Jacob H. @lukenamop Twitter profile

Pinned Tweet

Jacob H.

1 year

📌 Megathread of my bots and other services 📌 I’m both a Discord security auditor and a Discord bot developer, use this thread to find links to everything I have to offer!

151

663

1K

Last Seen Profiles

@URherePodcast

@Weston_Thomas24

@LancetGastroHep

@RiccardoLuna

@uechin_ewokaku

@Nickdanaii21185

@mayeali77

@MaddieOBender

@_mowr

@alnebras_Ali

@animasi_indie

@sellayom

@huber_ebe

@hermeseven

@MfetOfficial

@BinorRaja

@Real_satang

@slizana25

@veraseyecandy

@WordslnRed

@pyoungya___

@katevolved

@pttonkin

@sscu_iisc

@gripen_mukku

@maya91405

@AGUecohydro

@Dora_03_03_

@BITCH1MODEL

@TVSshow

@ped8NvmoIGHyXCg

@AlphaScaffold

@Dexcryptos

@ChKashifArain

@system_complex

@_SoMarcus

Jacob H.

@lukenamop

2 years

🚨 I was just targeted by the same hackers that compromised Giveaway Boat and MEE6 🚨 I didn't fall for it, my account is safe, and my bots were not compromised. I even reset my Discord password after interacting just to be 100% sure. Here's how they're targeting bot staff 🧵👇

10

97

187

Jacob H.

@lukenamop

2 years

Hey, you! Is your project new to Discord? Do you want a secure Discord server but you don’t want to spend the money on a "Discord audit"? Here's a 🧵 explaining how to do it in 3 simple steps 👇

8

52

169

Jacob H.

@lukenamop

2 years

🔐 Ledger Nano X Giveaway 🔐 📌 Having a hardware wallet is an essential part of keeping your NFTs and crypto safe! ℹ️ To enter: 1) Like and RT 2) Follow @lukenamop 3) Tag 2 friends that are new to NFTs I will contact the winner in 3 days!

23

139

Jacob H.

@lukenamop

3 years

1/ There's a new phishing attack for NFT admin/mod Discord auth tokens going around, hacking/exploiting servers to post fake minting announcements. Recent victims include @catsinthecups , @wolfdotgame , and @wendropio . Read the 🧵 for more info on protecting your community 👇

8

73

145

Jacob H.

@lukenamop

2 years

#ProjectAtmos holders will be getting a free pfp drop sometime this month... I just swept 5 NFTs off the floor of @ProjectAtmos and I'm going to sweep 1 more for every 5 retweets this exclusive sneak peek gets! Check out the genesis project here (DYOR):

14

74

106

Jacob H.

@lukenamop

2 years

I think I've swept 45 @ProjectAtmos NFTs by now - way more than I had to, but I love them too much to stop! I'll drop #5550 (double Bad RV) + a random floor piece to whoever sweeps the most in the next hour. DM me your wallet address if you participate!

Jacob H.

@lukenamop

2 years

#ProjectAtmos holders will be getting a free pfp drop sometime this month... I just swept 5 NFTs off the floor of @ProjectAtmos and I'm going to sweep 1 more for every 5 retweets this exclusive sneak peek gets! Check out the genesis project here (DYOR):

14

74

106

8

29

87

Jacob H.

@lukenamop

2 years

Okay, I never post about NFTs I buy, but these banners are from Project Atmos Genesis by @bloqparty_nft and I gotta say, I’m a huge fan! I’m the proud owner of these 4 🔥

4

11

78

Jacob H.

@lukenamop

2 years

So... I just did a thing... I love the lavender, and the F11, and everything else about this NFT. I'm so proud. @ProjectAtmos #ProjectAtmos

17

14

80

Jacob H.

@lukenamop

1 year

If someone asks you to test their P2E game on - don’t get tricked into thinking that it’s safe just because it’s on an domain. Apps and games on TestFlight do NOT go through Apple’s App Store review process. They can be malicious.

2

16

52

Jacob H.

