Investigating the Discord Exploit that Leaks Your IP!

Sdílet
Vložit
  • čas přidán 9. 06. 2024
  • There are people going around on Discord leaking a bunch of IPs... But how are they doing this?
    Well, apparently there is a Discord exploit that allows you to get someone's IP from their Discord ID. And if you want to use it, you just have to pay the low price of $30 a month.
    This smells like a normal Discord scam, doesn't it. It's not though. This is very much real.
    In fact I've have a handful of people confirm that their real IP has been leaked and I might be one of them. Is this a coincidence? Is this an exploit? Or is this something else?
    SOCIALS
    -----------------------------------------------------------------------------
    Discord Server
    / discord
    Twitter
    / notexttospeech
    TIMESTAMPS
    -----------------------------------------------------------------------------
    00:00 - The Exploit
    03:57 - Am I Being Mislead
    07:12 - Rising Suspicion
    09:01 - Discord's Flaw
    10:41 - But is it a Coincidence?
    12:37 - How Did They Break in?
    13:50 - The Snitch
    17:02 - Something is Fishy
  • Věda a technologie

Komentáře • 2,3K

  • @NoTextToSpeech
    @NoTextToSpeech  Před 3 měsíci +2464

    Update: Restorecord was in on it the whole time. They added the code that allowed people to get IPs from users github.com/restorecord-oss/restorecord-new
    edit: Restorecord DMCA'd the repo to try and prevent people from seeing it. Here's an archive archive.is/DhUUT
    Also the IP ping statement: I made it a joke because cordkiller's first video didn't show them open up any tool, it was IP straight to command prompt. In their later ads they actually show them putting the IP into a tool and using command prompt to monitor if the IP is down.

    • @InfinityDBL
      @InfinityDBL Před 3 měsíci +3

      First?

    • @SpectacularAustin
      @SpectacularAustin Před 3 měsíci +68

      That is insane! Discord should’ve done something about this a long time ago since only scammers use this service.

    • @hi-bk5fe
      @hi-bk5fe Před 3 měsíci

      hi

    • @Mr45Rabbit
      @Mr45Rabbit Před 3 měsíci +1

      dang

    • @Sintered
      @Sintered Před 3 měsíci

      @@InfinityDBL i liked the comment first then

  • @nohalo3forme
    @nohalo3forme Před 3 měsíci +5449

    My favorite bit is that the “lifetime” subscription only lasts 9,999 days

    • @TheFloridaMonkey
      @TheFloridaMonkey Před 3 měsíci +1146

      thats infosecs lifetime, the owner has smoker lungs

    • @nothomebutnotreally3782
      @nothomebutnotreally3782 Před 3 měsíci

      @@UCgx7OseCrundqkE8oEVeobgI’d imagine they’d assassinate you so *technically* it lasted a lifetime

    • @Kero-zc5tc
      @Kero-zc5tc Před 3 měsíci

      @@UCgx7OseCrundqkE8oEVeobgwhich someone could actually get through

    • @piberaroo
      @piberaroo Před 3 měsíci

      They will kill you on day 10k

    • @Arctis1000
      @Arctis1000 Před 3 měsíci +136

      @@TheFloridaMonkeyyour hopes are too high

  • @Signupking
    @Signupking Před 3 měsíci +431

    Sage is the winner in this situation, not only is he the main character of this story but he also got paid for snitching everyone involved.

    • @isaac_marcus
      @isaac_marcus Před měsícem +27

      Reminds me of Let's Game It Out's playthrough of Tech Support Error Unknown, where he just said yes to everything, forwarded all the emails to each of the other factions, blackmailed all the customers, got in serious trouble, got repeatedly promoted, and I think in the end saved the day.

  • @samboiiiiii
    @samboiiiiii Před 3 měsíci +163

    Discord more thrilling than Netflix nowadays

    • @mcfixer9503
      @mcfixer9503 Před 3 měsíci +8

      bro watching grass grow is more thrilling than netflix these days

    • @samboiiiiii
      @samboiiiiii Před 3 měsíci +1

      @@mcfixer9503lmao kinda true

  • @SOS-BFV
    @SOS-BFV Před 3 měsíci +6577

    I already know my ip address. Sorry scammers, better luck next time!

    • @mugitude
      @mugitude Před 3 měsíci +192

      please never ever comment again

    • @SMG5RO_old
      @SMG5RO_old Před 3 měsíci +284

      o ma gaaaa@@mugitude

    • @mirozo
      @mirozo Před 3 měsíci +94

      so true, cuz like what can they do with it. its just IP

    • @MemphisShyt
      @MemphisShyt Před 3 měsíci +15

      i agree, please NEVER EVER comment again

    • @user_x6037
      @user_x6037 Před 3 měsíci +30

      Proof Tell me your ip

  • @hooting-ton5215
    @hooting-ton5215 Před 3 měsíci +2617

    Inf0sec: "Pay us so we will blacklist your IP from our 'service'."
    Me: *Files an information takedown notification*

    • @Ya-Kids-Topic
      @Ya-Kids-Topic Před 3 měsíci +153

      bro graduated

    • @user-cr9cc2nl7j
      @user-cr9cc2nl7j Před 3 měsíci

      I dont think that will work, as inf0sec does’nt store any data, it just grabs it from restorecord.

    • @Cyber_Official
      @Cyber_Official Před 3 měsíci +75

      just like that one RUST game website that tracks users and want them to pay like 5 dollans to remove the tracker

    • @TheColonThree
      @TheColonThree Před 3 měsíci +43

      Nah, let's just send them a cease and desist letter.

