Double Counter's Doogle: How a Discord Security Bot Sold Lookups of Your Alts

When a Discord server uses Double Counter, every new member gets a link and clicks "Verify." A web page records their IP address, browser and device before the server lets them in. Tellter SAS, the small Paris company behind the bot, says that data is "never viewed by a human, and never sold or shared with third parties. It is used for one thing: detecting alt accounts."

Five years of archived pages, the company's own code and documents, and Discord's app store tell a different story. The same data powered a public alt-lookup site in 2021. Then it powered Doogle, a search engine that showed anyone with a Discord account the other accounts tied to a user ID, and that Discord's own store listed for sale. The verification page itself became an ad business.

On October 4, 2026, an attacker broke into Double Counter and copied about 12 GB of data, including IP addresses with city, postal code and internet provider for about 27 million accounts. Six days later Doogle shut down, without explanation. On October 15 the privacy policy was rewritten.

Doogle's homepage since October 10. Image: doogle.gg

What we found

• Alt lookups started in 2021. DiscordAlts.com, "Powered by Double Counter," let anyone type a Discord ID and get "a list of all accounts that are associated with it." The privacy policy said Double Counter "only collects one thing: your IP address."
• Doogle was open to anyone who signed in. Tellter's GDPR paperwork said "only authorized moderators" could use it. Free searches began in July 2025, and Doogle's own count of signed-in users grew from 22,405 to 840,625 in 14 months. We found no step that checked whether a searcher moderated anything.
• Discord's store lists it. A "Doogle Plus" subscription ("50 Doogle Searches per day"), created September 18, 2024, is still published on Double Counter's Discord store page. Since 2022, Discord's developer policy has banned using its data to "profile Discord users, their identities, or relationships with other users."
• An "alt" can be your sibling. Double Counter links accounts that share an IP address or a device, and calls the link "permanent." Its own site says the usual false positives are "people who share a device or a household connection."
• The verification page is an ad product. The "verifying" animation runs on a timer after the result is already in the page. Double Counter sells redirects of verified members by the thousand, and its ads.txt file once listed 87 ad-tech companies.
• The paperwork came late. Doogle first appeared in the privacy policy eight months after launch. Tellter's GDPR risk assessments for it were generated in batches, minutes apart, and say "No processing for marketing occurs."

How one click links your accounts

Double Counter is one of Discord's biggest verification bots. Tellter says it runs on more than 600,000 servers and sees 3.7 million people a month. Users report that it guards the official Microsoft Flight Simulator server. The largest server the attacker hit was Steal a Brainrot's; that Roblox game's official Discord has 7.7 million members.

When you join a protected server, the bot sends you a one-time link. Tellter's portfolio page says the page behind it "fingerprints the device and browser, then matches it against a graph of 40M+ identities." If your account matches an older one, the server's moderators get a log entry saying so.

A match is easy to trigger. Double Counter's documentation says accounts are linked when "the user either shares an IP with them, used their verification link, or used the same device," and that "the alt detection is permanent." Its verification bot page says false positives happen "rarely" and that "the common cases are people who share a device or a household connection."

Reddit has years of posts from people flagged as the alt of a sister, a brother, a cousin or a roommate. In one thread, a user told they had 17 alts said nobody else in their household used Discord and that Double Counter "will not reset my account."

When the system gets it wrong in one server, someone can't get in. In a search engine, the same mistake shows a sibling's account next to yours.

2021: DiscordAlts.com

The idea of searching that graph is older than Doogle. In 2021 Double Counter's homepage linked to an "Online tool" at DiscordAlts.com.

DiscordAlts.com in June 2021. Image: Internet Archive

"Once an alt account is detected in one of our servers, it is automatically added to DiscordAlts's database and can be looked up here," the site said. "Just type the main or the alt's Discord ID, and you will get a list of all accounts that are associated with it. Our alt detection process is based on IP, cookies, and other things."

The privacy policy at the time said: "Double Counter only collects one thing: your IP address... No other type of information is asked, collected or recorded." It didn't mention DiscordAlts. By September 2022 the domain was parked.

That 2021 policy also disclosed something later versions didn't: "Double Counter Pro provides a fingerprinting feature which shares your Internet Service Provider (ISP) - not your IP - to guilds," adding that it was "the guild's reponsibility to seek your consent." By October 2021 that paragraph was gone, though Pro's "fingerprinting" feature was still offered. No later version of the policy mentioned internet providers again until after the 2026 breach, which exposed the ISPs of about 27 million accounts.