@lukenamop

2 years

Servers hit in the last 8 hours via MEE6: RTFKT (165k) Alien Frens (74k) Cool Cats (101k) PXN (32k) HAPE (479k) Axie Infinity (739k) PSSSD (80k) My Pet Hooligans (31k) Blockworks (6k) Moonbirds/PROOF (17k) Memeland/9GAG (238k) Magic Eden (194k)

9

37

65

Jacob H.

@lukenamop

2 years

⚠️ 𝗗𝗢 𝗡𝗢𝗧 "drag buttons to your bookmark bar" to "verify" on Discord. ⚠️ Honestly, don't 𝘦𝘷𝘦𝘳 leave Discord to visit 𝘢𝘯𝘺 link. 6 months later, bookmarklet phishing is still one of the primary things scammers are using to compromise Discord servers. Details below 👇

Jacob H.

@lukenamop

3 years

3/ The end goal is to invite you to a very legit-looking server, take you through a fake verification link, and run code in your browser using what's called a "bookmarklet" to snag your Discord auth token (bypassing your password and even 2FA). This video shows how it works:

2

4

37

1

22

59

Jacob H.

@lukenamop

2 years

🤖 Now announcing: Wallet Collector Discord bot! Wallet Collector is a FREE bot which allows you to collect wallet addresses on Discord and export them to a spreadsheet. Share to anyone who might need this! The bot doesn’t need ANY special permissions.

12

19

62

Jacob H.

@lukenamop

2 years

Another day, another free Discord tool: In-channel captcha verification! ❌ No more directing your users to click links ❌ No more asking your users to open their DMs ✅ Verification handled privately, directly in your server! ✅ Free, forever

10

24

58

Jacob H.

@lukenamop

3 years

1/ So, let's recap tonight's events. $2m+ (600+ ETH) of stolen NFTs, originally attributed to an exploit in OpenSea's new listing contract. Here's a 🧵 on what we know, what we don't know, and some of the current best guesses as to what may be happening.

3

25

57

Jacob H.

@lukenamop

2 years

Over 12 hours later, the truth comes out! MEE6 staff have the remote ability to use MEE6 to give themselves roles in any server.

MEE6

@mee6bot

2 years

Some servers have reported MEE6 being used to post unwanted messages. There is no technical breach in our systems. This was due to one of our employee's account getting compromised. ✅ The issue is now fixed and we've taken all the steps to make sure it never happens again.

175

242

807

9

13

48

Jacob H.

@lukenamop

2 years

👀 Discord Pro-Tip 👀 If you’re making an announcement in your server, put your @ everyone ping at the very end of the message rather than the beginning! On mobile, Discord notifications only include the first 2 lines. This way, the notification can include actual content.

5

9

48

Jacob H.

@lukenamop

2 years

⛔ DO NOT open "Developer Tools" or "Console" on your browser. EVER. ⛔ RT and share. Sc @mmers have found a new way to snag your Discord credentials using these tools. Details below 👇

3

27

48

Jacob H.

@lukenamop

2 years

Hey @OthersideMeta , I see your Discord has been compromised. Please reach out to me, @Jon_HQ , @Plumferno , or @GrassyEth . We’re happy to help you recover at no charge and we can also run a full audit to upgrade your security protocols. Check out our profiles for more information.

6

5

46

Jacob H.

@lukenamop

2 years

⭐ What should you expect from a quality Discord audit?⭐ This is what a Discord server security audit report looks like. Each one is 8+ pages long, detailing all changes made to secure the server. This report follows a format that I developed with @Jon_HQ and @GrassyEth .

1

7

43

Jacob H.

@lukenamop

2 years

📌 Discord security breaches aren't slowing down. I wanted to build something free to help all servers: Server Supervisor Discord bot ✅ Monitors & logs every webhook update ✅ Option to delete existing webhooks ✅ Option to filter verified bot webhooks

6

11

40

Jacob H.

@lukenamop

3 years

You may know me from the HENI NFT Discord - I'm also a Discord bot developer and I've created a verified bot called Spam Defender to protect NFT servers from spam and scams. Check out all the info here and tell your friends: #Discord #NFTCommunity

5

11

36

Jacob H.