    • @authgg
      @authgg Před 3 měsíci +17

      They’re just going to ignore it, these types of people never follow laws

  • @ccost
    @ccost Před 3 měsíci +144

    this leak has a more diverse and entertaining plotline than most movies

    • @authgg
      @authgg Před 3 měsíci +1

      fr I'm glad I'm using vaultcord and dodged this bullet lol

  • @matt_hart
    @matt_hart Před 3 měsíci +68

    the database view at 15:30 is for planetscale and that screenshot doesn't show how many passwords exist. they'd have to click on the highlighted dropdown to view the existing passwords.
    in fact, i'd say that screenshot is proof that there are multiple passwords because the name of the password includes the date it was created, and unless restorecord started november 2023, that's not their first password. and not only that, but it's also pretty good reason to believe that they intentionally gave a password to inf0sec, if inf0sec started around november

    • @Wildcard65
      @Wildcard65 Před 3 měsíci +7

      Actually, if Zeb had access to the web server's code or configuration, they could pull the credentials for the DB and reuse them somewhere else.

    • @keithharvey633
      @keithharvey633 Před 3 měsíci +2

      ​@@Wildcard65 Not to mention they could also easily make a duplicate record for every record put in the restorecord db going into another db, easily making a "live clone" of the database to a separate db, if for some reason they couldn't access the actual db creds. (such as if a 3rd party handler was being used for db read/writes)

    • @user-xl5kd6il6c
      @user-xl5kd6il6c Před 2 měsíci +1

      @@Wildcard65 tbh, this is more likely than anything else

  • @Anatloe
    @Anatloe Před 3 měsíci +1359

    damn that sage guy is literally a double agent lmfao

    • @abc-qj7ve
      @abc-qj7ve Před 3 měsíci +117

      And he didn't even know

    • @discouragements
      @discouragements Před 3 měsíci +111

      i know him on discord hes a little kid who uses tools and tries his best being dangerous lololol

    • @eclipse_formal
      @eclipse_formal Před 3 měsíci

      you dont know him u clown, theres no way this nigga just said that, would be unfortunate if you got EDR'd@@discouragements

    • @satie7
      @satie7 Před 3 měsíci +75

      gotta give it to lil bro tho, he gave this video lots of content

    • @RandomFlyInTheInternet
      @RandomFlyInTheInternet Před 3 měsíci +173

      Bro played both sides and still Lost☠️

  • @Xoremak
    @Xoremak Před 3 měsíci +738

    xenos: "It is impossible for 2 people to possess a sigular password" 😑

    • @Noicer_wastaken
      @Noicer_wastaken Před 3 měsíci +19

      Just copy paste. 😂

    • @mcfixer9503
      @mcfixer9503 Před 3 měsíci

      he might have meant that it's a single-use code
      like when u get a text and it's like "228708"

    • @supperEisMan
      @supperEisMan Před 3 měsíci +36

      Also all databases have activity logs which show all active sessions.... So he is either completely incompetent or complicit...

    • @mlgbeeler420
      @mlgbeeler420 Před 3 měsíci +1

      Hell isnt that how everyone was using netflix? lol

    • @dimitralex1892
      @dimitralex1892 Před 2 měsíci

      @@supperEisManprobably disabled logging for "security reasons"... obviously on the same day the ip leakers went online

  • @wChris_
    @wChris_ Před 3 měsíci +31

    Not disclosing a data breach can get you a pretty hefty fine in the EU under the GDPR, if someone where to report them.

    • @_BangDroid_
      @_BangDroid_ Před 3 měsíci +6

      And everything else they're doing can get them not just fines but criminal indictments in most jurisdictions. I don't think they care about GDPR compliance.

    • @authgg
      @authgg Před 3 měsíci

      the owner xenos and admin zebratic both are commit fraud so they don't care anyways

    • @codegeek98
      @codegeek98 Před 3 měsíci +1

      I can't wait for 16:43 on this very video to become a court exhibit where he stopped stonewalling and admitted finding out about the breach

    • @666222333111
      @666222333111 Před 3 měsíci +1

      Yeah good luck with that. I tried reporting so many website for a bunch of shit and never gotten anywhere with it.

    • @authgg
      @authgg Před 3 měsíci

      @@666222333111 who did you report to though? the OP is talking about reporting to the government for GDPR violations. Since EU supposedly takes that seriously, and the operators of website are also in EU

  • @TanyaTulip
    @TanyaTulip Před 3 měsíci +88

    Shouldn't ever "verify" using links, ever. So many large trusted servers have remote verification when users join them, and it normalizes this concept of verifying externally, which opens you to the epic DDOS threads CordKiller was doing (plus IP leak and shit). It frustrates me, we don't want people to fall for this stuff, and yet we make it super easy by turning it into the norm. Like, wow, what a surprise, clicking an external link may bite you in the back! "well how was I supposed to know r/deltarune requires similar verifiation so i didn't expect any problems!"

    • @erikkonstas
      @erikkonstas Před 3 měsíci +7

      See, the thing is that there are valid uses for this... the mistake is when things get leaked...

    • @heroslippy6666
      @heroslippy6666 Před 3 měsíci +4

      I've seen some of these "verify" tools that requires full access to your account to scan it. ngl this stuff is sus from all directions. I do like the ones that require users to verify inside of minecraft. Pretty cool.

  • @TabouletShorts
    @TabouletShorts Před 3 měsíci +1794

    Sage : "Don't make a video about it"
    Ntts : "Nuh uh"

  • @withawater8784
    @withawater8784 Před 3 měsíci +1113

    At this point it's not the fact that this feature needs to be removed it's just that RestoreCord needs to be replaced with a legit backup service lmao.

