iiinova — where your digital self keeps evolving

Sunnie Sunday @echo-unvaulted.net · 28/09/2026

Sunnie Sunday Report 2026-09-27: echo-unvaulted.net 2 new contributors found for a total of 44. There's now a contribution activity tracker that became possible because of EchoVault's account expiration policy. Also added their entire world transfer history.

echo-unvaulted.net

Sunnie Sunday Report

Characters verified as EchoVault users

031

Sunnie Sunday @echo-unvaulted.net · 22/09/2026

It's much more entertaining to see them in-game now...

010

Sunnie Sunday @echo-unvaulted.net · 08/09/2026

Reached a milestone of 100k audits for the first week of September, with 42 confirmed EchoVault stalkers found! Been working on moving all my scrips to a Dalamud plugin so that will be my priority for this patch week. #ffxiv

010

Sunnie Sunday @echo-unvaulted.net · 30/08/2026

Sunnie Sunday Report 2026-08-30 budget SUV edition: echo-unvaulted.net After auditing a total of 87829 unique characters, 35 verified EchoVault users have been found. #ffxiv

031

Sunnie Sunday @echo-unvaulted.net · 23/08/2026

Sunnie Sunday Report 2026-08-23: After auditing a total of 68973 unique characters, 28 verified EchoVault users have been found. #ffxiv echo-unvaulted.net

echo-unvaulted.net

Sunnie Sunday Report

Characters verified as EchoVault users

040

Sunnie Sunday @echo-unvaulted.net · 22/08/2026

It's harder to tell from decompiled code and just one of the many reasons to advocate for a public open source repository. Former stalker plugins have used AI in the past but all I can say is that EchoVault isn't secured against silly cats poking at it.

110

Sunnie Sunday @echo-unvaulted.net · 22/08/2026

Playing devil's advocate I do gather a subset of what EchoVault would (without Account IDs) to catch them and that "ick" is a reasonable reaction. That said these few confirmed users are leaking sightings of their friends list, FC members and everyone near like clockwork. They have a right to know.

100

Sunnie Sunday @echo-unvaulted.net · 22/08/2026

Requiring plugins to be FOSS is step in the right direction. Too bad XMA has decided to protect the identity of stalkers by deleting our entry.

210

Reposted by Sunnie Sunday

Aurelie @crowbiotics.bsky.social · 28/07/2026

Also, I've been hearing about a new stalker plugin making the waves lately. I am once again begging you all to NOT put your info into these, whether it is personal information or your character information (yes, including your name). Literally stop giving these people your information willingly

271

Reposted by Sunnie Sunday

Lor Ignister 🌪️ @lor.etheirys.social · 18/08/2026

After reviewing the write up as best I can with a migraine, I have some follow-up questions: Some of these accounts only have claim codes, a takedown code, or no code in their Lodestone. How did you verify these profiles are scrapers and not random?

311

Sunnie Sunday @echo-unvaulted.net · 18/08/2026

Poisoning was my first intent. Over time I became uncomfortable with this because it requires caching and sending lots of legitimate character data with only a few things altered (or it won't be accepted). But yes it can be done with fake Account IDs.

110

Sunnie Sunday @echo-unvaulted.net · 18/08/2026

Some users who left their claim or takedown codes can be found on Google. Of those I've audited that way less than 10% were verified users (meaning over 90% just wants to opt-out of the website).

100

Sunnie Sunday @echo-unvaulted.net · 18/08/2026

What I look for isn't the codes. I start the verification process as them with Echo's API as you can see from the HTTP logs on each character's entry. If someone *only* did the claim process, they will not trigger an "already_claimed" response on the "/v1/auth/verify/start" endpoint.

010

Sunnie Sunday @echo-unvaulted.net · 17/08/2026

Just to add context: while we obviously don't have the server's code it can be implied that it compares where the reporter is in relation to it's sighting. The coordinates for both are sent.

210

Sunnie Sunday @echo-unvaulted.net · 17/08/2026

The data structure you see is from the latest version (v0.8.3) so yes. I didn't notice anything being removed since it launched...

110

Sunnie Sunday @echo-unvaulted.net · 17/08/2026

You are right, EchoVault's website is extremely dishonest on what it actually collects. To better understand what it does and the policies it violates, see echo-unvaulted.net/docs/index.h...

200

Sunnie Sunday @echo-unvaulted.net · 16/08/2026

The Sunnie Sunday Report echo-unvaulted.net is a weekly report of discovered EchoVault contributors. These characters were found with our own tools exploiting a few security oversights in Echo’s protocol.

echo-unvaulted.net

Sunnie Sunday Report

Characters verified as EchoVault users

055