In this timeline (currently being updated) we show the main events related to the alleged seizure of the XSS underground forum.
In addition, here you can find an analysis of the moderators present on the date of the alleged seizure and their latest activities performed on the forum (updated to July 24, 2025).
Links to discussions on the same topic on other underground forums are also provided.
July 23, 2025
Notice of seizure by the Paris court
The news of the arrest of one of the admins of the XSS forum and the seizure of the froum itself has been made public.
Meanwhile, the site is available on the Tor network.
For a few hours the xss.as mirror is also up, but then it goes down.
See details here
July 23, 2025
The news is making the rounds on Telegram chat
July 23, 2025
DDoS attack on the Tor site
While the clear web site xss.is displays a seizure page, the site in the Tor network is subjected to a DDoS attack.
July 24, 2025
Creating fake alternative TLD domains
On July 23, three new TLD domains were registered: xss.site, xss.online, and xss.forum. The following day, moderator ordinaria1 stated in the thread /threads/142437/post-1010800 that one of these domains, xss.forum, is a fake. No comments appear for the other registered domains.
July 24, 2025
XSS Admin Notice #1
In the thread /threads/142437/page-14#post-1010697, the XSS forum admin communicates for the first time since the seizure and says:
Guys, the main server is not affected. All efforts are focused on replacing the infrastructure. The forum and Jabber may be unavailable for a short time in the near future. Domain shutdowns are a common occurrence. Don’t panic. As soon as I figure out the situation, I’ll come back with an answer.
July 24, 2025
XSS Admin Notice #2
In the thread /threads/142437/page-14#post-1010697, the XSS forum admin communicates for the second time since the seizure, stating that the other admin, Toha, is unavailable, but that the seizure scenario had been anticipated in any case, and that the forum’s backend and backups are safe. The admin also provides the link to the new domain in the Tor network.
August 02, 2025
XSS Moderators Say the Forum Is Now Police-Controlled, Launch Alternative board: “DamageLib”.
XSS moderators claimed that they could not verify the identity of the “new admin”, who maintained the site accessible on Tor after the clear web domains seizure by law enforcement. Unable to confirm that the new XSS administration is trustworthy, they concluded that XSS is under police control and have spun up a replacement forum built on the DamageLib project and posted their first statement there.
August 02, 2025
Damagelib Forum Message Details
August 02, 2025
Update message on the new Tor website
An update message appears on the new Tor site, announcing that the forum will be undergoing maintenance.
The message says that the XSS onion site should be back up in 5 hours. Meanwhile, the new domain registered for use on the clear web (xss.pro) has been announced. The registrar used (Hosting Concepts B.V. d/b/a Registrar.eu) is really strange. Even the SSL certificate issuer is strange to be used for a forum like XSS which before the seizure mostly used Let’s Encrypt.
The A record of the new domain points to the IP 185.221.215.29, the same as the A records of the xss.forum and xss.online domains.
August 03, 2025
XSS Admin Notice #2
A new message (“Completion of infrastructure transfer”) from the XSS admin appears. The message states:
1) The forum has been restored with the backup from August 1st.
2) All moderators and the admin have been removed. Currently, besides the admin, there is only one moderator, a user named W, who registered on the forum today. The admin has opened a recruitment process to find new moderators for the various sections.
3) It appears paid scraping will not be possible in the new forum.
4) Most of the deposits in cold wallets appear to have been seized (the admin mentions over 55 BTC).
Interesting fact: the forum logo now features the Russian flag.
In the replies to the post, many users question the reliability of the content.
August 04, 2025
Tor network site down for a few hours
Since the morning of August 4, 2025, the Tor network website has been down. The clear web domain website is also unreachable.
The site was then back up and running after about ten hours.
August 05, 2025
Work in progress on the new site
For the first time since the domain xss.pro was registered, content appears on the clear web site. Specifically, a message warning that DDoS protection is being implemented to respond to attacks by former forum members.
The same message also appears on the Tor network website.
August 9, 2025
Forum back up with new anti-DDoS protection
The forum is back up again. The admin reported that following the migration to the new infrastructure, the forum has suffered several DDoS attacks.
The admin also reported that the mail server used by the forum is also undergoing reconfiguration and that the clearweb site will also be restored during the day.
August 12, 2025
New XSS moderator
A new moderator, using the moniker Flame, has been added to the forum. Flame has been active on XSS since February 9, 2020, but his interaction was virtually nonexistent until July 2025, when he began posting a few times in threads related to the alleged hijacking and subsequent migration of the forum’s infrastructure.
The new moderator is receiving a lot of negative criticism precisely because of his “promotion” to moderator without ever having contributed significantly to the forum.