    • @McFlare
      @McFlare Před 3 měsíci +53

      true the backing up your server is a good idea but when it's used to get ip's of your members and sell your members data that is way to much

    • @attempting7766
      @attempting7766 Před 3 měsíci +7

      @McFlare I heard that there bot called vaultcord that doesn't log your ip i might use that instead of restorecord now since these allegations are pretty heavy
      😂

    • @withawater8784
      @withawater8784 Před 3 měsíci +1

      @@McFlare True

    • @schwingedeshaehers
      @schwingedeshaehers Před 3 měsíci

      ​@@McFlaresome things you can backup using templates

    • @maselitoamazigh1385
      @maselitoamazigh1385 Před 3 měsíci +5

      i feel like its worse than a databreach , if it was the owner cant just turn it off like that , the sites would still have the data from the breach , feels more like the owner was in on it .

  • @yammerttv
    @yammerttv Před 3 měsíci +52

    There is actually a way to terminate someone's account. It has to do with Discords API guidelines. If you somehow get a hold of someone's Discord token (what you use to communicate with Discord's API); You can essentially just self-bot using their token and get their account terminated. It is quite literally that easy to do so, the hardest part is getting someone's token.

    • @GetZootedSkid
      @GetZootedSkid Před 3 měsíci +6

      I remember my account being termed for self botting because a program I had auto-joined their discord every time it launched and there was no way for me to turn it off at the time. No chance for appeal. Very cool.

    • @FellowCanadian01
      @FellowCanadian01 Před 3 měsíci +2

      Actually@@GetZootedSkid if you go to settings and authorizes apps and try to find the one you did and deactivate it

    • @gan1
      @gan1 Před 3 měsíci +4

      @@FellowCanadian01 he meant an external program joining it, not a bot app

    • @yammerttv
      @yammerttv Před 3 měsíci +18

      @@GetZootedSkid Very simple fix. Change your password. The way that Discord tokens work is a hash of your username, password, the date you joined, and a random salt value. If you change your password your token (hash) will be changed to a whole new value and thus their system won't work on you.

    • @GetZootedSkid
      @GetZootedSkid Před 3 měsíci +4

      @@yammerttv buddy, it was an external program, it was technically a self bot, it was an exe file, not a discord app, not a website, not a token grabber, it was a program file on my desktop that when ran, launched, would also join their discord server. There was quite literally no way of turning it off, and the account is gone. Anyone tryna give me a fix absolutely did not get what I said.

  • @redo1122
    @redo1122 Před 3 měsíci +37

    Firefox has container tabs, which is like a per tab profile. Also there is a program called ferdium, that just lets you login into tons of stuff, including multiple discord accounts. Chrome profiles sound pretty tedious.

    • @ThatMattWhite
      @ThatMattWhite Před 3 měsíci +4

      Not really tedious, especially since you're not limited to one tab.

    • @redo1122
      @redo1122 Před 3 měsíci +1

      @@ThatMattWhite can you open multiple tabs in multiple profiles?

    • @mcfixer9503
      @mcfixer9503 Před 3 měsíci

      @@redo1122in chrome? yes, each profile is a different window. I have 3 windows open with about 2-5 tabs each, for different emails and websites and such

    • @josjos2203
      @josjos2203 Před 3 měsíci

      @@redo1122 Chrome is better cause he also needs an email for every alt so it's more manageable and more separate that way

    • @jaden8923
      @jaden8923 Před 3 měsíci

      ​@@ThatMattWhite?

  • @gmanoffury
    @gmanoffury Před 3 měsíci +388

    "I have ur ip"
    Me with a dynamic IP: *Router goes off then back on*

    • @mycelia_ow
      @mycelia_ow Před 3 měsíci +35

      Prob wouldn't be too hard guessing your new IP, since only a part of it changes from doing that. A simple range search and you're back in their grasp. People rely too much on dynamic IPs 😭

    • @MetheusBatanir
      @MetheusBatanir Před 3 měsíci +3

      Thats sounds useful. Any help or advice how to make my UP adress more dynamic?

    • @uhhno841
      @uhhno841 Před 3 měsíci +2

      me with 3 Ip's thru a alternative method, "what one?"

    • @gmanoffury
      @gmanoffury Před 3 měsíci +26

      @@MetheusBatanir your ISP provides it, you just have to ask them, you can set up a dynamic DNS through windows tho

    • @Ozzianman
      @Ozzianman Před 3 měsíci +21

      ​@@mycelia_ow Meh, I can do resets all day. Or hell, even go dark for a good while. Whoever is trying to scam me will just move on.

  • @NoFailer
    @NoFailer Před 3 měsíci +597

    I have to be a sweaty nerd about this:
    DDoS - Distributed Denial of Service - Multiple networks with multiple machines
    DoS - Denial of Service - one machine
    When people say the first one, they usually mean the second one.

    • @kuba4ful
      @kuba4ful Před 3 měsíci +90

      🤓 ☝
      No but I'm with you on this one, it annoys me when people say DDoS when they mean DoS, and how they proceed to 🤓 ☝🤓 ☝🤓 ☝ you when you point it out 😭

    • @retrics1001
      @retrics1001 Před 3 měsíci +9

      thanks a whole lot google searcher bot

    • @Yilmaz4
      @Yilmaz4 Před 3 měsíci +44

      and even then, the ping command makes requests so slowly that you have to be completely ignorant to call it a DoS

    • @skilledcamman4752
      @skilledcamman4752 Před 3 měsíci +1

      chill

    • @maskettaman1488
      @maskettaman1488 Před 3 měsíci +2

      @@Yilmaz4 I sort of think the ping in the video was just a demonstration of the target going offline, not the attack itself

  • @eliseyzscripts6762
    @eliseyzscripts6762 Před 3 měsíci +8

    Thanks for clearing many peoples paranoia about gettin their ip's stolen out of blue! You're the best

  • @TheMAZZTer
    @TheMAZZTer Před 3 měsíci +9

    Without looking at the context it's hard to say, but the ping thing could just be a way to check if a target has gone down or not (and if not how badly they're lagging).

