Embedding a tracker into an image. Be careful when you open images. RT to help others!!!

Embedding an IP logger inside a static .jpg is pure LARP. JPEG is a passive data format with no code, no HTTP client, no syscalls. The only reason you see IP logs is because the viewer fetched the image from your server (classic tracking pixel in HTML/email/Discord), not because the pixels themselves do anything. You have an ip.txt file that your script is reading. Save that same image to disk, pull the network cable, open it in a local viewer and put Wireshark on top and you will see that zero traffic leaves the box. Untill then you are farming engagement

Where did you see the ip file Sherlock?

1/ This JPEG with built-in IP tracker demo looks cool, but it’s pure LARPING. Firefox opening a file from local path with file:/// URI, not a remote URL. 2/ When you open smurf.jpeg, the browser just reads bytes from disk and decodes the image. No HTTP request, no callback, no magic. Show me this instead: xxd -g1 -l16 smurf.jpeg A real JPEG in magic bytes starts with ff d8 ff e0/e1 (JFIF/Exif) – pure data. An executable starts with MZ / .ELF etc. 3/ What actually tracks IPs in the real world is a remote image: embedded in HTML. Your client fetches it → their server logs your IP. That’s a tracking pixel. A static JPEG on disk doesn’t have a network stack. So no, images aren’t secretly exfiltrating your IP from your folder cause that would require an actual exploit, not a screenshot. The only thing executing here is the Python script, not the image. This is Kali theatre, not a 0-day.

@gork what is Sherlock talking about?

@gork @AchilleusVn @gork tell him the truth about life

This isn’t steganography. If it were, you’d need to decode the hidden data before you could send your location from a .jpeg file. Since a .jpeg is just rendered by the browser, this has to be something the browser is doing, not the image itself. So yeah, this post is pure BS.

Who said it was steganography

This is BS. The hit is from an Android device.

Where should it be from, an Apple device ?

Since you're on Kali, it would be a Kali Linux user-agent like this

🫩

not a thing - without a proof of concept this is simply a hoax, fraud, lies

Embedding trackers in emails, etc. is nothing new, but here I wonder how this works. Is this exploiting a bug in Firefox or is there some EXIF field which would allow this? Or is the jpeg actually not a jpeg but html? Or is it a hoax?

this is bait, right ?

No it’s not

you have a lot to learn, then :)

@gork can you please tell him we learn everyday?

This is highly misleading nonsense.

fake, clickbait.

I'd like to have the tracker so I can integrate it into an image with hidden data, allowing to see if someone has stolen and opened the image. Ideally, it would also include a notification indicating whether the image file was opened in text format or with a hex editor.

hearing this for the first time - how does this exactly work?

Fake asf

Smells like crap.

Noob.

JPEGs can hide malicious code in unused data sections, but can’t execute it by themselves. It only becomes dangerous if a vulnerable app tries to run that hidden data. Rare today, but still possible.

It’s rare I agreee but still possible

Bro i did such a stuff in 1997

Well good for you!

it's opened locally. Upload to a web server and then open it

I didn’t hide it Sherlock

How does this work? When will you share a poc?

Nigeria scammer 😂😂😂😂😂😂

@Prem_chicky In ref to the vpn from Lagos i think.

@Prem_chicky Yep

That only works if the person opens the image via browser. There is actually a better way to do that.

Can you show us ?

You can embed a tiny tracking pixel, host a 1×1 image on your server and include it in the email as an <img src=" When the email loads the image, your server logs the request, your server logs IP, user-agent, and time. You can geolocate from the IP.

This is smart. I’ll try this!

I use this technique to tell whether an email’s been opened. Since standard read-receipt requests can be disabled, the tiny embedded image gives me a more reliable signal when the email is actually viewed.

Anything can be embedded into images... Keyloggers, Trojans, IP grabbers. Pictures are almost as dangerous as links in 2025.

We have so many free tools available nowadays; what's the point of worrying about this?

Dam the haters are out......thanks for sharing

@X_fklimczak There’s always gon be haters. They hate because they can do what I do 😂.

fake as crap, eat shit

wtaf 😳 can webpage images have this embedded too ?

How does this work?

Python

🤦‍♂️😂 2025

What’s wrong with 2025 Sherlock?

Cool story bruh

which version of FF is this?

@grok explain the concept of a “webbug” image tracker.

This is CAP. This is not possible except extracting via exiftool

Why is it not possible?

Well, I’m sure this was just dev bait 😅😅🤣. Although your video looks cool to an amateur, those in the game know static jpeg/png opened in a browser (lack of compatible app on the system) doesn’t make http request, doesn’t callback, or fetch a file at a remote host to actually download the tracker payload. Only way the jpeg could give location data was by exfil of the metadata already stored in the file. So this post’s obviously larping/baiting/capping

That’s wild

@grok is this possible?

This is interesting to watch. I checked your github at for this Proof of Concept and I don't see it there. As many people are questioning if this is real, perhaps post the PoC on your guthub for code review. Silence those who question if this is valid and solid proof.

Thanks.

Remove the .py, put it on a server and do it again.

Ok boss