BreachForums logs reveal anonymizers of choice for shady characters

When threat actors log into systems, they don't use their real IP addresses. Instead, they route their traffic through VPNs, proxies, and anonymizing networks. We analyzed a January 2026 data leak from BreachForums — a major English-language cybercrime marketplace — that contained threat actor IP addresses. The analysis can help Okta administrators make evidenced-based decisions about risky login behaviors and how to use controls to limit logins from dodgy virtual private network (VPN) services or anonymizing networks.

IP addresses are key indicators of compromise. Attackers don’t want to use IP addresses that could be potentially linked to their real-world identities if law enforcement obtains warrants or subpoenas that will be honored by service providers. This pushes them to the corners: virtual private network (VPN) services that promise to not retain logs, anonymizing proxies and so-called “bulletproof” networks. The desire to protect their identity extends not only to when they are staging attacks but also when threat actors log into forums and marketplaces used for cybercriminal activity.

Underground forums occasionally experience data breaches, and these leaks are an informative source of open-source intelligence. In January 2026, a dataset from a cybercriminal forum known as BreachForums was publicly released. The data compromised registered users from the forum, including nicknames, hashed passwords, email addresses, and IP addresses, with the data current as of around October 2025. 

BreachForums was a mainstay of the English-speaking cybercriminal underground, offering tools and services for fraud and cybercrime, guides, malware and served as an advertising platform for selling data leaks. It was the successor of RaidForums, which was taken offline by law enforcement in April 2022. BreachForums was disrupted by law enforcement at least twice since its first iteration in March 2022.

BreachForums ran on the MyBB open-source forum software on a MySQL database. The user database included many fields, including registered email addresses, hashed passwords, the IP a user registered to the forum and the IP of their last visit. Below is the full list of data fields.

The database contained nearly 324,000 rows. Some 235,208 rows have a “regip” — a field that is short for “registration IP,” which is the date an account was registered — and a “lastip” — a field indicating when someone last logged in — of 127.0.0.9. This IP address is reserved for localhost or loopback routing. This is odd. It could mean the forum was incorrectly configured, which caused the logs to be inaccurate, or may have been intentional. However, more than 88,700 IPs have “lastip” values that are not 127.0.0.9. 

We decided to look at these IPs and their corresponding ASNs to understand what services registered BreachForums participants used in order to preserve (or, in some cases, not preserve) their anonymity. The theory: If threat actors trust these networks, these networks may also be favored to launch various identity-centric account takeover attacks.

Underground cantina

All kinds of different personas logged in to BreachForums, and not just cybercriminal actors. Think of it as the online equivalent of the Mos Eisley cantina, the rough-edged alien bar in the original Star Wars film where creatures from around the galaxy mingled. Serious cybercriminals might be sitting at the bar, law enforcement and CTI professionals are lurking in the booths.

This means we can’t say that all of these IPs absolutely belonged to threat actors, as law enforcement and cyber threat intelligence (CTI) researchers may use the same services in order to blend in. Nonetheless, that blend of usage can provide an even higher degree of likelihood that requests coming from these ASNs, IPs and proxies are less likely to be “normal” users, and it’s also less likely that blocking them are going to trigger false positives.

Should requests from networks abused by intrusion actors be subject to more restrictive policies, or even blocked outright? 

Mature environments tend to allowlist trusted networks and deny requests from all others, so analyses of IP reputation aren’t required. That being said, it’s not always easy to create a known baseline, particularly in organizations with a large “extended network” of third-party partners or independent agents.

For these organizations, the first step is identifying legitimate sign-ins from these services. Administrators can identify successful sign-ins from any given ASN in Okta Identity Engine using the following query:

To provide additional context, Okta Threat Intelligence performed a quick analysis of success:failure ratios at authentication for each of the top 20 ASNs in the Breached Forum list over the week prior to publication, across all commercial Okta orgs. 

The analysis reveals that requests from several of the 20 ASNs most frequently observed in the BreachForums leak fail four to five times more frequently than they succeed.

Our methodology compared successful authentication events (user.authentication.verify) with failed authentication events (failed sign-in events, plus those requests Okta identified as threats and blocked at the network edge). It did not differentiate between workforce and customer identity systems. The data does not include requests denied via customer use of Network Zone policies - this would double or triple the number of “failed” requests if it were included.

We ran a sample of 16,044 email addresses through Have I Been Pwned, the data breach notification service, to see where else the same addresses may have been leaked before. This doesn’t mean that the email addresses have actually been registered, but if an email address appears in another breach, it may be more probable that the email address exists.

Of the 16,044 email addresses in our sample, 10,200 email addresses appear only in the "BreachForums2025" data, and 7,515 are Gmail addresses. This suggests that BreachForum registrants heeded the advice of one of its administrators, who advocated use of “disposable” email addresses, or those used for a single purpose and not for other accounts. The remaining 5,844 accounts appeared across other large data breaches related to information stealing (infostealer) malware logs.