  • @Maximus27064
    @Maximus27064 Před 3 měsíci +229

    I hope Discord take notice of this instead of being a headless chicken

    • @VeiTheOne
      @VeiTheOne Před 3 měsíci +30

      Bet you they won't. It'll probably hurt their revenue, and we all know these big fat CEOs care about money, not people.

    • @fatsausage-animaatioita4717
      @fatsausage-animaatioita4717 Před 3 měsíci +7

      discord did nothing wrong here?

    • @erikkonstas
      @erikkonstas Před 3 měsíci

      @@fatsausage-animaatioita4717 They still have the "Join servers for you" thing...

    • @numnut1516
      @numnut1516 Před 3 měsíci

      Lmao

    • @n00bxl71
      @n00bxl71 Před 3 měsíci +5

      Discord had literally nothing to do with this. Did you even watch the video. Even if they do take notice, there is nothing that discord is able to do, again, because it's not their issue.

  • @fusedqyou
    @fusedqyou Před 3 měsíci +357

    If Zebratic did all this then it is perfectly possible they have a backup of the database lying around. Xenos is a total moron and nobody should use these services anymore.

    • @erikkonstas
      @erikkonstas Před 3 měsíci +46

      Because there was ever a legitimate reason to use such a service 😂 If you're a server owner and want your members to automatically join a new server in case the old one goes for some reason, just self-host something... which does not even have to be online most of the time, only while you're doing the switch.

    • @trinex64
      @trinex64 Před 3 měsíci +8

      nobody should be trusting them in the first place lmfao, rep is already ass as it is

    • @NFSHeld
      @NFSHeld Před 3 měsíci +1

      If you mean Zeb was using the backup then how would the PW change to the original DB stop the breach?

    • @erikkonstas
      @erikkonstas Před 3 měsíci +1

      @@NFSHeld Remember that these people are not exactly the most logical beings on Earth...

    • @mow_cat
      @mow_cat Před 3 měsíci +2

      @@NFSHeld
      1. zeb could have found out people were looking into it (maybe xenus told them) and disabled the service temporarily
      2. zeb could have really lost access to the database, disabling the service, while still having a backup of the database somewhere
      zeb would have to be pretty dumb not have made a backup at any point im ngl

  • @accountname7738
    @accountname7738 Před 3 měsíci +7

    Nice video! However, the reason why they were pinging the person was not as a DOS attack, it was so that the people watching the video can see when the target goes offline.

  • @SyntaxErr404
    @SyntaxErr404 Před 3 měsíci +12

    16:31 i love this man

  • @ThatOneMfFrFr
    @ThatOneMfFrFr Před 3 měsíci +666

    Hey everyone
    Just want to let you know having your ip leaked is not dangerous at all
    The locations are not very accurate and most of you guys have a dynamic ip address like myself which means your ip changes time to time so dont worry about it
    Edit: if someone somehow is ddosing your ip you can just call your isp and change your ip

    • @retrics1001
      @retrics1001 Před 3 měsíci

      no shit sherlock..

    • @Rocksy7
      @Rocksy7 Před 3 měsíci

      this is simply false you can definitely get things like home address and phone numbers just from an IP using OSINT tools i got someone's phone number just as a test and the facts are changing your ip doesn't change the fact ur phone number is now floating around the internet brother you have to start using logic and brains how the fuck you think people get doxxed and swatted? Not from the person typing out their home address surely enough lmao

    • @cscscscss
      @cscscscss Před 3 měsíci +84

      someone got access to my home's cctv and posted some passwords and emails from it, and took down my router multiple times
      yeahhh sure buddy

    • @epicchip6071
      @epicchip6071 Před 3 měsíci +29

      ​@@cscscscssthats insane

    • @Ransomwave
      @Ransomwave Před 3 měsíci +245

      @css that is because your home's cctv password was not secure enough. they probably just bruteforced their way in because you guys didn't change the default password!

  • @burkino7046
    @burkino7046 Před 3 měsíci +147

    Wait, it happened AGAIN??
    I have a message from 12/22/2023 that talks about IPs being leaked. My friend said that "apparently it's from restorecord"
    Now 2 months later the same thing is being brought up

    • @public13684
      @public13684 Před 3 měsíci +20

      ntts did not want to make a video when inf0sec first came out in december
      verm got early access :P

    • @Arctic-axe
      @Arctic-axe Před 3 měsíci +14

      Bro I knew restore cord is sus I never trust that stupid thing it's so bad and easy to exploit

    • @authgg
      @authgg Před 3 měsíci +4

      yeah vaultcord exposed them last year it was just never admitted before now

  • @Boyga_Official
    @Boyga_Official Před 3 měsíci +6

    "room temperature iq" gotta be the smoothest insult I've seen

    • @NicoBille
      @NicoBille Před 3 měsíci

      Question that remains: roomtemperature IQ in °F or °C?

  • @HGStyleOfficiel
    @HGStyleOfficiel Před 3 měsíci +1

    something people often forgets is that an ip address is designed to be a public info, else it would not be shared with websites.
    the problem is not the ip address itself but your internet provider, because they may sell a database containing all the ips and their locations so people buying it can see people's location. some internet providers only tells the city, some tells the street, and maybe some (never seen this case) gaves the full address to your home. i have a friend who lives in france but has an internet provider that locates him in germany for some reason.

