I was in an argument online with a guy and he sent me a fake youtube link. I clicked on it like an idiot and he asked me how my city is (he knows the name) and he knows my cable provider. Does anyone know how serious this is and if I should be worried?


You aren't hacked.

Well, not by this link anyway.

I opened the link you provided on a cloud instance and proxied the connection through Burp Suite so I could track exactly what happened with the redirects.

Turns out it is a grabify.link link. Grabify offers url shortening and provides some level of detailed information about who follows the link. This includes IP address, user-agent header, hostname, and time the link was followed. This is all standard metadata that gets sent every time you send traffic anyway. At this point the person knows at least your IP address and the type of operating system/browser you are using (unless you modified your user-agent already, which many do for privacy reasons anyway). If you have open ports/ listening services on your router, there is a good chance they will try attacking these if they are malicious.

The bad news: They have any info they can glean from your IP, hostname, and user-agent header. This includes your cable provider since your cable provider owns the netblock you are in.

The good news: They can't do much with this alone. They can scare you by pretending to have hacked you, but by this link alone they haven't gained access to your network/phone.

What to do now:

  • If you have a dynamic IP from your ISP (most do), release and renew your DHCP lease. This will change your IP address and they won't know how to find your router anymore. Sometimes you can do this in your router, some ISPs you need to call them and say you want to release/renew your DHCP lease. You can verify this worked by googling 'what is my IP' before and after the release/renew.

  • Check what ports are open and what services are listening on the router.

This is easiest to do on a linux machine, but can also be done on Windows and Mac by getting the nmap tool. For reference, this is the command I use on linux to scan my own public IP address when I want to see what ports I have exposed:

dig +short myip.opendns.com @resolver1.opendns.com | xargs nmap -p0-

This gets your public IP address and scans all of it's ports. If this looks strange to you, I would google around for how to scan you public IP, or search other answers. This is not the most standard way of finding and scanning your public IP but is efficient on linux, especially when the first half of the command is aliased to whatismyip.

Bottom line:

You are probably safe.. for now. If every one of your ports on the WAN side of your router is closed, you're fine. If you release/renew your DHCP lease through your ISP, you're extra fine. If you have ports open/ services listening on the WAN side, definitely get new DHCP lease, as the person can now sit back and try to find vulnerabilities in them, and possibly hack you from there. If you happen to be an unfortunate soul with a static public IP (unlikely), buckle down and figure out how to best secure your router, because this person knows its address now.



I'm pretty sure your phone was not hacked.

Such information are easily to obtain by simply having your IP address. And by connecting to a link controlled by somebody you make your IP address visible to him. This means all the web sites in the world you connect to have this information about you, it is probably in the mails you write etc. You can try it yourself by visiting sites like whatsmyipaddress.com.

This means that these information by themselves are not really secret. But if the attacker finds out that you are surprised that he has this information then this knowledge can be used to mount social attacks against you, i.e. if you are gullible enough in this case you will be gullible in more cases. For example the attacker might "help you" to install a program which claims to better protect your privacy but in reality provides the attacker full access to your system or fills it with lots of advertisements.

Knowledge of your IP address might also be useful to mount attacks against your internet router because many of these routers are open to attacks and average users don't care about the security of these devices. This then can lead to really serious problems, like the one described in How millions of DSL modems were hacked in Brazil....

Your Answer

