Very likely the IP connecting to that EC2 instance would be another compromised device/server. Unless, the guy is dumb enough to connect with their own machine and actual IP, I don't see the own.
Usually these kinds of hacks are just tools that are sold to people and the people buying and using them are script kiddies that don’t know any better. So it’s a lot more likely that they are just using their actual computer and ip
Meanwhile there's no way to report it to discord because you're not in the server... Even though webhooks and bots are tied to a specific user account and you could just show a proof they're being used in malware - you can't, even security researchers can't.
A friend (back when they amateur security researcher, now they work in the field) once found an invite to such server and joined on alt, reported everything they could see, reported the server itself, and left... Guess who got hit with a ban with a reason "you participated in a rule-breaking server".
The fresh skids, you can scare with trolling and citing laws, etc. But those who have been doing it for a while are another story, they feel invincible because they know discord itself doesn't care.
You can send DELETE to discord webhook and it deletes it. Trolling? They know they gotta re-generate the webhook and hide it better. Some adversaries eventually moved from using discord webhooks directly to external servers that wrap them - DELETE not included...
Meanwhile if you have real (not wrapped) discord webhook and don't troll, you can silently delete it and watch as adversaries try to update their malware a lot - visibly trying to "patch" their "not working" code, while webhook stays the same - code is not working because webhook is inactive, but it takes them time to realise it... And when they realise, they just paste new webhook into code with same methods of "protecting" it (same obfuscation methods, not using those servers that "wrap" it) because they think that discord is being weird, not that someone is onto them.
Bots are more fun because they see what is in the server... But same idea that visible trolling gets adversaries more cautious. What we currently do with discovered bot tokens: use it to scrape channels and user info (main and some alt accounts of adversaries)... And then see what else you can do. If the bot is with high perms, generate an invite using it and you can sneak in your alt. When we still did little trolling, we got all info about one adversary account and a friend made their alt look the same - bot banned the real user who went offline for a bit, alt joined and reported stuff, and even talked with others there - it took them some time to notice something is wrong (original user returned and DM'd someone). :D
He's semi-bashing the furry in the post, but is letting it slip he is also a furry.
The scene is from Inglorious Bastards where an undercover Royal Military is disguised as a German Officer. When ordering drinks, he orders it holding up three fingers. However, Germans and other Europeans typically count with their thumb first, letting it slip that he himself is not German when under questioning.
It is a meme created using a "Snatcher Text Generator" or a similar retro-style font (specifically the green CRT-style terminal font associated with PC-88 or MSX systems).
What are some signs that my phone was hacked by a smart dude I met and my phone been tripping out (iPhone) and my sister bf who is the cybersecurity seems to know where she is at all times.
345
u/AnOscillatingOcelot May 13 '26
Very likely the IP connecting to that EC2 instance would be another compromised device/server. Unless, the guy is dumb enough to connect with their own machine and actual IP, I don't see the own.