  • @zekrodev
    @zekrodev Před 3 měsíci +323

    I honestly think restorecord should be banned for this. I verified my own discord bot a while ago and I needed to disclose every bit where user sensitive information is stored for what purpose and for how long it is stored. I believe that is for GDPR reasons, but therefore, because RestoreCord can be accessed in the EU as well, this should result in a ban. Whyever would someone log IP addresses in a database together with user IDs. There is literally no way this is necessary ,especially not for reasons they mentioned (like the VPN blocking).

    • @applmango
      @applmango Před 3 měsíci +4

      I think the website would only get banned in the EU

    • @erikkonstas
      @erikkonstas Před 3 měsíci +7

      "Whyever would someone log IP addresses in a database together with user IDs." The only reason would be to answer the question "WHO was it whose alt tried to join my server?", but... that's not its job here...

    • @Lezm
      @Lezm Před 3 měsíci

      Fr

    • @joecooldoo
      @joecooldoo Před 3 měsíci +2

      Developers log your IP address and associate it with an account so if they see you are doing something malicious they can blacklist your entire network.

    • @zekrodev
      @zekrodev Před 3 měsíci

      @@joecooldoo This makes no sense, because most ISPs rotate residential IP addresses on a regular basis. That’s why long term IP banning is effectively useless unless you have a static IP, which is very expensive in most cases.

  • @boxmantherandom
    @boxmantherandom Před 3 měsíci +162

    sage being a snitch literally helped lol

    • @halfsine
      @halfsine Před 3 měsíci +37

      sage was the anti-hero of the story

  • @GoodWerksHelping
    @GoodWerksHelping Před 3 měsíci +2

    This video was insane ntts keep up the good work❤

  • @Nyxar-2077
    @Nyxar-2077 Před 3 měsíci +8

    16:13 bro cooked too much 🔥💀

  • @illumi1749
    @illumi1749 Před 3 měsíci +33

    why was that whole "sage" ark so much more interesting than all your other videos combined

    • @w3w3w3
      @w3w3w3 Před 3 měsíci +1

      $age was funny af hahaha

  • @_VULTAR_
    @_VULTAR_ Před 3 měsíci +86

    This guy is seriously like a superhero for discord

    • @YesSpeechFromText
      @YesSpeechFromText Před 3 měsíci +5

      its spiderman guys!!!!

    • @_VULTAR_
      @_VULTAR_ Před 3 měsíci +8

      @@YesSpeechFromText what

    • @mycelia_ow
      @mycelia_ow Před 3 měsíci

      @@YesSpeechFromText It's YSFT guys!!!!

    • @UnderpaidGuardD9
      @UnderpaidGuardD9 Před 3 měsíci

      ​@@YesSpeechFromText
      Where's MaybeSpeechForText

    • @notrhythm
      @notrhythm Před 3 měsíci

      is there another channel like this, that talks about new scams, leaks, or exploits but not just limited to discord?

  • @aloneshy517
    @aloneshy517 Před 3 měsíci +1

    Thank you for making this video and helping people stay safe online, I keep learning by just simply watching these videos. Keep up the amazing work!

  • @suuper_sam
    @suuper_sam Před 3 měsíci +2

    this is def one of the most craziest things you discovered. everything had so much plot twist

  • @teleportor
    @teleportor Před 3 měsíci +243

    2:06 is crazy

    • @obiotwastaken
      @obiotwastaken Před 3 měsíci +6

      fr 😭

    • @haaxxx9
      @haaxxx9 Před 3 měsíci +6

      That's hot!

    • @Difluoroacetamide
      @Difluoroacetamide Před 3 měsíci +16

      ​@@haaxxx9Fr i couldn't even edge to that, I exploded immediately

    • @Lezm
      @Lezm Před 3 měsíci

      @@haaxxx9😩

    • @mycelia_ow
      @mycelia_ow Před 3 měsíci +7

      @@Difluoroacetamide bro?

  • @dylanharding5720
    @dylanharding5720 Před 3 měsíci +128

    Every single website you visit needs to know your IP - consider a web request as sending a letter. If you don't include a return address, the server has no idea where to send the response to.
    Your IP being leaked is nothing to worry about, and if you are worried, just restart your router.
    IP based geolocation is inaccurate, most people have dynamic IPs, DoSing is not a major concern for anyone, and more and more people are ending up behind CGNAT (tldr shared IPs) anyway.

    • @erikkonstas
      @erikkonstas Před 3 měsíci +2

      Er... try visiting your public IP address, it will most likely lead you to your router's login page (DO NOT LOGIN FROM THERE).

    • @collared
      @collared Před 3 měsíci

      false. entering ur public ip WILL NOT bring up your routers login, unless ur ISP doesnt know what theyre doing lol@@erikkonstas

    • @lunlunnnnn
      @lunlunnnnn Před 3 měsíci +60

      ​@@erikkonstasif your public IP leads to your router's login page, it's misconfigured and you should change its firewall to block this. also, even if you left it publicly accessible, it'd only be a problem if you kept the default password which you should never do for obvious reasons

    • @undefinedchannel9916
      @undefinedchannel9916 Před 3 měsíci +22

      @@erikkonstasI think you misunderstand. Try accessing that IP outside of your network (on your phone with mobile data). It will only be accessible when you are connected to your network.

    • @tomtomi93
      @tomtomi93 Před 3 měsíci

      ​@@erikkonstas as people Said, you should reconfig your router If you can Access it from outside networks

  • @Vsnozu.
    @Vsnozu. Před 3 měsíci +40

    Bro put my ip in the thumbnail

  • @pupsi_cola
    @pupsi_cola Před 3 měsíci +2

    Seeing as their whole thing is "server backups", I wouldn't be surprised if infosec started using a backup of the database or if xenos flat out rolled the servers back.

