Discord OSINT

All right, thank you all for coming. We're going to get started with the next talk now by Zach Malinich. He has a slide for his own bio, so I'm not going to read his. Turning it over to you, Zach. You can do it. Thanks for the introduction. So, like you said, my name is Zach. Online handle is Uber Zack Attack. Are there any Penn State alums in here? No Penn State alums. All right. Any RIT people in here? Okay, a couple. Um, but yeah, I graduated from Penn State, majored in cyber security, and then by trade I work as a pentester. So, overview of the talk. I'm going to give a preface how OSENT can be applied in

Discord. Um, overview of some of the OSENT methods that I'll be covering, some case studies. I'll be going into how to scale OSEN approach in Discord. I'm not show off a real world example, lessons learned from that. My approach hypothetically of course and then some protections put in place. So to begin with currently I feel like discordosent is currently underutilized and has a lot of potential but at this current moment there's a lot of investment needed to do osen effectively and there's also a lot of risks and consequences involved a lot of this won't be clear until halfway through the presentation so stay tight so OS and Discord I'll be mainly focused on people of

interest and covering how to search Discord for personally identifiable information, interests and occupations of those people of interest, accounts tied to their real name, um even the location that they potentially live in and information that could be used against that person of interest. So to begin with the current methods um kind of originated from an article from Osen Curious. Um ultimately I just covered how to search for Discord servers. So mainly focused on using Google Dorks and Google searches for certain servers like Call of Duty Gaming Discord servers. Um, there's also the built-in explore feature within Discord. And there's also third-party sites like Discordb or Discord to search for servers as well. And then for users of importance, it had

a main focus on identifying the owners, admins, and mods. But usually that's kind of easy to find since the rules are kind of um laid out in a way where the mods are usually at the top of the member list on the right side of the server whenever you're navigating it. So, the methods that I want to focus on today are chat history and the search function, linked accounts, server nicknames, and then one that I'm excited about, mutual servers that not a lot of people really focus on. So, to begin with, the Discord search function. Anyone familiar with Google Dorking, this will probably be very similar to that. um it has operators and it really narrows down your search if

you're searching for something specific. for example, if you're searching for a specific user and if they ever sent a link within a chat channel. And then some the operators um most important ones if you really want to search effectively are from. So you narrow down the user that you're looking for has. Very important to kind of narrow down any type of media, links, embeds, files, videos, images, anything like that. And then if you're in a really populated server and there's a ton of channels, using in will definitely help if you just want to search channel by channel instead of just getting all the channels all at once. And then you can also use keywords with these searches as well. So

for example, specific user password, though I doubt anyone would type their password in Discord, but you can always hope for the best. Um, also depending on if you don't get any results, there are Easter eggs within the search function that you can find. Hence, empathy banana. It's one of the Easter eggs you can get depending if your search fails. So, notable examples from this. Um, first one I have is a picture of someone graduating from college. It is a very big moment, but unfortunately he kind of didn't have the foresight to realize that he was posting this in a hacker discord with his full face um his account name and then also the university where he graduated from.

But this is just an example looking for images of someone. You might be able to find like a very personal image and then tie everything together. And kind of going back to the search function, as I was saying, it's very important to narrow down your search because for example, the one user here, they have over 10,000 results. So manually shifting through that is going to take some time. And then bottom example here might be hard to read, but essentially someone posted their company badge within a photo and didn't realize it. So also they had to be warned since it was a hacker discord. So um second important one that I want to point out are linked

accounts. Um essentially with these you can link accounts tied to a Discord user. So Spotify whatever. And as you can see it's extremely useful. So for this example here, we have their original user and then looking at their about me section within their profile. We already have two accounts uh linked that exposes their real name, which is GitHub and Spotify. They also linked a ton of other social media, mainly gaming apps such as like Battleet, League of Legends, which kind of exposes like a second online handle that you could search for potentially. Then they also have a third one for Epic Games and PlayStation. And then we can see the original username that they have for

their Discord account for Instagram. So, in total, we already have about three online handles that we can search for, including their real name that we can tie everything together with another one. Um, this one can be useful at times, but uh linked accounts are a lot better, but in certain cases, you can actually get different online handles from the nicknames that they set for different servers. So very common use case for this is gaming servers. You have online handle for Discord, but you go by a different username or gamer tag on Xbox. So you change it in the server that you're in, so it's easier to find people. But with these examples here, the one person here had like

