply additional OPSEC measures, including the removal of sensitive files from the forum infrastructure and the removal of the favicon, the forum’s real IP address appears to have been identified.

Registration Process

To present a familiar experience to users of established cybercriminal forums, “ZeroForums” employs a registration process closely modeled on platforms such as DarkForums, RaidForums, and BreachForums. Prospective users are required to accept a registration agreement before accessing the registration form.

The registration form requests a username, password, and email address, alongside two separate CAPTCHA challenges to prevent automated bot registrations. Optional fields include language settings, account preferences, and time zone configuration. Upon submission, the user account is created, and a confirmation email is dispatched to the provided address. Following email confirmation, the registered user gains the ability to both view and create posts on the forum.

Figure 4: The registration form of the “Zeroforums”

Forum Structure and Subforums

The forum’s homepage lists several subforums catering to typical dark web cybercriminal activities, including DataBreach, Free Database, Database Requests, Tools and Scripts, among additional subforums.

Figure 5: The Homepage of the forum with the subforums

Staff Structure

Similar to other dark web forums, “ZeroForums” maintains a staff team comprising three tiers:

Administrators hold the highest level of authority on the forum, responsible for overall platform management, user moderation policy, subforum configuration, and the enforcement of community rules. The administrator also sets the operational and ideological tone of the forum through their own posting activity and content curation.

Moderators serve as the day-to-day enforcers of forum rules, managing user conduct, reviewing and approving or removing posts, handling user reports, and maintaining the integrity of individual subforums. Moderators operate under the direction of the administrator.

User Group Leaders manage designated user groups within the forum, overseeing the activity and conduct of members within their assigned communities. On “ZeroForums”, this role is currently held by the same individuals as the moderator tier.

The identified staff members are as follows:

Administrator: Admineirunk
Moderators: Bluecateye and Camelliaonly
User Group Leaders: Bluecateye and Camelliaonly

Figure 6: The Staff page of the forum, the members of the Administrator group, Moderators and User group leaders

Administrator Profile: Admineirunk

Admineirunk is the sole administrator of “ZeroForums” and the forum’s founding member, holding user ID 1 — confirming they were the first account created on the platform. The account joined on May 29, 2026, and has initiated 8 posts and 6 threads since joining.

Figure 7: The Administrator of the “zoneforums” ‘s profile

Forum Statistics

As of the time of writing this report, “ZeroForums’” statistics page records 32 posts across 16 topics, with 70 registered members and the most popular subforum being Free Database. The forum is notably new, and the relatively low volume of 32 posts across 16 topics and 70 registered members at the time of writing should not be interpreted as an indicator of limited threat relevance. Dark web forums in their early stages frequently exhibit low post counts and membership numbers before rapidly scaling in activity and user base, as demonstrated by the growth trajectories of now-established platforms such as BreachForums and RaidForums, both of which began as small communities before becoming major cybercriminal hubs.

Figure 8: The stats page of the forum, displays 32 posts across 16 topics

The forum’s member list displays all 70 registered users across 4 pages of 20 records each. Beyond the staff accounts, registered members are categorized as Junior Members, Newbies, and Account Not Activated users.

Figure 9: The forum listed 70 registered users across 4 pages

Q&A Subforum

“ZeroForums” maintains a dedicated Q&A section addressing common user inquiries on topics including updating personal profile pages, use of cookies, login and logout procedures, and member registration. This section mirrors the support infrastructure observed on more established dark web forums and is consistent with an operator seeking to lower the barrier to entry for new and less technically experienced users.

Figure 10: The Q&A section addressing common user queries

“Admineirunk”, the administrator of the forum, is one of the most active members, with notable posts including “Category: Gaming data in the United States” and “30 million Chinese students”, indicating a direct role in seeding the forum with alleged data breach content. The administrator has also shared two Telegram channels on the forum, one of which is no longer accessible and one of which remains active at the time of writing.

Figure 11: The stats page of the forum, displays 32 posts across 16 topics

Telegram Infrastructure

The Telegram channel shared by forum administrator “Admineirunk” translates to English as “Notification Channel” and has accumulated 6,451 subscribers at the time of writing. The channel is accessible via two Telegram addresses, was created on January 2, 2026, and has been used to share a linked Telegram channel that is no longer online, the clearnet address of “ZeroForums”, and an onion address for the forum.

Figure 12: The “Notification channel” promoting the “Zeroforums”

iShare Supply and Demand Channel

A separate Telegram channel — translated to English as “iShare Supply and Demand Channel” — publishes posts in Chinese and on September 20, 2026, actively promoted “ZeroForums” and the Telegram channel associated with the forum.

Figure 13: The “Zeroforums” Telegram channel, Telegram bot and admin contact shared on another Chinese language telegram channel

New Telegram Channel

Despite the original Telegram channel no longer being accessible, the operators created a new Telegram channel on September 27, 2026, through which they have shared 96 files of alleged data breaches at the time of writing.

Telegram Bot

A Telegram bot linked to “ZeroForums” has been identified, recording 767 monthly active users and associated with 3 community chats as noted on the bot’s profile.

Onion Site

An onion address for “ZeroForums” was shared via the associated Telegram channel. The onion site was not active at the time of writing this report. Further investigation led to the identification of an IP address that appears to host the forum, which upon geolocation references a server based in the United States.

Figure 16: The “IP address that hosts the “Zeroforums” is geolocated in US

Assessment

“ZeroForums” represents a newly established dark web forum with a deliberate design strategy of mimicking the interface, registration flow, and subforum structure of established cybercriminal platforms. Its default Simplified Chinese language setting, combined with the administrator’s posting of content targeting Chinese student data and U.S. gaming data, suggests a primary focus on Chinese-language cybercriminal audiences while maintaining English-language accessibility to broaden its potential user base.

The forum’s use of Cloudflare CDN alongside additional OPSEC measures, including favicon and sensitive file removal, indicates an operator with at least a moderate degree of infrastructure awareness. However, the apparent exposure of the forum’s real IP address, geolocating to the United States, represents a significant operational security failure that may expose the hosting infrastructure to law enforcement identification.

The active Telegram ecosystem surrounding “ZeroForums”, comprising a notification channel with over 6,400 subscribers, a secondary promotional channel, a newly created breach-sharing channel with 96 alleged data breach files, and a bot with 767 monthly active users, indicates that the forum’s operators are actively building an off-platform community infrastructure to ensure continuity of operations and audience retention even in the event of the forum itself being taken down.

All content in this report was identified through DarkOwl Vision during routine dark web and open-source collection. DarkOwl does not endorse, promote, or amplify the content of any threat actors referenced herein. The authenticity of all advertised breach claims referenced in this report has not been independently verified by DarkOwl.