Doogle: "Find every alt account behind any Discord user"

Doogle arrived in September 2024 as a Discord command. Double Counter's launch post said anyone with Double Counter Pro could type /doogle @user "in any server, anywhere" to "look up all the alternate accounts, VPN attempts, verified servers and more for the user," "even in official Discord servers," whether or not the server used Double Counter.

The day after the command went live, a "Doogle Plus" subscription was created on Double Counter's page in Discord's own store, and the listing is still published. It promises "50 Doogle Searches per day," using "Double Counter's massive database with 30+ million users" to "find all alt accounts for a Discord user, sorted by likeliness." A "Double Counter Ultimate" tier followed in February 2025 with "twice as many Doogle uses daily." On app subscriptions, Discord keeps a 15% platform fee on a developer's first $1 million in sales.

Doogle Plus on Discord's store, and the rule Discord has had since 2022. Sources: Discord store API, Discord Developer Policy

In 2025 Doogle moved to its own website, and access kept widening:

You didn't even need an account to start: "You will see how many linked accounts are on record before you sign in," a September 2026 Doogle guide promised.

Doogle's sign-in counter, read from archived copies of its site and its counter API. Sources: Internet Archive captures of doogle.gg and integrations.tellter.com

Doogle called these people "Discord moderators." In fact the number counted Doogle accounts: the site's own code names the request behind it "Get Doogle User Count." We found no step in either version of Doogle's website that checked whether a searcher moderated a server. The 2026 site didn't even ask Discord for the list of servers a user belongs to. The counter grew sixfold between mid-August and late September 2025, just after free searches arrived. It reached 840,625 on October 7, and Double Counter's breach report says the email addresses of about 840,000 Doogle accounts were copied.

What a search showed

Doogle never showed IP addresses or locations. For each linked account, graded certain, medium or possible, it gave the username, avatar and ID, plus the number of servers the person had verified in, their VPN attempts and a five-word "fingerprint" that Doogle said follows "the person from one account to the next." A paid add-on, Lens, scored each account's kicks, bans and moderated messages across the network from 300 to 850, the same range as a U.S. credit score.

Doogle's own example report. The account is made up. Image: Doogle, archived by the Internet Archive

The person being searched was never told. Doogle's alt detection page said so as a selling point: "The person you search is never notified."

You could opt out with Double Counter's /privacy command, if you knew it existed. Even then, an opted-out account still appeared in other people's results as "a placeholder card instead of their identity." In September 2025, Double Counter's docs had promised that opting out would "also opt-out any associated accounts." By December, that sentence had been rewritten into a narrower promise, though it still began "As of September 21, 2025."

People noticed. In May 2025, a post calling Double Counter "a glorified doxing tool" drew 184 upvotes on r/discordapp. That September, a YouTube video titled "Discord Alts Can Be Tracked Now..." passed 1.5 million views. It warned that Doogle "will only lead to it being used to stalk normal innocent Discord users, NOT the bad users." An r/privacy thread the same month said it could expose "the accounts of family members who share your internet connection."

Doogle's API, "granted on request," looked up IDs in bulk and charged per lookup. Its documentation told developers: "Whatever you build, cache identity lookups: profiles change rarely, and every live call is billed." Tellter revoked the keys on October 10. The shutdown doesn't reach copies that customers cached, and Tellter hasn't said who its customers were.

Where the 50 million came from

Tellter bought AltDentifier, a rival verification bot, in 2022 and merged it into Double Counter in March 2024. We found no notice to users in archived pages. AltDentifier's policy had promised since 2019: "AltDentifier never stores your IP Address for later use." From February 2025, Double Counter's Doogle page said the search "relies on the Double Counter & AltDentifier databases." Meanwhile a Tellter case study, online at the same time, said there was "No direct database migration." Public documents don't show which is true.

The verification page is an ad product

Most members never see Double Counter's settings. What they do see is the verification page, and Tellter has been selling space on it.

In 2022 and 2023, members who ran an ad blocker were sent to a page that read: "We must run ads to continue maintaining it. Please support us by disabling your ad blocker. I've done it, verify me!"

