Hello, I'd like to warn you about something.
So today I was messing around on the internet, when I decided to consult an affiliate of mine about an irrelevant matter. When I went to speak, it turns out he had been IP resolved via discord.
So I went to do some digging.
After consulting the discord API chat (Bot coders, basically) One guy knew how it was done. He had coded this exploit.
https://gist.githubusercontent.com/leovoel/0eb72445cae32f7769040f5105366483/raw/290fae9b0d5a5c3c6c476d1247cf278efe1a4848/thing.html
Here's how it works.
Discord has a complex proxy chain that loads data and images for you without you clicking, so that you aren't IP tracked.
This code convinces discord to load data into the client while bypassing this proxy chain as it is an MP4 file.
So user sends the exploit as a GIF (It's actually an MP4 file but metadata hides this.) When you hover over it, it sends a request to that host of the MP4 file, compromising your Ip.
Here is a test I ran myself with my own website:
http://prntscr.com/dkexx5
This blocked content is because my website does not have SSL, but this is easy to get by, as you can see it directly attempts to contact my website (If it was using the proxy chain it would look like this: http://prntscr.com/dkf1q6)
This is proof of concept of IP logging without opening a link in discord.
I recommend everyone use their VPN's.
This is all.
Have a wonderful day.
EDIT:
HAS BEEN PATCHED BY DISCORD WITHIN 2 HOURS OF FINDING IT