Discord OSINT

Introduction to OSINT on Discord

This presentation explores the underutilized potential of Open-Source Intelligence (OSINT) on Discord, highlighting its capabilities and risks. While effective OSINT on Discord requires significant investment and carries consequences, it can reveal personal information, interests, occupations, real-name accounts, potential locations, and data that could be used maliciously.

Current OSINT Methods on Discord Server Discovery

Google Search: Using Google to find Discord servers.

Discord Explore Feature: Utilizing Discord's built-in server discovery.

Third-Party Websites: Platforms like DiscordB and Discord.<0xC2><0xA0>## Discord Search Functionality

Discord's search function is akin to Google dorking, offering operators to narrow down searches. Key operators include:

from:: Filters messages from a specific user.

mentions:: Finds messages mentioning a specific user.

Date operators (before:, during:, after:): Filters messages within a time window.

pinned:: Searches for pinned messages.

Keywords: Can be used to find specific terms, potentially uncovering Easter eggs like 'empathy banana'.

Notable Examples:

A graduation photo revealing a full face and university name.

Discovering over 10,000 messages from a specific user, highlighting the need for operator use.

A desk setup photo inadvertently showing a company ID badge.

Linked Accounts and Server Nicknames Linked Accounts

Discord profiles can display linked external accounts (e.g., GitHub, Spotify, Instagram, PlayStation, Epic), providing multiple online handles and potentially real names.

Server Nicknames

Often used in gaming servers, users change their nickname to match their console or gaming platform username for easier friend requests.

Can sometimes reveal a user's real name within mutual server contexts.

Mutual Servers and Student Hubs Student Hubs

A feature allowing university students to connect via servers tied to their university, rolled out in Fall 2021.

Requires a .edu email address for server addition.

Can reveal personal names used as server nicknames and provides a linked view of mutual servers.

Applying Student Hubs Concept to Cybersecurity

The concept can be adapted to cybersecurity by analyzing servers related to specific fields, platforms, or companies.

Analysis Focus: Server ownership, purpose, goals, target audience, and community.

Case Study 1: Beginner/Intermediate Defensive Security Focus

Mutual servers indicated interest in beginner/intermediate defensive security and certifications.

Examples: Cyberwalks Academy, Security Blue Team, Blue Team Labs Online, Track Acme, Hack the Box.

Case Study 2: Intermediate/Professional Web Application Security Focus

Mutual servers pointed towards intermediate to professional levels with a strong interest in web application security.

Examples: Jay Haddock's Discord (bug bounty hunting), Pentester Labs, Kaido (Burp Suite tool).

Confirmation: It's crucial to confirm inferences made from mutual servers by examining chat history and linked accounts.

Advanced Techniques and Data Scrapers De-anonymization Attack

Researched by Hacker Hackmon Dev, this method can potentially reveal a person's general location by exploiting Cloudflare CDN caching.

Notable Mutual Server Examples for Stronger Inferences

Breakdev Red: Application/invite-based server for offsite professionals.

Evil Jinx Mastery & Melddev Academy: Servers accessible only after purchasing a course.

Kaido: Niche web tool server.

Student Hubs: Requires .edu email and offers niche clubs/subjects.

Challenges in Scaling OSINT

Server Limits: Free users have a 100-server limit, Nitro users have 200.

Self-Bots: Using actual accounts (self-bots) is against Discord's Terms of Service and manually intensive.

SpyPet

A data scraper that made headlines in April of the previous year, designed for OSINT.

Tracked 14,000 servers, 600,000 users, and logged 4 billion messages at its peak.

Features: Server info, member counts, user bios, usernames, nicknames, linked accounts, past usernames, and deleted messages.

Downfall: Shut down by Discord; the owner disappeared.

Lessons Learned:

OSINT Backlash: Users performed OSINT on the SpyPet individual.

Publicity: Its takedown was relatively quick after gaining attention.

GDPR Violations: Potential storage of minor chat history without consent.

Intentions: Initially aimed at harassing trans people and political dissidents, later monetized.

Technical Capabilities: Tracked server memberships, user information, and captured deleted messages.

Discord Unveiled and SearchCord

Discord Unveiled (May 2025): Brazilian researchers scraped 2 billion Discord messages from 3,000 servers, tracking 4 million users.

SearchCord: A much larger platform than SpyPet, scraping nearly 64 billion messages from 95,000 servers.

Goal: To replace forums and make Discord public server messages accessible online.

Data Collection: Scraped discoverable servers through Discord's discovery feature, accessing public channels.

Features: Extensive statistics, historical data (oldest message from 2015), replicated server interfaces, and keyword-based search.

Limitations: Users could not be searched individually; searches required context within a server.

Shutdown: Shut down quickly after its release, following the Discord Unveiled research.

Owner's Post-Mortem: The owner detailed the project's creation with limited programming knowledge, privacy issues, and the decision to shut it down due to popularity.

Undisclosed Data Scrapers

The creator of SearchCord mentioned other data scrapers, including those advertised to cybercrime groups.

Example: Focus on mental health servers for extortion, potentially targeting minors.

New Data Scraper (Europe-based)

A newer, non-public data scraper focusing on online game servers and increasingly Discord messages.

Activities: Doxxing individuals, advertising on YouTube, operating on Cloudflare (later switched to DOS guard due to reports).

Stats (as of July): Growing from 800,000 messages and 5,000 servers to 1.5 million messages and 6,000 servers.

Protections and Key Takeaways User-Level Protections

Remove Linked Accounts: Disconnect external accounts from your Discord profile.

Mindful Posting: Be cautious about what you share online; assume everything is public.

Server Admin/Moderator Protections

Highest Verification Level: Require phone number verification for users joining.

Disable Server Discoverability: Do not make your server discoverable to prevent data scraping.

Optional Protections

Disable Direct Messages (DMs) and Message Requests: Prevents unknown users from contacting you or seeing your mutual servers.

Final Takeaways

OSINT Feasibility: OSINT on Discord is possible using chat history, linked accounts, server nicknames, and mutual servers, but scaling it is challenging, potentially illegal, and requires significant preparation.

Data Scrapers: Two main forms exist: botnets and scraping public/discoverable servers. This trend is likely to continue.

Discord Privacy: Discord is less private than perceived; data from public channels may be collected. Private channels, group chats, and servers are generally safe.

Historical Context: SpyPet was not the first; Discool (2020) had similar capabilities. Other undiscovered data scrapers likely exist.

Cross-Platform Risk: Similar data scraping capabilities may exist on competing platforms like Guilded.