0

I was on Discord, and someone sent me an invite to a server called "Operation: Pridefall".

I didn't know what it was, the link is http://discord.gg/xxxxxxxxx - and the invite was legit.

I thought it was just a regular chat. I looked, and there was some IP addresses being leaked.

I asked the person who invited me, "What is this?". They said "Look it up, it's exposing LGBT people"... I do not hate gays at all, and so they might dox me.

I have changed my discord password. But I don't know what else to do, and if this is legitimate. I do not know if it's possible to hack someone through a Discord invite.

Please let me know what to do.

Improve this question
19
  • 3
    If someone knew my public IP, they can roughly tell which part of the country I'm from. My IP right now is 212.95.8.233. I'm telling you that because IP alone means nothing.
    – user163495
    Jun 1, 2020 at 9:30
  • 2
    "Is it possible..." are bad ways to frame a question in information security. I don't know how the Discord app works internally. There might be a vulnerability that allows this, there might not be. The only answer I can comfortably give is "I don't know for sure". However, I think you worry entirely too much about this.
    – user163495
    Jun 1, 2020 at 12:23
  • 2
    I think you should just calm down and keep cool.
    – user163495
    Jun 1, 2020 at 12:44
  • 2
    Do you know what "doxxing" means? It means publicizing private persally identidfiable information, such as your name, your address or your social security number. An IP address is none of these things.
    – user163495
    Jun 1, 2020 at 14:34
  • 2
    I would do none of those things
    – schroeder ♦
    Jun 1, 2020 at 16:25

2 Answers 2

Reset to default
5

Discord itself is entirely server-based, as described in this Discord blog post. In other words, your client is always directly communicating with a Discord server, which then re-sends your data to other clients. That means any potential attacker will see the Discord server's IP and not yours.

However, that doesn't have to be the case for other online services, which you can link in your profile. When you join a server, other users, as well as bots and user-bots, in that server will gain access to the data in your Discord profile, which they can scrape and potentially use to track down your IP. You can see which services you have linked to your account by going to the User Settings and choosing the Connections category.

Your best course of action right now is staying calm. They might try to use the pressure to their advantage and try to direct you to a phishing site to get your Discord credentials or scan a login QR code. By just following an official Discord invite (the https://discord.gg/xxxxxx format), your credentials are safe.

Furthermore, the things you described do violate the Discord's Terms of Service in multitude of ways. You can report the server to Discord's Trust and Safety, as described in this support article.

After you're done with the report (since it requires you to get the server ID, which requires you to be present in the server), or immediately, if you're not planning on making a report, I recommend you to leave the server and report + block anyone trying to threaten/blackmail you afterwards. You're most likely not dealing with a nation-state or an organized crime group, just a group of kids having no better way to entertain themselves during the quarantine, and are safe to ignore their threats. After all, credible online threats can still be subject to prosecution and should things escalate even more, you can report them directly to the authorities.

Lastly, as a general advice, I'd highly recommend enabling two-factor authentication on Discord if you haven't done that already.

Improve this answer
1
  • Comments are not for extended discussion; this conversation has been moved to chat.
    – Rory Alsop ♦
    Jun 2, 2020 at 13:58
1

I don't think much bad can come out of you just joining the server and leaving it shortly after. AFAIK, most people have dynamic IP addresses, meaning your IP address will change about every time you connect to the Internet. This means that somebody recording the IP address from which you connected isn't that much of a threat. I think that Discord should be relatively secure, so I don't think you can harm someone via an invitation. Even changing the password seems like an overkill, although it's good that you take your security seriously and it obviously never harms to change your password. Googling "operation pridefall" has returned some info on it, you might want to check it out for context. To me it seems like people behind it are just extremist trolls wanting to spread mean comments around the time of pride month, not someone very dangerous.

To sum up, I don't think you have something to worry about and I wouldn't worry too much about personal security. Observing good security practices, like using up-to-date operating system and software, choosing more secure software alternatives to less secure ones, using strong passwords and two-factor authentication, at least where it matters, is always good. Aside from that, doxing might potentially be a crime, depending on details and jurisdiction, so perhaps reporting it might be appropriate, either to Discord or to local law enforcement (or both).

All of the above is just my opinion and contains some subjectivity. It can also be at parts inaccurate. Normally I would not post such an answer, but you seem distressed, so I thought that my outlook will be better than nothing.

Improve this answer
13
  • Further, I joined the server twice. Didn't click any links. But, my worry is that links aren't needed for some hackers (they seemed professional).
    – Carl Johnson
    Jun 1, 2020 at 10:25
  • 1
    By no means let yourself be "social engineered" into doing something that attackers could actually use. It's best not to talk at all with them. Threatening the victim into giving some information, going to a website (which could try to infect you're machine with malware for example) or anything like that could actually enable them to do some damage in some circumstances.
    – Hubert Jasieniecki
    Jun 1, 2020 at 11:00
  • 2
    Accessing someone's phone like that is really top notch hacking that I really, really don't think could happen here. I know various national security agencies can manage it. About your IP you can check it by just searching "what's my ip" in Google or DuckDuckGo. You can note it down, then disconnect from the internet and check back after a while. It's most likely to be different then.
    – Hubert Jasieniecki
    Jun 1, 2020 at 11:03
  • 3
    Factory reset is already too much in my view. I wouldn't recommend doing even that. Of course if you want to do that and it will make you feel safer it won't hurt, but I don't see a reason to go to such extremes. Just logging to a Discord server from a phone is not enough leverage for them to gain access to your device. To be continued
    – Hubert Jasieniecki
    Jun 1, 2020 at 11:24
  • 2
    The main technique of such "hackers" is scaring someone into doing something they would benefit from, either by gaining further leverage (for example they ask someone to email them to get real name, from there they can checkout Facebook etc.) or by direct extortion of goods. They might also enjoy scaring people and getting the feel of power over them. The truth is, it's unlikely there's any real power involved. 20 years ago it was different, as many services and devices were poorly secured, but nowadays you should be just fine if you observe good practices and don't talk to those goons.
    – Hubert Jasieniecki
    Jun 1, 2020 at 11:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.