@lukenamop

3 years

3/ The end goal is to invite you to a very legit-looking server, take you through a fake verification link, and run code in your browser using what's called a "bookmarklet" to snag your Discord auth token (bypassing your password and even 2FA). This video shows how it works:

2

4

37

Jacob H.

@lukenamop

1 year

Shoutout to @LemonGF for asking the question. I found a few articles from 2022 reporting cases of malware and scams being distributed via TestFlight:

Scammers have 2 clever new ways to install malicious apps on iOS devices

Getting past the App Store gatekeeper has always been tough. Here are two new ways.

arstechnica.com

1

5

29

Jacob H.

@lukenamop

2 years

I’m proud to announce my proprietary security bot, Server Supervisor, is officially Discord verified! If you’d like to learn more about how it works or get it set up in your server, you can check it out here:

9

35

Jacob H.

@lukenamop

1 year

My Discord bot, Spam Defender, has been acquired by @HashbotOfficial , and I’ll be joining their team as a Project Manager! I’m very excited for what this means for every community that depends on both SD & HB to keep their servers free from impersonators and scammers 🔒

Hashbot

@HashbotOfficial

1 year

🤝 We're proud to welcome Spam Defender founder @lukenamop to the team as Project Manager. Welcome aboard!

1

0

8

15

2

34

Jacob H.

@lukenamop

2 years

👏 Enable 👏 2FA 👏 on 👏 Discord 👏 Yes, Discord authentication token compromises bypass any 2FA you might have. However, there are 2 things an auth token *can’t* bypass if you have 2FA enabled: 1) Transfer Server Ownership 2) Delete Server

1

12

31

Jacob H.

@lukenamop

3 years

I’m going live with @QueenyMartha this coming Monday to talk about Discord security, specifically for NFT servers. I’ll have some tips for general users as well as some for project managers, and we’ll do a Q&A! I hope to see you there!

2

8

28

Jacob H.

@lukenamop

2 years

Taking down malicious phishing sites left and right 🙏 Stay vigilant. If you’re targeted by these sc @mmers , please send malicious Discord invites and URLs my way via DM and I’ll follow up to get their shit shut down.

1

5

30

Jacob H.

@lukenamop

3 years

Casual self doxx. I’m Jacob, nice to meet you!

5

0

26

Jacob H.

@lukenamop

2 years

The most secure NFT <-> Discord verification bot on the market, @VulcanAuth , just got a huge update! Now you can migrate roles that you're managing through other bots into Vulcan. No more starting over from scratch!

1

4

26

Jacob H.

@lukenamop

2 years

5/ Some info, if you want to check your servers to see if any of these scammers/hackers are present. "Staff" user IDs: 959568833331474472 622545616265936896 759990948208967730 847293369553518623 292379315214090241 959569775372144660

1

7

26

Jacob H.

@lukenamop

2 years

7/ Please share this thread to warn as many people as possible. These hackers have been targeting NFT server staff for months but they just recently started targeting Discord bot staff. Stay safe out there friends.

0

4

26

Jacob H.

@lukenamop

2 years

Thanks for the custom @angy_chubbies NFT! My username everywhere is "lukenamop," aka "luke and a mop," and this artist perfectly captured what I was looking for. Now I can clean up the web3 universe, with mop in hand, in true chubby fashion!

6

2

26

Jacob H.

@lukenamop

2 years

Step 2/ Learn the ins and outs of your Discord bot options. This requires 𝗿𝗲𝗮𝗱𝗶𝗻𝗴 𝘁𝗵𝗲 𝗱𝗼𝗰𝘀 and 𝗱𝗼𝗶𝗻𝗴 𝘆𝗼𝘂𝗿 𝗼𝘄𝗻 𝘁𝗲𝘀𝘁𝗶𝗻𝗴. There are important security bots: - Wick - Server Supervisor - Spam Defender - Good Knight - Hashbot / Beemo - Sledgehammer

1

3

24

Jacob H.