In archived copies of the result page from 2024 to 2026, a spinner reads "Double Counter is verifying your Discord Account..." between ad slots. The "Success!" message is already in the page underneath it. A script hides the spinner after a fixed delay, under a developer's comment: "Goal is to increase active view as much as possible." Active View is Google's measure of whether an ad stayed on screen long enough to count.

The verification result page's source in January 2025. The one-time link is removed and the highlights are ours. Source: Internet Archive copy of beta.doublecounter.gg

Then the page sends you somewhere else. Since at least March 2024, archived copies have redirected verified members to a game-key store's referral link, a web host's "Double Counter" landing page, and Tellter's own apps: a bouncing-ball video maker, a word game, an AI support bot and Doogle.

In July 2026 Tellter opened this up to advertisers. Its Advertise page offers "60,000 verified Discord users a day," because the verification screen "is the one page they all have to look at." It sells "Redirects": "After a successful verification, members are sent straight to your Discord invite or your landing page." Its FAQ asks, "Do you accept 18+, gambling or crypto projects?" The answer: "Yes, case by case." Campaigns run on free servers only; "Servers on Double Counter Pro are ad-free."

According to the advertiser dashboard's code, "You pay per 1,000 delivered redirects," priced by country. It also suggests a dedicated invite link to see "exactly how many members it brought in." In a copy archived on October 7, every clause of the advertiser terms was still a placeholder marked "[TODO-LEGAL]."

Double Counter's Advertise page on October 15. Image: doublecounter.gg

The display ads came through ad networks. In late 2024, Double Counter's ads.txt file, which lists the companies allowed to sell a site's ad space, named 87 ad-tech companies. From February to May 2025, the ad company Ezoic served the verification page through its own servers, so every visitor's IP address and one-time link passed through Ezoic. The privacy policy at the time had a section titled "We Do Not Share Your Data With Anyone."

What Tellter's paperwork said

Tellter made its promises in its privacy policy and in GDPR documents linked from it:

The timing matters too. GDPR requires a data protection impact assessment, or DPIA, before processing that's likely to be high-risk begins. Doogle launched in September 2024. The privacy policy first described it on May 3, 2025, and Tellter's earliest published DPIAs are dated May 30, 2025. The file metadata of both the May versions and the revised October versions lists "python-docx," a Python library, as the author. In each batch, all four documents were created within minutes of each other.

Tellter's DPIA for Doogle and Lens, which the privacy policy linked to until October 2026. Highlights are ours. Image: Tellter SAS

After the breach, the policy was edited between October 7 and 9. "AES-128" encryption became "AES-256," the 24-month retention section disappeared, and new security measures matching the incident report's fixes appeared. The page kept its October 2025 date and its note that "No material changes have been made to our data practices." On October 15 it was replaced with a version that "corrects and expands our previous policy." It lists internet provider, location down to ZIP code, usernames and email addresses, drops Doogle, swaps Ezoic for Google AdSense, and no longer links to the risk assessments.

What Discord's rules say

Since October 2022, Discord's Developer Policy has said: "Do not use API Data to: profile Discord users, their identities, or relationships with other users," and "Do not sell, license, or otherwise commercialize any API Data." The current version adds "Do not target users with advertisements or marketing."

The fit isn't exact. API Data means what an app gets from Discord, and the IP addresses and device signals came from Double Counter's own web page. But the usernames, avatars and IDs that Doogle linked together are Discord data.

Discord also vetted the bot. It told Insider Gaming that it "requires third-party apps to complete a verification process before they can be added to more than 100 servers," and Double Counter is a verified app. Its listing in Discord's app directory still says it is "the only bot that compares IP addresses, cookies and other advanced fingerprinting techniques to block alts."

Discord told Dexerto on October 7 that it had "disabled new installs of the app while we work with Double Counter to understand the full scope of the incident, and we'll take further action as appropriate." As of October 15, Discord's app directory still lists /doogle among the bot's popular commands, and Doogle Plus is still published in its store.

The breach

Double Counter's incident report says the attacker got in through Metabase, an analytics tool still running on a retired server, where a flaw "let the attacker forge an administrator session." They took over the bot, posted invites in about 50 large servers, copied database tables for 25 minutes and ran $7,316 in fraudulent charges through another Tellter product's payment account.