two online handles for different servers. And on the other side, this person actually had the real name set as their server nickname. So potentially you can find the real name through the nicknames, but um it's best to look through the linked accounts and nicknames at the same time. So a quick lesson that I wanted to cover are student hubs. Who is in a student hub currently in Discord? Okay, a few of you. So quick lesson essentially allows university students to connect with each other through discord servers. Uh initial rollouts were in fall of 2021. Um and I personally added my own cyber security club to the student hub that I was a part of. So, what it looks like, this one is for

um Penn State University, but essentially it's its own little um it's not exactly like a server, but has a kind of different UI that you can explore. It's kind of similar to the explorer function if you ever use that, but essentially once you use your student email, you'll get like a verification code and then you join. And then once you join the layout is pretty much at the top. It shows the newest servers. These are mainly like location based or like niche communities and servers. So pens example um there's a lot of like branch campuses. So a lot of the new servers that would come in are for certain branch campuses. And then down below you can actually see

like the most populated Discord servers that are tied to the student hub. So the top one is obviously the main Penn State Discord server. The one note I wanted to point out that there's actually unrelated servers with no PSU affiliation. The only way that someone could add their own server to a student hub is if they already verified with their.edu edu email and they have the right level of permissions within that server. So essentially only mods and admins can add their servers to a soonhub. And then on the right side, the very far side, that's where all the members are listed, but that's blurred out since a lot of people didn't realize that they shouldn't put their real name

there since you can see it. So essentially with this with students hubs, this allowed for like a link view in a sense through mutual servers. So I could see that they're a part of the student hub and I could kind of formulate that they probably joined all the Penn State related servers through the soonhub and through this I could kind of gauge what they're interested in and also see their real name if they did add it to the soonhub or a different server for that matter. So this gave me an idea of what if what if I replace what the student hub has already done and swap it with cyber security. So there's pretty much obvious

differences with this approach. So with student hubs is pretty obvious. It's mainly class majors and subjects, clubs and social hangouts and gaming. Then when it comes to cyber security discord servers it's mainly specific fields and subjects platforms and then servers owned by celebs influencers I don't really like influencers the term that much also companies though what's important is what stays the same is the personalities such as the mods and key people admins regulars within the server the ethos and goals for the server and then the target audience and community. So initially starting out if you wanted visibility kind of like with what student hub has you join one server at a time. So for example

defcon but after a while once you join enough servers then visibility improves you can kind of gauge interest from that. So another point of this, it's important to analyze what server you run. So going over what is the server, who owns it, what the goal is, anything specific. A lot of this can be summed up with the five W's. So what it looks like in action with two case studies. So first one, we found this person. They're part of like seven mutual servers that I'm also in, but there's a couple servers that I notice that have like a common theme within them. So, the synopsis is the first one that I noticed was Cyberwalks Academy. It's owned by um Day Cyberwalks

or Day Johnson. A lot of it's geared towards sock cloud security threat detection and kind of the goal audience or target audience is entry level cyber security positions within a blue t blue team side of things and then with this it's assumed to be beginners and intermediate since it's more entry level. There's also security blue team and blue team labs online. Uh essentially it's just hack the box but just purely blue team stuff also soon to be beginners and intermediates and big one hack the box. Uh they have a main platform with the labs they have the academy with both courses anderts and a CTF platform though with this since hacked the box is so big it's assumed to be be beginners

all the way to the professionals. So looking at it all together, there's a heavy emphasis on training mainly aimed towards beginners and intermediates. There's also a heavy bias with defensive security interests. So looking at this person in particular, they're most likely a beginner intermediate level and most likely interested in defensive security and certifications. So for case study number two, does anyone would like to take a guess at this? Anyone mainly within the appsac space? Bug

bounty. Everyone shy. All right. So kind of going back to what I was saying earlier, there's like a common theme that I saw within the mutual servers. So the first one that I saw was the Jay Hatex Discord owned by Jason Haddex. Um through that server there's a course on bug bounty hunting. So with this it's assumed to be intermediates and professionals within web app security. There's also pentester labs uh pretty much a web app pentesting training platform. They have training on ooth's top 10 all the way to code review. So it's assumed to be beginners and professionals in web security and then Kaido niche web security tool pretty much burp sweep but in rust. So al together