@lukenamop

2 years

Solrarity (166k) Okay Bears (84k) The Habibiz Lazy Lions (152k) HYUNDAI (142k) Akutars (15k) Gangster All Star (50k) A total of 2,765,000 users. Kick MEE6 now until you hear more from reputable security specialists. THIS IS STILL ONGOING.

3

5

24

Jacob H.

@lukenamop

2 years

My Server Supervisor bot has a new (mobile friendly) captcha style! Try it out for yourself or read more at

1

4

23

Jacob H.

@lukenamop

3 years

2/ The predators behind this exploit spend multiple days developing relationships and building trust. It's important to stay on your toes, even while building what may seem like a real relationship! There are a few red flags 🚩 to look for which I'll point out.

2

0

23

Jacob H.

@lukenamop

2 years

Looking for a bot to privately and securely collect whitelist/allowlist wallet addresses on Discord? I’ve got one in early beta testing, to be released to the public soon! Contact me for early access 👀

13

7

23

Jacob H.

@lukenamop

3 years

Happy New Year, everyone! May 2022 bring peace and good fortune to all. My resolution is to do everything in my power to keep NFT #Discord safe by sharing security tips/tricks and continuing to develop the Spam Defender bot into the ultimate #NFTCommunity protection machine.

1

22

Jacob H.

@lukenamop

2 years

Congrats to @astrostleth ! I just sent #5550 and #6896 to your wallet 🙌

2

0

23

Jacob H.

@lukenamop

2 years

Step 1/ Learn the interaction of every permission on Discord (in both role and channel settings). Here's a quick-start guide: Make sure to check every role and every channel to be sure nothing slips through. (This includes bots - don't give them Admin!)

2

1

22

Jacob H.

@lukenamop

2 years

To be clear, this is not a new technique. Clicking the image itself isn’t an issue. The issue lies in clicking the “View Original” link, which will take you to a website and *then* access your token. Continue to use normal levels of caution when interacting with links and files.

Letz Smash 🇱🇺

@LetzSmash_SSB

2 years

⚠️New Discord Hack Technique⚠️ If you received a DM with a picture not loading; DO NOT OPEN IT ! It will steal your Discord session Token and let the hacker change your password and use your account freely The A2F does not protect against ! Report suspect activity to admins

125

2K

0

14

20

Jacob H.

@lukenamop

2 years

3/ I didn't click any links or leave Discord at any time. I'm trained to recognize these scams so I was careful the entire time. While I was there, I saw the "staff" (aka hackers) were targeting a bunch of other bot support servers. STAY ON YOUR TOES.

1

4

21

Jacob H.

@lukenamop

3 years

4/ How would you end up at this point in the first place? Someone will reach out offering to hire your or collab with you. They'll probably sound "too good to be true" (🚩 #1 ). Over time they'll show you what looks like a legit website and a large Twitter account.

1

0

20

Jacob H.

@lukenamop

3 years

Damien Hirst's NFT Initiative, Which Asks Buyers to Choose Between a Digital Token and IRL Art, Has Already Generated $25 Million | Artnet News

2

3

21

Jacob H.

@lukenamop

3 years

🤯 Spam Defender banned 7,455 spammers before they could get into the @HENIGroup Discord just now… Absolutely insane!

1

2

20

Jacob H.

@lukenamop

2 years

“Out of 3,207 [apps leaking Twitter API keys], 230 are leaking all four authentication credentials and can be used to fully take over their Twitter Accounts and can perform any critical/sensitive actions.” Revoke access here:

Researchers Discover Nearly 3,200 Mobile Apps Leaking Twitter API Keys

Researchers have uncovered a list of 3,207 apps, some of which can be utilized to gain unauthorized access to Twitter accounts.

thehackernews.com

2

11

19

Jacob H.

@lukenamop

2 years

If you reset all staff Discord passwords and delete all existing webhooks then the current hackers’ access will be fully revoked and you can start recovery.

2

1

19

Jacob H.