  • @hededinchesslol
    @hededinchesslol Před 3 měsíci +21

    2:08 buddy

  • @kxlmn1
    @kxlmn1 Před 3 měsíci +85

    Daily dose of ntts helping me learn more about discord than the actual scammers on yt ❤

  • @ButterFromDiscord
    @ButterFromDiscord Před 3 měsíci +3

    This would only work if your id was unique to your ip, but it remains the same no matter what ip you’re on. It wouldn’t be possible for it to be unique since you can be logged in in several devices at once

  • @inqmusician2
    @inqmusician2 Před 3 měsíci +3

    I checked the 192.44 IP and it's the P&G IP. And finding the exact person using the IP is very difficult if you're not an ISP. Because there can be hundreds in your neighbourhood using the same IP as you. Location is more reliable than IP lookup.

  • @jennygracefully
    @jennygracefully Před 3 měsíci +3

    Thank you for making this video and helping people stay safe online!

  • @Heroas_Hamseros
    @Heroas_Hamseros Před 3 měsíci +28

    5:53 GmbH is meant for a German company. GmbH stands for "Gesellschaft mit beschränkter Haftung" translated as "Limited liability company"

  • @MarcoMaurice
    @MarcoMaurice Před 3 měsíci +2

    Ahh this gives me nostalgia for Skype. The world is repeating it self

  • @canhedotricks6078
    @canhedotricks6078 Před 3 měsíci

    The amount of twists in this video is crazy

  • @Dann.y
    @Dann.y Před 3 měsíci +29

    "because theres no way to magically terminate someone on discord" says the person that magically terminated that scammer's account a few weeks ago.

    • @dr1nkndr1ve
      @dr1nkndr1ve Před 3 měsíci +14

      these things get patched quickly, or he knows a discord admin personally

    • @simonnt
      @simonnt Před 3 měsíci +9

      He had access to that guy's bot, it may have something to do with that

    • @WAZZZAAAP1
      @WAZZZAAAP1 Před 3 měsíci

      lmao

    • @erikkonstas
      @erikkonstas Před 3 měsíci +6

      Uh that happened because the scammer was stupid enough to leak his bot token...

  • @AmIBlee
    @AmIBlee Před 3 měsíci +8

    The fact that he actually called the file "Snitch-7" at 17:01 is just funny and i don't know why

  • @Akab
    @Akab Před 3 měsíci +4

    10:35 funfact: every website on this planet logs your ip address, don't need any feature for that.
    A webserver needs your ip to serve you information 👍

    • @kai-o-kai
      @kai-o-kai Před 3 měsíci +2

      Maybe the server logs it, but you do need a feature to actually record it somewhere.

    • @Tom-fy8lw
      @Tom-fy8lw Před 3 měsíci +4

      Very often websites doesn't log the IP (that can get very expensive in the EU), but only saves it temporarily

  • @Daemon125
    @Daemon125 Před 3 měsíci +8

    16:45 Unless they're morons and have the DB port wide open to the internet, the owner is 100% in on it. Changing a DB password wouldn't lock out the other service unless it had a live connection. There would have had to be a networking route between the two. I wouldn't be surprised if they were hosted on the same AWS account

    • @TheRedOGRE
      @TheRedOGRE Před 2 měsíci

      That makes alot of sense. Very suspect.

  • @anonyone8834
    @anonyone8834 Před 3 měsíci +29

    As an indian livung under 1000s of NATs what can you possibly do with my ip?💀💀

    • @nanopi
      @nanopi Před 3 měsíci +7

      That's what they get for only working with IPv4.

    • @_BangDroid_
      @_BangDroid_ Před 3 měsíci

      NAT is not a firewall even if you have 1000, plenty of ways you can traverse NAT

    • @anonyone8834
      @anonyone8834 Před 3 měsíci +2

      @@_BangDroid_ i mean not 1000 but isps here don't give a different ipv4 to every single connection, i don't even know how many nats i am behind.

    • @unknownuser993
      @unknownuser993 Před 3 měsíci +2

      Oh man, as an SRE supporting a service in India, that hit home. That routing really causes pain .😭.
      Sometimes traceroutes show 20-30 even more hops. Shit gets crazy.

    • @anonyone8834
      @anonyone8834 Před 3 měsíci

      @@unknownuser993 I know man, port forwarding etc here is the hardest thing

  • @klafbang
    @klafbang Před 3 měsíci +12

    You actually used to be able to DoS people using ping. Send a "Ping of Death" to a Windows 95 machine, and it will BSOD.

    • @orangejjay
      @orangejjay Před 3 měsíci +4

      The ping of death was not a ping. It was a specific packet that was sent and it was actually called "nuking." There were fun tools called WinNuke that could do this and made IRC vey fun.

    • @SuperBloopie
      @SuperBloopie Před 2 měsíci

      @@orangejjaythe good ‘ol days of IRC channels 😅

  • @unotheguy6
    @unotheguy6 Před 3 měsíci +15

    I was confused this had 155k views but i saw this was uploaded 6h ago. This deserves 1M+ views

  • @CMM47
    @CMM47 Před 3 měsíci +5

    13:40 Nah I think they had an under the blanket exchange 💀

  • @lpoki8897
    @lpoki8897 Před 3 měsíci +4

    It's so wild how many of these websites are made by absolute idiots.
    They know just enough to make systems talk to each other and pull some data.
    And use a website template, and if you said the words "best practises" to them they'd just drool and blink with both eyes.
    And in this case add some maliciousness and greed.