now tying it together there's a heavy sorry I can't speak today heavy emphasis on web applications and then training aimed towards intermediates and professionals and then at the personal interest they're most likely at the professional level with heavy interest in the web app security but all this isn't good until you have solid confirmation the inferences and assumptions are only valid once Once you confirm, so this is where you would go back through their chat history, linked accounts, try to find solid confirmation instead of just assuming based on the server that they're in. Though with this, this can also be applied to other things such as location. Uh this is the map of all Bsides conferences in the northeast

mainly though Bides isn't the greatest example since people can travel to them but the potential is still there if the server is um specific enough and tied to like one location then makes it easier to assume. You could also do manual confirmation with this um through a dean anonymization attack. Um the research published on this uh I definitely recommend you go look up Hackmon Dev on GitHub. It's through his gist. But pretty much the TLDDR is that the CloudFare Flare um CDN's um the way that they cache can actually show the location of where the person is. So essentially with this with Discord, what happens is there's person set up a bot, but essentially it will send a friend

request to the person that you're targeting. it will change the profile image to something different, but it recognizes through like a certain hash. And then once the friend request is sent, the person on the other end doesn't actually have to accept it or not. um it just has to like load and then based on the CDN's it will look at like based on the time that it was accessed like which location was used. So in this example it was like LA and then uh Dallas for the CDN. So it kind of guesses where it is. This is more of like uh not as granular as like joining specific servers tied to location, but if you want extra confirmation, then

this is definitely the way. Like I said, I definitely recommend looking this up and reading about it. Uh this also affects signal as well. Definitely a lot of interesting stuff here, but and then notable examples I wanted to cover. So, kind of what I was saying, you want to look for servers that are niche, specific, and have requirements since this will help make stronger assumptions about the person that you're targeting. So, for example, brick dev red, it's a application invite um server based or mainly geared towards offsac professionals. Um, you have to verify that you work for a company. It will send like a verification code to your company email and once you join, you must have your

rule name set as the server nickname. I think it automatically does it through a bot, but that's like one of the requirements for joining. Um, there's a couple interesting ones here as well. So, Evil Jinx Mastery and then Maldev Academy. These two you can only gain access to by purchasing the course that they offer. Um, and Kaido, like I brought up earlier, it's a very niche web security tool. So, it's safe to assume that people that are within that server already know a lot about web. There's not a lot of people that would join that due to popularity or anything. and then student hubs. It's probably the best example of all three of these requirements since it

has requirements with student email. It's specific to that particular university such as Penn State or RIT. And then it can be niche. So if you're into software engineering, cyber security, gaming, stuff like that. The one problem for those familiar with Discord, there's a server cap. So if we want to scale this, we have to deal with this. You can only join up to 100 for free users and then 200 for Nitro users. You cannot use Discord bots since they manually have to be added by the server admins. These are like MI6, Dino, stuff like that. So, we actually need to use actual accounts which are also known as selfbots and Discord's terms and essentially this is just a

game of visibility. There's other issues that we have to consider such as the discord to that definitely be violated. We have to use math which is probably the biggest red flag to understand why this is such an issue and the methods and techniques that I just showed are manually intensive. However, enter spy pet. It was uh publicly announced in ways during April of last year. And in one of the articles, the owner specifically said that it's um definitely for people interested in OSENT. So once I saw that, I had to join it. Pro tip, if you try to buy Salana multiple times in five minutes, your bank will be very upset with you. So, some quick stats. At its peak,

there's 14,201 servers being tracked. Um, about 600 million users being tracked and then 4 billion messages logged. So, one of the things with spyet is that it would show the server info. So, for example, Hack the Box, it would show like the bio that they have, all the stickers and emojis that they have. It also show like member count and who was online at that time. Um, another interesting thing that it showed was like server bands if you wanted to track that. And you could also track user bands

specifically. So, of course, I had to look up myself after I stalked my friends on this, but what it showed was your profile. So, the about me section, and then instead of clicking through the different tabs on your profile and Discord, it would just display it all here in one page. Some other info that was interesting was for your username. It would actually log if it changed and show you the date. And then if you had any server nicknames, it would show where that nickname was from. So a common example is Hack the Box. They have their own Discord bot, but essentially um within your account settings, you're given like an API key that you give to

the bot and once it's linked, it will track your rank and different things like your season progress or certifications, stuff like that. Um some other useful info was the server info. Um, one of the biggest things that surprised me was it actually tracked when you would leave as well. The main selling point was um chat history. Uh, it would capture messages before they were deleted. And then within Spyad itself, you could actually get like a CSV of a specific server and chat logs for that entire server. So with this, I did on Hack the Box, but I did a simple like control F look for a keyword. I was able to find it within Discord as