@lukenamop

2 years

1.1/ Make sure dangerous permissions aren't assigned to 𝘢𝘯𝘺𝘰𝘯𝘦, not even staff, and make sure critical staff have secondary "Cold Admin" accounts. See the quoted thread from @Jon_HQ for more info on why this is necessary and how to set it up:

Jon_HQ

@Jon_HQ

2 years

🚨 Jon_HQ Cold Discord Admin Protocol v.1 🚨 Something I've been having troubles with explaining to teams is both the setup and usage of Cold Discord Admins for an NFT project. So here is my guide on both setup, and usage, for free, as always ♥️

5

20

65

1

21

Jacob H.

@lukenamop

2 years

Ever had a verification bot "break" when too many people try to join? Here's how you can improve this in your server 👇 MEE6 and other "reaction role" bots slow down when too many people try to use them:

3

8

20

Jacob H.

@lukenamop

2 years

I noticed a server in the wild which failed to protect their invite URL as outlined in this very brief thread, so I parked their invite URL for them. Please, make use of this tip! The chance of a friend catching your mistake before scammers do is very low!

Jacob H.

@lukenamop

2 years

🔒 Discord Security Tip 🔒 Opening & closing a server gives scammers a chance to “steal” your invite URL and trick people into joining the wrong server. If you use a vanity URL, you need a 2nd server at full boost level to “park” your invite URL when you aren’t using it.

1

4

14

2

6

19

Jacob H.

@lukenamop

2 years

2.1/ Then there are general use/utility bots: - Dyno - ProBot - Carl - YAGPDB - Xenon - Logger - Invite Tracker - Craig - Giveaway Boat - Giveaway Bot - Ticket Tool - Tickets - Tweetshift - Pingcord - Statbot - p̶l̶e̶a̶s̶e̶ ̶n̶o̶t̶ ̶M̶E̶E̶6̶

2

19

Jacob H.

@lukenamop

2 years

I'm back with another useful YAGPDB custom command! This one will let you bulk assign a role to up to 45 members at a time. It works with both @ mentions and raw user IDs. You can copy the code here:

4

2

17

Jacob H.

@lukenamop

3 years

Another #NFT #Discord security audit complete, this time for @RedKiteNFT ! They brought me in a few days ago to help secure everything for their community. I left them 4 pages of notes, but that’s one of the “easier” audits I’ve done lately! 🙌

2

0

18

Jacob H.

@lukenamop

2 years

If you missed our chat today we discussed security, audits, bots, alternate platforms to Discord, how to protect servers, and just generally shared as many tips as possible. We’re going to try to do this weekly! Most likely Fridays at 8pm US EST.

1

2

19

Jacob H.

@lukenamop

2 years

Scammers can use bots to hide scam links behind real links. Never trust links on Discord, especially if they're sent by a bot. This scam will steal your Discord authentication token, which even bypasses 2FA. All project staff are targets of this scam.

2

4

16

Jacob H.

@lukenamop

2 years

@wealthhhhhh My banner from @ProjectAtmos , all the way!

3

0

18

Jacob H.

@lukenamop

2 years

2.2/ And you also have your web3 bots: - Vulcan - Collab Land - Whop - Guild xyz - Alpha Bot - Wallet Collector - Boto - assorted price trackers

1

18

Jacob H.

@lukenamop

2 years

⚠️ 𝗨𝗽𝗱𝗮𝘁𝗲 𝗔𝗽𝗽𝗹𝗲 𝗗𝗲𝘃𝗶𝗰𝗲𝘀 𝗔𝗦𝗔𝗣 ⚠️ One of these exploits can be triggered by "maliciously crafted web content [that] may lead to arbitrary code execution." Don't sleep on this. If you have an Apple device, you're being targeted by these exploits.

2

7

18

Jacob H.

@lukenamop

2 years

6/ These are the primary phishing attempts we're seeing from hackers like this: 1: Scanning a QR code (usually via a fake Wick bot). 2: Asking you to drag a "bookmarklet" (aka button) into your browser's bookmark bar to verify.

2

4

18

Jacob H.