  • @Xudmud
    @Xudmud Před 3 měsíci +3

    8:40 Lucky it was in the last 90 days, given Chrome (and Chromium-based browsers) don't retain browsing history locally longer than that.

  • @jellybean7361
    @jellybean7361 Před 3 měsíci

    Never thought I'd see such a deep rabbit hole and such plot development over discord, a bot and some malicious websites.

  • @worttex8008
    @worttex8008 Před 3 měsíci

    This feels like movie or book to me. Like there's start something that messess with search, suddently clue is found, there's plot and stuff.

  • @doogy_wants_doogcakes
    @doogy_wants_doogcakes Před měsícem +6

    imagine that ip from ohio is watching this video

  • @martim1379
    @martim1379 Před 3 měsíci +2

    2:55 cmd is just to see if DDOS is working or not, ping command is not the actual ddos attack, he is probaly using free DDOS website

  • @PhantomDevelopment
    @PhantomDevelopment Před měsícem

    As a cyber security student I can say that finding someone's IP is the same as looking at the door of a house to break in, attack is depends on how secure the door is, if the door is secure enough you have nothing, attack by only IP is same thing

  • @Lezm
    @Lezm Před 3 měsíci +7

    Thanks man, it’s a relief I don’t use discord often enough to ever come across this bot, your doing gods work, appreciate you bb ❤

    • @yx-su5qf
      @yx-su5qf Před 3 měsíci +1

      Same bro it's the first time I hear about this bot

    • @Lezm
      @Lezm Před 3 měsíci

      @@yx-su5qf yeah, I heard of it it because of this channel, if it wasn’t for him I wouldn’t have heard of it at all

  • @fmoney
    @fmoney Před 3 měsíci +6

    I did not know that you suffer from incontinence No Text To Speech 5:06, very brave of you to make that joke.

  • @brandon659366
    @brandon659366 Před 3 měsíci

    Great work getting to the bottom of this! Subbed

  • @tarmacmercury62
    @tarmacmercury62 Před 2 měsíci

    Almost fell for this earlier. Only reasons that I didn't click authorize is because I noticed that authorizing would send me to a website immediately, and because it wanted to join servers for me. I'm glad I have a bit of common sense to check what bots are trying to do.

  • @resied4620
    @resied4620 Před 2 měsíci +4

    sorry discord gangsters but i already know where i live.

  • @fxturist8534
    @fxturist8534 Před 3 měsíci +5

    assuming restorecord is based in the US or EU, they have up to 72 hours to report a data breach before facing legal consequences

    • @user-uo8ny1kj4c
      @user-uo8ny1kj4c Před 3 měsíci

      It's probably based in India we all know how good they are with technology

    • @spgaming1272
      @spgaming1272 Před 3 měsíci

      it's not a data breach, the owner just gave the creds to the idiot that runs Inf0sec

    • @fegoteron
      @fegoteron Před 3 měsíci +2

      @@spgaming1272 And he accessed the data, which means that data was breached, which means its a data breach...

    • @Ozzianman
      @Ozzianman Před 3 měsíci

      ​@@spgaming1272So it is a data breach.

  • @Nonixgames
    @Nonixgames Před 3 měsíci +4

    NTTS is the only one i could watch and listen for hours without rest, NTTS THE GOAT 🗣🗣🔥🔥

  • @Insignia_
    @Insignia_ Před měsícem

    Man I couldn't care less about what 15 year olds do on Discord, but this almost documentary-like presentation is really catchy. You make it worth watching, great job.

  • @jakeblum907
    @jakeblum907 Před 3 měsíci +6

    7:29 WOMP WOMP

  • @chapichapo
    @chapichapo Před 3 měsíci +4

    Amazing video - this channel is turning into real investigative journalism!

  • @notghostvista
    @notghostvista Před 3 měsíci

    this guy does a greater job on giving others tips on how to be careful more than Discord themselves

  • @GenjiPrime
    @GenjiPrime Před 3 měsíci

    In where I live, having my IP address is pretty useless since it only point you to the server's address which almost never within your city lol

  • @thatpyraguy
    @thatpyraguy Před 3 měsíci +50

    "we are very secure!" -discord
    "U sure?"-NTTS

  • @dxvzera
    @dxvzera Před 3 měsíci +6

    4:04 bro doxxed me 💀

  • @windee5714
    @windee5714 Před 3 měsíci

    atleast the infosec guy was honest and didn’t try to make a fake ip the first time

  • @MoonLiteNite
    @MoonLiteNite Před 3 měsíci

    When doing legal security checks...... and trying to any method DOS attacks, it is fairly common to have a command prompt from another server just pinging your target...
    The main machine you are running the attack from generally is going to be frozen, overloaded, etc, so just running another server with a simple ping command is the best solution :D

  • @luxploit
    @luxploit Před 3 měsíci +4

    4:48 i know this guy from another discord, he really has the IQ of an antarctic thermostat

  • @fxturist8534
    @fxturist8534 Před 3 měsíci +7

    2:48 ermm actually 🤓 (nerd note) this is DOS and not DDOS (also on one of my classes we did a little funny DOS attack on my city's website to see views counter go up on one of the posts lmao)

    • @undefinedchannel9916
      @undefinedchannel9916 Před 3 měsíci

      they DDoS it in the background while using ping to check if it’s still up

  • @psapple5858
    @psapple5858 Před 3 měsíci

    this reminds me of when there were rumours of people grabbing ips through discord vc.