well, and it actually worked on me as well. Um, the green highlights I'll cover later since they're really interesting, but the red one was actually a deleted message that I posted. I meant to post it in a private channel. I think I deleted it within 10 seconds or so, but um, the main selling point being that it could capture deleted messages, it definitely worked. though the fun had to come to an end since uh Discord found out about it and had to stop the party. So end of the story was the site was taken down. Site owner um unknown at this point. I have no idea where they're at and Discord having the final laugh, but what lessons could we learn

from this? So, the first lesson that popped out to me was OPSSE. There's already a community tracking this um before and they're able to like do OSENT and other things and pretty much they have like a diagram here, but essentially they looked through Cloudfare name servers. They found a second domain tied to Spy Pet with a matching registar. They found a GitHub repo from that. They found a c ton of cat photos and accounts. They looked through way back machine which led them to another GitHub page with um like Bloggo. It's a very specific tool. So it had low star count. So they were able to see the account start that repo. And they also saw that the same

account was in the same Discord server that was tracking them. So, and it also had the same cat photos that they found from earlier from Macedon and then GitHub I believe. Second lesson publicity um didn't get taken down until April and it was online since October 2023. So, it was up for about 5 months, but it took nine days for it to be taken down once it was exposed. Uh biggest thing here was GDPR violations. Um not only did it violate the toss, but the GDPR with the added bonus of potentially storing minor chat history, which is definitely a big no no.

Uh the other lesson was with the main selling point being um logging deleted messages, their original intention for Spy Pet was to harass trans people and people of different pol political beliefs and use the deleted messages as leverage. So once they had a change of heart from harassing to making money then they made some changes on their site but way back machine doesn't lie. So what did it do technically right? So main thing that I was kind of looking for was if it was able to track what servers people were in which it did really well at even when they left as well. the infrastructure seemed to work well as sometimes it was under DOS

attacks but it was like a cat and mouse game. The other big thing was that it was able to view Discord user information. So my approach hypothetically of course is planning an approach on what servers to join, how many accounts to use, which will require math, building better infrastructure that won't be detected, and an opsac obviously. So, the math. So, after some research and looking online, there's about like 1.9 million possible servers of interest that would take this with a grain of salt. Um, this is mainly based on like two stats I saw. One of which was like from four years ago, another being from two with the total amount of servers. Uh the one stat was that 90% of

all Discord servers have less than 15 people in them. And then the total amount of servers was about 19 million. But like I said, those stats are outdated. So at this point, I have no idea. But this is like my best guesstimate. But with this, there's only a few Discord servers that we'd be interested in since if you join heavily populated servers. There's just not be a lot of noise that you have to filter out. Plus, those are mainly just ones that people join for fun since it's the latest trend. And then if we join servers that don't have a lot of people, we're not get a lot of attention. So the other point of

this they that I would want hypothetically to think about it was to join servers with around 250 and 300 people and this is based on Dunbar's number which is a psychology term but essentially it is the amount of people that one person could remember at one time. So like after about 150 people, a person kind of forgets everyone else at that point. So if we kind of go past this number a bit and join the mods or admins won't really look at us too much. So, putting it all together, even if we cut half of those potential servers in half, it's still close to 1 million Discord servers that we would have to join. And with this, we pretty much need

close to 10,000 free accounts or 5,000 paid accounts if you want to up the server cap to 200 with uh Nitro. But this is already close to 50 grand a month. So not really feasible. And then if we want to be OPsack safe, practice good sock puppet practices or rules and then set up multiple cloud instances and set up the infrastructure for it. And then with this using multiple public IPs. So, if Discord does see what's happening and there's about like 4,000 accounts coming from one IP, they're definitely going to raise some questions. And then for perspective, Spy had at least 430 or 143 accounts. So, definitely puts into perspective how big this would be

with scaling it. So essentially we'd have to build out a fully functional tool as well. The main three things that I would kind of want to prove hypothetically of course is having like a tagging system where you could categorize the servers, a check system that would check invite links that have been collected and then see if accounts were removed from the servers and a query system which essentially would just pull user information, messages, stuff like that. Everything else is kind of like buzzwords but some other ideas if you want to approach this hypothetically of course. So finished project just spip but better. You can also think of it as a command and control framework or

