Discord is a treasure trove of real-time, contextually rich digital interactions, offering OSINT investigators unprecedented access to diverse community conversations, user networks, and the various digital file types shared through its interconnected server ecosystem. These insights can be pivotal for open-source intelligence (OSINT) investigations.
Social Media Intelligence (SOCMINT), a branch of OSINT, focuses specifically on collecting information from social media platforms. Every social media platform, however, is unique, necessitating tailored guidance for effective OSINT investigations.
(Check out our previous guides for OSINT on TikTok, Facebook and Reddit here.)
In this guide, we'll cover SOCMINT/OSINT techniques for Discord, the popular platform for text, voice, and video chat.
Discord launched in 2015 to facilitate text, audio, and video communication between online gamers. Now, 10 years after its launch, 200 million monthly active users globally are using 28,400 different servers to privately communicate and share ideas on virtually any topic, not just gaming—making it a valuable tool in criminal investigations.
In fact, in 2021, U.S. investigators used Discord chat logs to track extremist groups involved in the January 6th Capitol riot. Discord server archives revealed key details about their planning, coordination, and real-time communications.
In terms of user experience, Discord is comparable to the popular enterprise collaboration platform, Slack.
What makes Discord popular among online gamers is its native support for all online gaming platforms. Players using one platform (like Xbox) can use Discord voice chat to talk with players on other gaming platforms (like PlayStation) without any issues. Its ability to integrate natively with popular online gaming consoles regardless of the hardware makes it very popular among gamers and boosts its credibility to support other communications needs, such as businesses or family communications.
With a large, growing user base and an incredibly wide-breadth of topics discussed, Discord has become a very important source for OSINT gatherers.
Discord is composed of servers, which form a hierarchical communication structure. Each server is dedicated to discussing a specific topic or subject. Server topics can range from gaming, music, and entertainment to science & tech, education and student hubs.
Each Discord server can contain multiple channels. Whether they are text, voice, or video channels, each has specific permission settings and user roles.
Here are the different channel types on the Discord platform:
Each server has one or more administrators who control access to the server and determine user interaction levels.
Discord has official applications to support different operating systems, such as Windows, Linux, and Mac, and mobile phones like Apple iOS and Android. The web-based browser version allows running Discord on any device with a supported web browser.
There are two primary user categories on Discord:
Before inspecting Discord servers, you need to log into the platform first. It's advised to use a sock puppet account (research account) to conceal your true identity on Discord during investigations. In this article, I‘m using the Discord web interface (by accessing it via my web browser).
To access Discord via web browser, go to Discord.com and log in.
As discussed, Discord is comprised of servers that constitute virtual communities, each dedicated to discussing a specific subject. Discord provides a discovery function (see Figure 1) for finding servers; however, not all servers are listed because they need to meet specific eligibility criteria to be included in the official Discord list of servers.
Figure 1 - Discord provides a Discovery feature for finding Discord servers
To be eligible to be included in the Discord public server list, a Discord server needs to meet the following six conditions:
If we want to search for a specific server or community, we can use the Discord built-in search feature. All we need to do is insert the search keyword in the Discovery Search bar and press the search button (see Figure 2).
Figure 2 - Search for Discord servers using the Discord Discovery search bar
Discord allows users to browse some information about any server before joining it. This “Preview” will enable us to fetch information about a specific server, such as (see Figure 3):
Figure 3 - Discord server preview mode
According to Statista, there were over 28,400 servers in August 2024.
However, a large number of servers have a low number of members, which excludes them from being listed on the Discord official server discovery page. Since not all Discord servers are discoverable through the built-in search feature, we can use third-party services to find a broader range of public servers.
Here are some of the most prominent ones:
Figure 4 - Discadia allows finding unlisted Discord servers
We can also use Google Dorks to find unlisted Discord servers:
After landing in the target Discord server, we can begin inspecting the following areas to gain more information about the server’s intent and users:
The Discord server name and description could provide a hit, revealing its purpose and target audience.
For example:
The number of members within a Discord server can provide insight into its influence and activity level. For instance, a server with 3,000+ members geared to a specific niche might indicate a popular hub, which could attract malicious actors looking to exploit its members.
A smaller server with 20–100 members could be a private or focused group that discusses sensitive or specialized topics.
It is worth noting that when we encounter a Discord server with a large number of members, while there are few members online, it could indicate that bots are moderating/managing the server or there are large number of fake accounts created using bots to artificially inflate member count.
Next, it is time to review the public channel names and inspect what they discuss and share.
For example, in a server for software developers, a channel titled “#code-share” could reveal technical chats about software coding techniques or may mention discovered software vulnerabilities.
In the same vein, if we find a channel named “#download-links” it could contain download links to pirated content.
Even Public Announcement channels could reveal connections with other entities or links to events.
Checking out the server’s rule channel can indicate the server's culture, focus, and community values. Beyond finding valuable information, OSINT gatherers should always read the server rules before participating in any discussion to avoid raising suspicions about their activities while interacting with other users on the server.
A verified server indicates a higher level of trust and authenticity. Discord verifies its servers by adding a green icon next to the server name. When a server is verified, this means Discord recognizes it as belonging to a business, brand, a community or a public figure.
OSINT gatherers should be suspicious when dealing with unverified servers, as they could be used to spread disinformation. Resources acquired from unverified sources should be cross-referenced with other sources to ensure authenticity.