  • @user-vg1ic3hk3l
    @user-vg1ic3hk3l Před 3 měsíci +3

    11:43 an anime PFP and a Hellenistic statue PFP. Perfect duo😂

  • @captheobbyist6434
    @captheobbyist6434 Před 3 měsíci +18

    a lot of people are worrying about their ip getting leaked but it's not that bad at all.
    first of all your ip can only show approximate location
    second of all ip change from time to time when for example router reloads so they are dynamic
    and third of all, your ip is being sent EVERY time you access ANYTHING on internet. even just turning on your computer or mobile, you send thousands of requests to various domains.

    • @erikkonstas
      @erikkonstas Před 3 měsíci +1

      This "Your IP is sent every time you connect" argument is nonsense, yes it's true but that's not why we worry about IP leaks at all. The problem is when your IP ends up *in the wrong hands!* And, if you happen to be actively running the thing that leaks your IP, you'd end up doing reboot after reboot to your router, because it will be getting leaked every time... and no, your location is not what they want, your DoS-ability is what they want.

    • @collared
      @collared Před 3 měsíci

      its not even approximate but very innacurate. the location ip lookup gives me is about 300km away from my actual location lol

    • @lunlunnnnn
      @lunlunnnnn Před 3 měsíci

      ​@@collaredit depends, I have multiple public IPv4s at home, and with one of them you can get the town I live in, and with the others you can get an exact address if you know the right tools. but I will admit that my setup is unusual, and for most people this isn't something they should worry about, like who the hell has an entire /29 block assigned to them

    • @SioxerNikita
      @SioxerNikita Před 3 měsíci

      @@erikkonstas Getting an IP is not that hard if the person is doing anything multiplayer.
      Most fast paced games will use some peer-to-peer data along with a server to speed up player interaction speeds.
      If you play a video game, everyone there has your IP...
      Your IP being leaked is 99.9% not an issue, especially if someone has genuine hacking skills to leetz0rz hack you, the IP is not going to be the limiting factor...
      If you have a secure network without shitty unsecured smart devices, then it is very limited what someone can do with your IP... Most people also don't have a static IP, so turning off the router will give you a new one...
      Denial of Service is the only semi relevant thing you can really do with an IP these days on a decently secured network

    • @SioxerNikita
      @SioxerNikita Před 3 měsíci

      IP doesn't even show location. The IP geolocation is third party companies linking IPs to areas.

  • @Oryie
    @Oryie Před 3 měsíci +4

    5:13, cool to know

  • @marionascimento450
    @marionascimento450 Před 3 měsíci +1

    Haven't finished the video yet (7:55) but this is something I (we) have been doing in multiple servers for many years now (at least 3), discord bots disguised as verification bots, among other things, which get not just your IP but the user-agent, your email and connected servers, etc. depending on the scopes, as you verify or log in or authorize it all goes into a database. This in dozens of servers with dozens of thousands of people.
    EDIT: After watching a bit more, it is confirmed, but this is by no means the only bot stealing data, there are hundreds.
    Also: Zebratic doesn't need access to the database. Xenos said he had access to the servers, if that's true, he can get the IP/User-Agent, etc. anyway and send it to another database he controls, in addition to Restorecord's, without ever having access to their db. On the other hand, he also said only the servers have access to the DB and Zebraic only had access to the servers so it's also possible depending on the exact permissions he has that he can see the whole credential to connect to the DB. In any case, it wouldn't be necessary and not even desirable, you want to be more stealthy than that and if you're not managing the db you don't want logs accessing all the records.
    EDIT 2: It seems this was really RC db or he was in on it somehow. It was done in a very poor way, hence why it was discovered so easily. Anyway, it's a good thing for everyone's privacy, good job you and bad job RC!

  • @vermamaerodriguez96
    @vermamaerodriguez96 Před 3 měsíci

    got a ad saying "no text to speech viewers." that is terrifying ad is called Dscord backups

  • @osfanbuff63
    @osfanbuff63 Před 3 měsíci +6

    4:56 only in Ohio

  • @V530-15ICR
    @V530-15ICR Před 3 měsíci +3

    4:35 Ohio ip

  • @Reelix
    @Reelix Před 3 měsíci

    Great video - Well researched :)

  • @fayking
    @fayking Před 3 měsíci

    love ur stuff bro, this one is cool asf

  • @dascraazy
    @dascraazy Před 3 měsíci +3

    0:56 bro has furry in dms hell nawwww

  • @MrnicemanRBX
    @MrnicemanRBX Před 3 měsíci +3

    Bro links his IP 💀💀💀 7:47 here where he leaks his IP.

  • @GetZootedSkid
    @GetZootedSkid Před 3 měsíci +2

    They are doing a "NTTS Special deal" now, gonna assume this was probably part of their plan.

  • @xchronox0
    @xchronox0 Před 3 měsíci

    I'm glad that not a single server I've ever joined has ever made me verify with any sort of bot, aside from the few that are like "pls react emoji to agree to rules!"

  • @realslimshaco8550
    @realslimshaco8550 Před 2 měsíci

    If you're an OG you remember being able to do this on Skype back in the day

  • @bio09029
    @bio09029 Před 3 měsíci

    being considered a missile to avoid for scammers is crazy 😭

  • @cinderwolf32
    @cinderwolf32 Před 3 měsíci

    5:10 is the most chaotic sequence of deadpan narration I think I have ever heard in so little time

  • @Ieeuwz
    @Ieeuwz Před 3 měsíci +2

    He must of been using the live database for the data, how would resetting the login to a database break a whole website? They can just dump the database and import it on their inf0sec project and still search through existing records no?

  • @rameater1557
    @rameater1557 Před 3 měsíci

    I remember in my network security class, we 100% used terminal to practice ddosing. We also used tree to simulate that we know hacking too.