botnet. So for opsec, so those green messages that I pointed out earlier, those are actually me joining a server, me clicking the invite link and not fully accepting it and joining again. So for a tip, if you want to stay OPSAC safe, only open invite links through unauthenticated sessions or like a private web browser window. And with this, the cool thing about invite links, it will actually show you the server population as well. So this is where you could reference Dunbar's number to see if you should actually join it as well. Though this works both ways as well. Um, if you keep on joining and leaving as well, the mods are probably going to catch on to that. So in this

case, Dino, it's popular moderation tool. they kept on seeing this one member leaving and joining. They would just troll post like insults or something. So definitely don't do that as well. So for the second tip, if you were to build this out and are worried about other people using these techniques against you, how would you avoid it? So essentially whatever account that you have using to track servers, messages, people instead of having one bot fully to like cyber security and another one for coding, you would split the two communities together so it doesn't seem like one's just fully focused on cyber security. So, for example, if you're targeting somebody in cyber security and tracking their

servers, the one bot would only have three out of the 10 servers that I part of, while the other bot had the other three, and it would make it really hard for the person to track that. So tip number three, kind of like I was saying earlier, if you want to avoid Discord discovering your secret botnet, uh definitely focus on sock puppets and public IPs. So at this point, you might be paranoid. I do have a couple suggestions for those that are. At the user level, take note of what accounts you link and display on your profile through the connection setting. And also be mindful of what you post in Discord. It is still the internet, of course.

So, and if you are a mod or administrator for a server, setting the verification level to highest is definitely the way to go since it requires a validated phone number for their Discord account. Some optional things as well, if you're really paranoid, uh, turning off direct messages and message requests. Um, this is optional but definitely required if you're really paranoid. And the only reason why I bring this up is that there's like a workaround that you can do. So, in the case that you have someone's username and can't find any chat messages, um, it will kind of pop up within the search window that the user is there, but no chat messages are there. So, you

could potentially um go to your friends list, start a conversation, put in their username, and then kind of pseudo send a message request, but don't say anything at all because they won't actually get notified, I believe. I haven't really verified this, but once you do this, it will show the mutual servers tab right below the message request. So, like I said, those protections are optional, but mainly for the really paranoid out of scope ideas. Um, you can consider social engineering with this as well. So, using server boost or befriending the admins. Um, the admins are probably less likely to kick you out if you use super server boost since they give perks to the servers.

Um, and then wrapping it all up, it is feasible to do o OENT and Discord like focusing on chat history, linked accounts, server nicknames, mutual servers to scale. It has shown requires a lot of preparation involvement. You might get caught and it's definitely illegal. So, I don't recommend doing it. And I have to give out shout outs to Brendan no Texas speech who has excellent videos on discord and instantly G. And then final note spy pet was not the first. Discool was similar but it was discovered in 2020 is very shortlived. There was like an unofficial third one right after Discool but that never came to be. So main thing with this is that it's possible for other data miners to

be undiscovered. that might exist currently. And then also the last thing I would like to add is that it's possible to see this capability on other platforms like Gilded. Guilded is pretty much a Discord clone, but I want to anxious to see what it would look like if something does come out for Gilded like this. So with that, this is where you can find me. And yes, you can trust the QR code. It's not a fishing link, but here are my socials and stuff. Thanks for coming to my [Applause]

[Applause] talk. Are there any questions? Yep. When you set up so much presence that you can detect all these mutual servers with people that you're targeting, aren't you also exposing your own? Yes, but like I kind of mentioned like you would want to target servers that are already populated enough. So if you do Yeah. Since there's already so many people that the mods can't remember, then that's easier to blend in. So that means you should go over. Yes. Yep. So, like for example, if you join a server with 15 people, the mods are immediately pick up. Yeah. But if you're number 302, Yep.

red sweatshirt, you thought about uh the antibbot stuff. So, like some servers when you join, you have to type in to a channel saying you accept the terms of service and stuff like that. that's going to affect your ability to like hypothetically scale up your project, right? Do you know what percentage of servers have this type of thing like a type stuff built into them? Percentage wise, I have like no idea. That would be kind of something that you would have to do on your own, but I kind of had the idea of if you get these like bot accounts, you'd pretty much have to manually log into them, manually join the servers, and once they're fully

connected, then let it go. But yeah, uh, one thing to be aware of is Discord is gonna IPO soon, so they'll have an insatiable thirst for cash. Um, so they're going to start introducing all these new features naturally, like ads are coming. Um, so it's possible likely that there'll be ways to purchase API access or data. Obviously, not username or messages, but there might be ways in the future to do like get access to data dash.