@lukenamop

2 years

4/ I've already let these bot servers know they're being targeted, but I still recommend reducing the total bots you're using and limiting permissions of the bots you're using to the minimum they can possibly have while still functioning properly.

2

18

Jacob H.

@lukenamop

2 years

Discord Transparency Report: “One notable trend is that accounts disabled for authentication token theft rose by 740% (in Q3 and Q4 2021).” It’s clear Discord is aware of the hacks on their platform. Hopefully they take steps to protect communities.

Discord Transparency Report: July – December 2021

This Discord transparency report covers July to December 2021.

discord.com

1

4

18

Jacob H.

@lukenamop

2 years

@NFTherder @minibossgrl @wallet_guard @Server_Forge ServerForge is a gathering of independent individuals, and @wallet_guard is a member of ServerForge. As am I.

0

17

Jacob H.

@lukenamop

2 years

The official OpenSea Discord server was compromised a few hours ago. EVERY SERVER can be hacked, no matter how professional your team is. The best way to reduce the chance of compromise is to bring in a full-time security specialist to perform an in-depth audit.

3

16

Jacob H.

@lukenamop

2 years

1/ A user joined my Spam Defender support server and immediately DMed me asking to "collab" (🚩 #1 ). They directed me to open a ticket in their server (🚩 #2 ). The server's "verification" had two steps. The first step was a typical "reaction role" button.

2

17

Jacob H.

@lukenamop

2 years

... 𝗼𝗿 ... you could save yourself hours, days, WEEKS, of work by bringing in an auditor who spends every day doing everything I've detailed in this thread. Well-reviewed auditors may not be cheap, but they can jumpstart your community and provide lasting protection.

1

16

Jacob H.

@lukenamop

3 years

5/ If you look closely you might notice that they aren't followed by anyone you're following (🚩 #2 ) or that their account is even stolen/purchased (🚩 #3 ). See the screenshot in this Tweet:

Jon_HQ

@Jon_HQ

3 years

Another tweet coming out very shortly about today's compromises, but here are two little red flags to look out for if an NFT project approaches you about a collaboration... This twitter account is a scam, if you join their Discord it'll try to get you to verify and phish you.

1

8

32

1

16

Jacob H.

@lukenamop

2 years

⚠️ DISCORD SECURITY ALERT The "Manage Roles" permission gives Discord mods the ability to enable this permission for roles in your server, even if they *don't* have "Mention Everyone" perms. IF MODS HAVE "MANAGE ROLES", THEY HAVE THE ABILITY TO @ YOUR VERIFIED ROLE.

3

6

18

Jacob H.

@lukenamop

3 years

10/ With new forms of phishing exploiting big-name projects left and right, it's important to stay ahead of the game. Find sources you trust and follow them for more info like this. I personally like @Jon_HQ , @Plumferno , @ddotFi , @wilxlee to name a few.

0

2

16

Jacob H.

@lukenamop

2 years

Here’s the first Tweet in the thread if you want to give it some love:

Jacob H.

@lukenamop

2 years

Hey, you! Is your project new to Discord? Do you want a secure Discord server but you don’t want to spend the money on a "Discord audit"? Here's a 🧵 explaining how to do it in 3 simple steps 👇

8

52

169

0

1

15

Jacob H.

@lukenamop

2 years

@alsaai_eth @NFTherder Hotshot says he blurred out the context "to shine a light on the behavior, not calling out the ppl or project involved." I, for one, am happy to be associated with the words I've written. Here's the full context.

Jon_HQ

@Jon_HQ

2 years

Sharing information in this space is vital. Both members in the quoted tweet are in @Server_Forge All my homies love @Server_Forge

21

10

51

1

2

16

Jacob H.

@lukenamop

2 years

2/ The second step was a fake external link that asked me to add a bookmarklet to my browser (🚩 #3 ) and then click it to verify and join the server.

1

2

15

Jacob H.

@lukenamop

2 years

1.3/ User roles should be sorted from highest permissions to lowest permissions. "Vanity roles," to give cool colors or titles, should have no permissions. In general, channels should not have any explicit ✅/❌ permissions except "View Channel" and "Send Messages."