The report doesn't name the flaw. On August 11, the U.S. cybersecurity agency CISA listed a Metabase bug that lets an unauthenticated attacker "gain administrator access" (CVE-2026-72898) as actively exploited. Public certificate logs show a metabase.doublecounter.gg address that was renewed as late as September 11. We can't confirm it was the server that was breached.

Have I Been Pwned says 274,922 email addresses with Discord usernames were "published publicly." The report also mentions two untouched databases: "cold storage" holding "user data and IP addresses for ≈ 58 M users," and a separate "behavioural data database." The privacy policy said IP addresses are kept for at most 24 months, and Tellter hasn't said how old the cold-storage data is.

Some of the people in this data are likely children. Double Counter guards Roblox game communities, and 73% of Roblox users who have passed its age check are under 18, according to Roblox's shareholder letters. Since 2022, the verification page's hidden search keywords have been "roblox,videogames,anime." Tellter's risk assessments say it "treats all data subjects as a potential child."

What we still don't know

Tellter's only public statements are its incident report, the Doogle shutdown notice and the rewritten privacy policy. None of them answers these questions:

• Why did Doogle close? The notice gives no reason.
• Who used the API, and did they delete what they cached? Tellter told customers to cache lookups and hasn't named them.
• Was the search log taken? Tellter's risk assessment mentions "logging of all Doogle lookups," a record of who searched whom. The incident report doesn't say whether it was in the copied database.
• How old is the cold storage? The policy promised a 24-month limit, yet Tellter keeps a separate store of IP addresses for about 58 million users.
• Did AltDentifier's users end up in Doogle? Tellter has said both yes and no.
• What will Discord do? It hasn't said whether it reviewed Doogle against its developer policy, and Doogle Plus is still listed in its store.

What to do if you've verified with Double Counter

• Assume your verification data is exposed: your Discord ID, username, IP address, city, postal code and ISP at the time you verified.
• Ask what Double Counter holds, or delete it, with the bot's /privacy command or by emailing [email protected]. Deleting removes your Verified status in every server that uses the bot.
• If you used Doogle or the dashboard, your email address was copied. Expect phishing that mentions Discord, Double Counter or Doogle, and check your address on Have I Been Pwned.
• In the EU or UK, you can complain to your data protection authority if the answer doesn't satisfy you. Tellter reported the breach to France's CNIL.

The leaked data pairs Discord usernames with email addresses, and anyone holding it can search for both on other sites. You can run those searches first: a username search checks a handle across 700+ sites in about 20 seconds, and an email search shows which of nearly 200 services an address is registered with. Fingerprint uses only what profiles show publicly. It collects no IP addresses or device data from the people it finds and holds no breach data. Try it free on the demo, and use the opt-out page if it finds something you want gone.

FAQ

What was Doogle?

Doogle was a lookup service from Tellter SAS, the company behind the Discord bot Double Counter. You pasted a Discord user ID and it returned other accounts that Double Counter's verification data linked to the same person, graded by confidence. It launched in September 2024 as a Discord command, moved to doogle.gg in 2025, gave free searches to anyone who signed in with Discord, and shut down on October 10, 2026.

Why did Doogle shut down?

Tellter hasn't given a public reason. The shutdown notice offers subscribers a prorated refund or a new Double Counter add-on that "works only within their own server." It came six days after the Double Counter breach, in which about 840,000 Doogle account email addresses were copied.

What data was exposed in the Double Counter breach?

Double Counter's incident report treats Discord user IDs and usernames for about 28 million accounts as exposed. It does the same for IP addresses with country, region, city, postal code and internet provider for about 27 million. About 1 million email addresses and 25 million browser hashes were copied. Discord said its own systems weren't breached, and passwords and card numbers weren't involved.

Can someone find my alt accounts on Discord?

With public data, only when your accounts share something public, such as the same username, an email address in a bio or links between profiles. Double Counter also links accounts through private signals captured when you verify, such as a shared IP address, device or cookie, which is why siblings and roommates can be flagged as each other's alts. Doogle made those links searchable until October 10, 2026. Moderators of servers that use Double Counter still see them when an account verifies.

How do I delete my data from Double Counter?

Run /privacy in any server that uses Double Counter, or in a DM with the bot, and choose "Delete my data." You can also email [email protected]. Deleting your data removes your verified status in every server that uses the bot, so you'll need to verify again in servers where you're still a member.