Yeah, the API is definitely something worth poking into, but they kind of have a separate API for their own user accounts, I believe. So, that's one of risk that you run trying to automate is once you start like proddding at that one API and doing automatic functions, then it'll be very very hard to kind of integrate Yep. I've honestly like I guess I've been like doing it with like I've made like self bots and stuff and usually they don't even really ban you for like messing with the API and just like making your own self bots. At least like up until I don't know if like it's changed recently, but like Discord's very like like as long as you're not putting them

out in the news, I don't think they really care too much. you just like do whatever, you know, stuff get popular in the old days. Yeah, that's kind of why I brought up the point of um Spy Pet not being like publicly known until like April since it ran for like 5 months and people were already warning Discord about it, but they didn't really do anything until public spotlight got put on. And also the owner of Spy Pet was actually um advertising it mainly to like federal agents of all people and AI trainers since they had like the 4 billion messages. So that's a good point. Yep. Oh yeah, my bad. Um despite that they

had the CSV files that they surely those still exist on breach form someday. uh breach form maybe, but um I would like to imagine that once Discord shut it down, it was just like completely wiped. So there's probably a couple CSV files out there, but I mean some Yeah. So the one of the main drawbacks with Spyet was that since it was only joining like public channels, it couldn't really join private ones. So a lot of the messages sent were just like kind of nonsense, but you could train AI on it, but I don't know, a lot of meme talk, so it'd be kind of hard. Yep. Yeah. Kind of operational. Uh you mentioned in your talk that

originally the system design was designed to attack the market, but then they shifted over to make it profit. Yep. Right. Two questions. one, how long did that last? I know which is money is more important than picking up people followed by, you know, um followed by like how much money did this company make? Um, how much did you pay them? [Music] Um, not a lot, but it was still embarrassing. I forget. It was there was a weird the wallet they used they had like a certain cash limit so it was like I want to say less than 100 bucks but it was kind of like this is way too much for this thing since I know it was be

taken down but um with your point of when it switched I would kind of have to go back through way back machine to see like the change but I know it was pretty much they changed like the wording in their about page and once They set that up. Then they went to like the news outlets and was like, "Hey, use this free tool to spy on your friends and stuff." So that's kind of like is within April, but it was pretty much like five months. Didn't really think of that idea and all of a sudden it's like, "Oh, I could make money on this." So it's good to know that sometimes. Yeah. What was the second part of that

question? You answered it first. Oh, okay. How much money? Uh yeah. So since it's crypto, I have no idea, but I mean I'd like to think not a lot and it's probably already taken away since to GDPR. So yep. So the breaking toos and GDPR was that from scraping of messages itself like if the bot was created simply just to view mutual servers and take nothing else then would that still be uh yes um so with toss it's essentially um like you cannot automate the account at all but kind of like what he was saying they're kind of lax but it's if you like scale it to like spy pet like getting all this data then it becomes an

issue um there are a couple like GitHub tools that automate some of the stuff so you could like try them out but kind of worried that I would get my main account banned for doing that but um with GDPR since it's like very overreaching even like collecting information on what server they're in is like kind of like a privacy violation and essentially just comes down to like how Discord is built since it's like a ton of servers. So knowing what where someone else is is kind of like privacy. If it was meant to be like a private thing, but it's kind of like your own at your own risk. If you do join like a public server, then

there's a ton of bots in it. So like knowledge of mutual servers would be a violation, but it's definitely a violation if you're like collecting all their messages without their consent, especially without Discords or European citizens consent. Thanks for your question. Any others? Yep. Was there ever any sort of organizational like was this it original purpose? Did it come out of like Kiwi Farms or the Chanus or like who was using this? Um I do think so like the there's a video from no Texas speech. He does a really good job of like covering this. But I do think the owner was kind of advertising it in Kiwi Farms at first and they were able to find it since like

all his accounts had the same cat pictures or whatever, but it was kind of sold at first like, oh, we can use these messages against these people. Then it turned into like, oh, why don't I make even more money? But um though I do I think the owner was cop but it wasn't it's like legal like stuff. I forget the term for it but I yeah he also like tied it to Coinbase which requires like real name and stuff. It got taken down. So I think at this point Discord went through got Coinbase involved and stuff. So, and it's one of the things if you do like publicize it, then more people are going to do it. So,

and Discord already has a ton of issues going on. So any others? All right. Thanks for coming to my talk.