"i need a new partner for beluga's new roleplay server" SCAMMERS (ATTEMPTED DOXXING/BLACKMAIL)

[OfclyGoodenough]

Popup - Discord

OWNERS:
falln#0001 (UID: 709121953213972551)
Mito#6900 (UID: 882756984015818762, also in the Rainbow 6 and F1 {under the name of “Chris”} servers)
slushie#4596 (UID: 883070128613380176, also on the League of Legends and Dyno servers)
Defender#4774 [BOT] (UID: 926978594301935637, a Discord nuker designed as an “anti-nuke bot” by Fallin with help from Mito)

Associated Websites:

falln.dev | Loading…

Registered via NameCheap on Pi Day, 2022 (Updated April 23, 2022) - Whois falln.dev

Defender | Home (antinuke.gg)

Registered via NameCheap on May 23, 2022 - Whois antinuke.gg

Associated Discord Account - Captain Kenway#0405 (UID: 932152464185102376, from Beluga’s server)

Associated Discord Servers:
Discord (personal)
falln (Token)
Discord (Defender)

Associated GitHub Account - fallnx (falln) · GitHub

Associated Sellix storefront - https://sellix.io/falln

Associated Twitter Accounts:
Profile / Twitter
falln (@fallnx) / Twitter
Defender (@DefenderDiscord) / Twitter

Associated YouTube Channel - Whalrus - YouTube

Associated Email Addresses:
[email protected]
[email protected]

Server was freshly created and is operating two fake giveaways:

• 5x Discord Nitro Boost
• $250 prepaid Visa gift card + 1 year Nitro Boost. (REQUIRES SUBSCRIPTION TO WHALRUS’ YOUTUBE CHANNEL)

The server also automatically deletes posts with words like “fake” and “scam” in them

I have slid DMs with Fallin and Mito on why they are using bots to promote their server, and they claimed that someone else was behind the issue and that they are working with “certified” Discord moderators to help the issue. They also opted not to make a public announcement “as it would draw more attention to this issue.”

I was then asked to provide “sufficient proof” that they operated a scam server after I called them out. Thus, I used this as an opportunity to send them a Grabify link to Youareanidiot.cc with Smart Logger enabled as they were on their cell phone.

They never got back to me, so I sent this post as proof.

[OfclyGoodenough]

Their response to my proof

[OfclyGoodenough]

Their “certified moderator” goes by the name of Cactus#0523 (UID: 459235187469975572)

[OfclyGoodenough]

Cactus has reached out to me, but the admins have not deleted the invite as was asked.

[OfclyGoodenough]

[OfclyGoodenough]

After much deliberation, @Cactus_Discord and I have concluded that the management team were at the very least compliant in helping us correct this issue. We did, however, come across a user by the name of qt vee <3#3072 (UID: 948261736442650674). They were a member of the server and had sent me DMs with a picture of my actual house and the names of my mother, stepmother’s husband (long story) and grandmother.

The screenshot above shows their senior moderator ber#6969 (UID: 934620129407406170) randomly pinging qt vee seconds after they sent me a dm with personal info. Cactus took note of that as I was reporting qt vee’s Discord account, despite their demands that I not report them and, later, that I delete this thread.

This indicates that server staff are legit trying to blackmail me into deleting this post through the doxxing of personal information. I did attempt to grab their IP address via a shortened Grabify link, but they were using a VPN from the Romanian company Gigabit Business Internet, Cloud Services & Technology Partner (m247.com)

Though Falln was cooperative with everything, they also refused to take immediate action in the form of a swift ban, claiming they wanted to go further. I have since filed reports to both Discord staff and the FBI.

[Cactus_Discord]

Hi, I am the cactus in the screenshots. I don’t really appreciate them using “… we have been in close contact with a Discord Certified Moderator to help mitigate this current issue and prevent it from happening in the future” as it is a pretty annoying thing to say. The bot that is dm spamming users with the invite is using a single invite, if the invite gets removed then the issue stops. Thank you for reaching out to me in dms!

[OfclyGoodenough]

Falln has since blocked my account, further proving they attempted to dox my personal information.

[OfclyGoodenough]

NEW ACCOUNT - morticianwindbound#0726 (UID: 955276833572683787, from the Formula 1 server)

[Andromeda]

How on earth did they dox your information? The first mistake you did was report with your actual account instead of a burner. Both of you did the same mistake. I’m not a tech savvy dude but I do have common sense.

This reminds me of a day I infiltrated a ‘mother of all roblox scams’ server and it was busted sometime later, with the scam twitter account getting taken down as well. But I used a burner account, I have about 3 discord burners.

[OfclyGoodenough]

Most likely because I had a linked social media account.

[Andromeda]

And that’s exactly why I switched accounts. I won’t blame you but be careful when you report such accounts/servers. If they’re banned you too might lose your account. I see this happening to many users who reported servers and lost their own accounts as well, many losing their main accounts. I narrowly escaped a ban when Scambaiter’s old server was banned. Those who were banned had just one role difference with me.

[OfclyGoodenough]

Discord staff have reached back, confirming that an investigation is underway.

[Andromeda]

That’s a good sign. Get back at em blackmailers’!!

[AxxoSecurityServices]

The website has been flagged as malicious on several security providers,
(urlscan.io, Virustotal, Intezer Analyze), Further information about this website can be found listed below

• Domain Creation Date -Monday 14th, March 2022 12:00 am

• Website Popularity - 0 (Poor)

• Domain Blacklist Status - Not detected by any blacklist engine

• HTTPS Connection - Valid HTTPS Found

• Proximity to Suspicious Websites - 26/100

• Threat Profile - 51/100

• Phishing Score - 24/100

• Malware Score - 51/100

• Spam Score -1/100

• This website contacted 4 IPs in 3 countries across 4 domains to perform 8 HTTP transactions. The main IP is 2a06:98c1:3121::3, located in United States and belongs to CLOUDFLARENET, US. The main domain is falln.dev.

• Google Safe Browsing: No classification for falln.dev

• Current DNS A record: 188.114.96.3 (AS13335 - CLOUDFLARENET, US)

• Domain created: March 14th 2022, 21:09:46 (UTC)
  Domain registrar: NAMECHEAP INC