Next, we will inspect Discord user names (See Figure 5). A Discord user account will have two names linked to it:
Figure 5 - Discord account has two names linked to it - a display name and a username
Discord allows users to have a unique display name on each server. For example, if my nickname in the Discord "OSINT" server is "John Doe" while my display name across the Discord platform is "thunderweaver," then my display name on the "OSINT" server will appear as "John Doe" and not “thunderweaver” as it appears elsewhere.
Many Discord users have the same username on multiple social media platforms. For example, a Discord user may use the same Discord username on Facebook, X, and Instagram. To locate where a particular Discord username appears online, we can use the following online services:
Next, search for Discord users’ display names to see where else they appear online. These search engines and Google dorks can help:
Clicking a Discord user display name will open a new window containing more information about the account.
To view the user's details in full, click on the three dots in the upper right corner of the window and click “View Full Profile” (see Figure 6).
Figure 6 - Access Discord user full profile details
The full profile details window shows more information about the subject user (see Figure 7), such as:
Figure 7 - Full profile details window of a Discord user
Next, perform a reverse image search for the Discord user profile and banner images to see where else they appear online, as this could reveal other social media accounts linked to the same person under different names.
Before executing a reverse image search, we need to extract the target Discord user profile and banner image to view them in large size. Here’s how:
Step 1 - After opening the target Discord user profile detail window, click on the three dots in the top right corner and select “Copy User ID” (see Figure 8).Figure 8 - Each Discord user has a unique User ID associated with them
Step 2 - After copying the target Discord user ID, go to the Discord-Avatar website, paste the ID into the search box, and hit the “Enlarge” button. This service allows you to display and download target Discord user profile images, banner pictures, and avatars in full resolution (see Figure 9).
Figure 9 - Use the Discord avatar online service to download the target Discord user profile and banner image
Step 3 - After getting the images in full size, you can begin searching for them online. Here are the most popular reverse image search engines:
A Discord user can share media files such as images, videos, and links, which can point to externally hosted MS Office files and PDF documents. All these files should be inspected visually and their metadata should be extracted to discover hidden information.
Here are some tools to reveal digital file metadata:
Check who the target user communicates frequently with online, and ensure that you also inspect their profiles using the techniques we've already discussed.
Discord does not allow viewing other users' friend lists, so to inspect a particular user's friends, you need to do the following:
We can also use the Discord built-in search function to analyze a particular user’s activity associated with a particular Discord server.
Here are some examples of using Discord's search function for OSINT and investigative purposes:
The Discord search feature is available at the top right corner of the Discord server.
Placing your mouse in the search textbox will trigger the following search options: (see Figure 10).
Figure 10 - Discord built-in search options
Figure 11 - The Has search operator options on Discord's built-in search
Before/During/After: Filter search results based on a specific date or time range.
Pinned (True or False): Search for messages pinned to the top of a channel.
Sentiment analysis, a natural language processing technique, has emerged as a powerful tool for understanding digital communication, especially in online communities like Discord, where users tend to post large volumes of text content.
Discord users' posts can be analyzed using sentiment analysis techniques to:
There are different Artificial Intelligence (AI) powered tools to execute sentiment analysis; here are the most prominent ones:
To analyze the sentiment of Discord videos accurately, we first need to extract the content in text form or a transcript. Here are some tools that can help with this process:
Here are some tools and resources to help you conduct OSINT investigations on Discord:
Investigating each social media platform raises unique challenges for OSINT gatherers, and Discord is no different. These are the main difficulties OSINT analysts could face when inspecting Discord for information:
Discord allows users to delete or update their messages without keeping logs to retrieve past messages. In addition, Discord servers can be deleted entirely or changed to private, which further complicates the investigation process.
Discord users can change their display names as many times as they want. They can also access their Discord accounts via TOR, VPN, or proxy servers, making tracking their real identity difficult.
Discord also verifies accounts using just an email address. No phone verification is required, which makes identifying who is behind a Discord account very difficult.
Discord leverages encryption to protect voice and video channels. Messages are also end-to-end encrypted, which prevents external observers from intercepting private communications.
Discord integrates with other web services, allowing social media login and Oauth login connections. Cross-platform integration complicates OSINT investigations by creating a more complex digital identity scheme. This makes comprehensive tracking of users' activities more challenging as it requires investigators to correlate identities across different social media platforms.
Some Discord servers may reside in a jurisdiction different from their users. This makes conducting a Discord investigation very complex, as it could span various countries and jurisdictions.
As we’ve demonstrated, Discord is a great source for collecting digital evidence to support various investigation needs.
However, because Discord allows users to remain anonymous, OSINT investigators should follow specific procedures when collecting evidence from Discord to ensure the defensibility of their findings:
WebPreserver is a social media and web capture tool that allows you to capture long Discord discussion threads in just a couple of clicks. With custom scripts, the browser plug-in can automatically expand threads or previews, saving you time from manually expanding and capturing every post. Better yet – all evidence collected is complete with the appropriate metadata, digital signatures for authentication, and can be exported in native formatting, so you can present your evidence in context.
Learn more about WebPreserver here.
With over 200 million monthly active users, Discord offers rich intelligence-gathering opportunities through server discovery, user profile analysis, and advanced search techniques. By examining server structures, analyzing user profiles, performing reverse username searches, searching third-party server discovery platforms, using Google Dorks and sentiment analysis tools, and conducting image and metadata investigations, investigators can extract valuable information from the platform.
Reading this guide has equipped you with sound strategies to explore user-generated content, analyze interactions, and unearth valuable intelligence while navigating the nuances and challenges that come with a vast data set of anonymized content.