1

15

Jacob H.

@lukenamop

2 years

Flashy graphics and marketing tactics don't replace detailed written reports. Look for someone who will be available to help you as things evolve long-term. Someone like @Jon_HQ , @Plumferno , or one of the many other auditors contributing to the public @Server_Forge community.

1

14

Jacob H.

@lukenamop

2 years

@Jon_HQ @Server_Forge ServerForge is one of the most unique communities I’ve ever been privileged to be a part of. It’s so incredible to see info and resources spread far and wide by every member of the group. Keep up the good work, everyone 🙌

0

1

14

Jacob H.

@lukenamop

2 years

1.2/ Aside from explicit permission settings, you also need to give some attention to the role order (or hierarchy). If this is wrong, all your hard work setting permissions would be for naught. Bots should be no higher on the role list than they need to be.

1

16

Jacob H.

@lukenamop

2 years

This is the last tweet in a thread from Giveaway Boat detailing how the dev was compromised (fake verification bookmarklet scam) and how the hacker was able to use the bot (“eval” command that may have exposed the bot’s token). This is “resolved,” but I won’t use this bot again.

Giveaway Boat

@giveaway_boat

2 years

As for how they got access to the bot's token when I had 2FA enabled, the only likely way is that they used eval command in the bot using my account, which is a cmd that many devs use to run codes privately. This might be the only way they could get token, I've removed it now!

2

0

7

2

4

14

Jacob H.

@lukenamop

3 years

6/ When you're starting to think they might be trustworthy, they'll invite you to check out their Discord and help you through their fake "verification" process, stealing your auth token. As soon as they have your token they have full access to your account, even if you have 2FA.

3

0

14

Jacob H.

@lukenamop

1 year

🤖 Wallet Collector bot - Collect wallet addresses on Discord - Export submitted addresses to a csv spreadsheet - Only allow users in specific roles to submit their wallets - Does not require any server permissions Docs & Invite: Price: Free

2

4

12

Jacob H.

@lukenamop

2 years

Made it this far? Still want to do it yourself? Contact me or @Server_Forge and we can connect you with further resources!

3

2

14

Jacob H.

@lukenamop

1 year

🔒 Discord Security Audit Service - Audit & update all settings, permissions, roles, and channels - Audit & update existing bots - Set up additional security bots More info: Message me or schedule a free introductory call at

1

3

11

Jacob H.

@lukenamop

2 years

🔒 Discord Security Tip 🔒 A day or so before your mint (or other scheduled events), have all of your moderators and team members reset their passwords. Even if they have 2FA! This will reset their Discord auth tokens and boot out hackers lying in wait.

4

15

Jacob H.

@lukenamop

2 years

Official update from the @Ticket_Tool developer:

4

6

14

Jacob H.

@lukenamop

1 year

Incredible to see Wallet Guard continuing to improve on their protection services. You guys are next level, keep up the great work.

Wallet Guard

@wallet_guard

1 year

Introducing Stormwatcher ⛈️ detecting wallet drainers without even having to connect your wallet or simulate a transaction. Watch it in action now ⬇️

28

106

276

2

0

12

Jacob H.

@lukenamop

3 years

💡 Discord Security Tip 💡 Don't give your mod team "Manage Roles" permission! If they need to be able to assign whitelist roles, use this YAGPDB custom command I wrote. Reach out to me if you need help with this. Once it's set up, it's as easy as "-whitelist @lukenamop "!

3

2

12

Jacob H.

@lukenamop

2 years

Look for someone with positive reviews from other auditors, not just someone that other project founders recommend. Look for someone who has a track record of proactively providing public, free resources, who will go out of their way to protect servers they don't even work with.

1

13

Jacob H.

@lukenamop

2 years

Feel like the chips are down? Spend some time improving yourself: • Take an online class • Reach out to someone you haven't talked to in a while • Go hiking/climbing/running/biking • Help your local community Things will bounce back, take advantage of your downtime!

1

4

14

Jacob H.

