November 16, 2025
Left the .git open, got roasted
An exposed .git folder let us dox a phishing campaign
Scammers left secrets in plain sight; commenters split: chase them or nuke it
TLDR: A Discord crew found scammers’ exposed code and bot password, reported it, and the whole operation got taken down fast. Comments erupted over whether to hunt longer, help victims using stolen data, or share the kit for detection—proof that one sloppy mistake can sink a phishing scam.
A Friday phishing fail turned into community theater: a BeyondMachines Discord member flagged a fake login, and the crooks had left their code history wide open. Translation for non-nerds: they forgot to lock the folder that stores all their edits and notes. The crew peeked, found the source repo and a Telegram bot token (basically a password to control their bot), and filed reports to GitHub, Telegram, and the hosting company. Result: repo deleted, bot vaporized, site down. Receipts? screenshots.
But the comments stole the show. One camp wanted a longer chase: “Could’ve traced the attacker for a bit,” sighed poly2it, craving CSI vibes. A harsher chorus grumbled the crooks “got off easy,” demanding more consequences. ArcHound wrestled with ethics: can you help victims by retrieving stolen logins — and should you? They also begged for kit snippets to improve detection next time.
Meanwhile, the nerds chewed on how a secret ended up in config files, with CGamesPlay scratching their head. Jokes flew: “never deploy .git to production,” lots of eye-rolls, and memes about “leaving blueprints on the front lawn.” The crowd cheered the fast takedown powered by Discord teamwork, while arguing the big questions: chase vs. shut down, rescue victims vs. don’t touch stolen data, and publish clues vs. play it safe. Internet court is now in session.
Key Points
- •A phishing email led investigators to a fake login page reported via a Discord community.
- •Gobuster reconnaissance revealed a publicly accessible .git directory on the phishing site.
- •Inspection of requests exposed an active Telegram bot token and chat IDs hardcoded in the code.
- •The team pulled the repository, finding automated deployments and multiple fake pages.
- •Abuse reports resulted in GitHub removing the repo, Telegram disabling the bot, and the host taking the site offline.