Image: Alexander Shatov/Unsplash.
A site that is scraping Discord, storing users’ activity and messages across servers including what voice channels they are active in, and then selling access to that data for as little as $5, has links to Kiwi Farms, the notorious troll and harassment site, 404 Media has found.
The news presents additional context on how the tool, called Spy Pet, is being used and by whom. 404 Media also learned that Discord has known about the scraping site since at least February, according to multiple screenshots of reports filed to Discord.
“It’s definitely distressing knowing that my information, such as servers, about me, previous usernames & message logs are publicly available—I have had more than one person harass me with the information available on the site,” one person whose information is included in the scraped Discord data told 404 Media in an online chat. 404 Media granted the person anonymity to protect them from retaliation.
On Kiwi Farms, an account called “spy.pet” has uploaded multiple dumps of Discord messages from the Spy Pet service. In at least one of these threads, they have analyzed the posts of people posting in a queer community Discord. They describe one dump as containing 916,000 messages. Another says it includes just over 220,000 messages. They have also uploaded pie charts which break down the percentage of messages on the servers written by specific users.
💡
Do you know anything else about Discord scraping? I would love to hear from you. Using a non-work device, you can message me securely on Signal at +44 20 8133 5190. Otherwise, send me an email at joseph@404media.co.
When asked if this account belonged to them, the Spy Pet administrator told 404 Media in an email that the only accounts they control access to in relation to Spy Pet is the site’s respective Telegram channel and a Twitter account. “I checked the account you linked, and it seems to only use [Spy Pet] and its export feature, which anyone can use,” they added.
404 Media determined that the administrator’s email address is linked to an account on Kiwi Farms. When trying to create a new account on Kiwi Farms with the Spy Pet administrator’s email address, the site says this is not possible because that email address is already in use. “Email addresses must be unique. The specified email address is already in use,” the message reads. 404 Media verified that when a new email address is used, no such error message displays, but a user does not need to have clicked the subsequent confirmation email for the Kiwi Farms site to say the address is in use.
Kiwi Farms has repeatedly been linked to long-term harassment of specific people. In July 2021, Kiwi Farms lost its domain registrar. The following September, cybersecurity company Cloudflare said it blocked Kiwi Farms after weeks of public pressure. That pressure came after Kiwi Farms was linked to harassment of trans Twitch streamer Keffals.
404 Media obtained multiple screenshots which show people reporting the Spy Pet service to Discord in February. When 404 Media originally reported the existence of Spy Pet this week, the administrator said they had not received any communications from Discord, legal or otherwise.
Discord acknowledged a request for comment when asked about it learning of Spy Pet in February, but did not provide a response in time for publication. A Discord spokesperson previously said in a statement that “Discord is committed to protecting the privacy and data of our users. We are currently investigating this matter. If we determine that violations of our Terms of Service and Community Guidelines have occurred, we will take appropriate steps to enforce our policies. We cannot provide further comments as this is an ongoing investigation.”