@lukenamop

2 years

An update on this free tool: I just made the source code for a standalone version of Server Supervisor's Webhook Protection feature available to the public here:

Jacob H.

@lukenamop

2 years

📌 Discord security breaches aren't slowing down. I wanted to build something free to help all servers: Server Supervisor Discord bot ✅ Monitors & logs every webhook update ✅ Option to delete existing webhooks ✅ Option to filter verified bot webhooks

6

11

40

1

5

13

Jacob H.

@lukenamop

3 years

9/ Okay, what if you or someone you work with falls for this and their auth token is grabbed? Immediately reset your password! Even though the auth token bypasses your password and 2FA, resetting your password will actually also reset your auth token and they will lose access.

1

13

Jacob H.

@lukenamop

2 years

Step 3/ Research the various attack vectors scammers use to compromise Discord accounts. Bookmarklets, QR logins, etc. Understand how to protect your staff from these attacks (hint: 2FA is definitely recommended, but it will 𝗻𝗼𝘁 protect you from these phishing scams).

1

13

Jacob H.

@lukenamop

2 years

3.1/ This one is kind of on-going. Scammers are evolving & innovating every day. You're going to want to check for new trends fairly often to make sure you don't miss anything and can give your team plenty of warning.

1

13

Jacob H.

@lukenamop

2 years

@Jon_HQ To add to this: It's okay to admit you made a mistake! Everyone does. This happens to be a mistake that has huge repercussions, but it's better to admit and work to make amends than brush it under the rug and pretend like nothing happened.

0

1

13

Jacob H.

@lukenamop

2 years

To clear up what happened last night: 1) Captcha Bot is not hacked! 2) Ticket Tool had an issue with the “add” command which allowed people to add Manage Webhook permissions to themselves. 3) Ticket Tool was the only problem. 4) The “add” command was fixed last night.

1

3

12

Jacob H.

@lukenamop

2 years

🔒 Discord Security Tip 🔒 Opening & closing a server gives scammers a chance to “steal” your invite URL and trick people into joining the wrong server. If you use a vanity URL, you need a 2nd server at full boost level to “park” your invite URL when you aren’t using it.

1

4

14

Jacob H.

@lukenamop

2 years

2.3/ And, don't forget, you're going to want to limit the permissions of each bot as much as possible. By default, most bots will ask for more permissions than they actually need to function, which creates additional risk.

1

12

Jacob H.

@lukenamop

2 years

This Discord error is affecting all bots, including Spam Defender and Server Supervisor. For Spam Defender, the protection features are still working but all /commands are down. For Server Supervisor, webhook protection is working but all verification panels are frozen.

Captain_Plantain

@Cap_Plantain

2 years

⚠️ DISCORD BOT WARNING ⚠️ Discord has introduced an API error that is causing most bots to respond with "<bot-name> is thinking..." when executing a command All we can do is wait until discord fixes this

2

7

23

2

1

12

Jacob H.

@lukenamop

3 years

🚨 Another day full of #NFT #Discord hacks... - @Friendswithyou / @fRiENDSiES_Ai - @HeartNFTs - @DraffesNFT - @Nifty_Island - Rap Empire DAO to name a few! I have a passion for Discord security and would be happy to help. 🔄 Retweet and share, we need to stop these hacks ASAP.

0

1

11

Jacob H.

@lukenamop

2 years

Here are some examples of accounts Spam Defender can protect your community from, these are accounts that attempted to use alternate fonts & symbols to sneak in, but they were caught immediately. More info available here:

1

2

11

Jacob H.

@lukenamop

1 year

macOS is becoming more “hackable.” If you use a Mac, please be wary of the things you download so you don’t inadvertently install something like this. Stay safe, friends!

FastFoodRembrandt.onion

@solminingpunk

1 year

#ALERT we have observed A new macOS information-stealing malware named 'Atomic' (aka 'AMOS') is being sold to threat actors via private Telegram channels for a subscription of $1,000 per month. And I just got in. #cybersecurity #infosec #malware #macOS

26

176

610

0

2

10