348 million Discord messages are allegedly up for sale

Hundreds of millions of Discord messages have been scraped and are now for sale on hacker forums. At least, that’s what the seller claims.

A threat actor is offering over 348 million scraped messages for sale on the well-known cybercrime forum. The messages were allegedly extracted from nearly 1,000 public Discord servers.

According to the listing, the majority of the records come from users in the United States, France, and Russia, spanning nearly a year’s worth of conversations. The sample shared by the seller showed that scraped data included:

• User ID
• Username
• Display name
• Nickname
• Message
• Guild ID
• Channel ID
• Message ID
• Reply ID
• Timestamp

Cybernews researchers have checked the data, and so far, there’s no sign it’s fake. The leaked dataset contains no private messages or non-public data—only content scraped from publicly accessible Discord servers.

While scraping public Discord messages isn’t exactly rocket science for someone with the right skills – the real issue kicks in when that data gets aggregated, cross-referenced, and tied to individual users. That’s when things start to get personal, and the risk of targeted harassment becomes very real.

“It makes it easier to look through someone's message history on a lot of public servers at once,” said Cybernews researcher Aras Nazarovas.

Cybernews has contacted Discord, but a response has yet to be received.

Discord messages used for harassment

If it is genuine, it’s definitely not the first time someone’s scraped Discord’s public messages. In 2024, a shady website called Spy.pet surfaced, claiming it had scraped billions of public Discord messages from nearly 620 million users.

Spy.pet didn’t stop at message logs. It bundled users' Steam accounts and other linked platforms, offering what it called an “enterprise option” to anyone looking to train AI models on its data. That includes, allegedly, federal agencies.

​​To browse this surveillance goldmine, buyers just needed to shell out crypto for credits, which unlocked server archives, and look up profiles.

The site had reportedly been running since late 2023, but it wasn’t until early 2024 that it got wider attention, prompting Discord to finally step in. Spy.pet's scraping spree broke a list of regulations, including the GDPR, and was ultimately taken down.

Still, its admin told 404 Media that he “didn’t intend for [his] tool to be used for harassment,” a questionable defense considering the data was openly offered on Kiwi Farms, a known ground for doxxing and targeted abuse, especially against women, and LGBTQ+ users.

“Spy.pet was specifically created to make it easier to harass people from the LGBTQ+ community so the data from this newest leak could also be used for similar purposes,” said Nazarovas.