INVESTIGATION UPDATE: New Testimony and Expanding Cybersecurity Allegations Surrounding the…

INVESTIGATION UPDATE: New Testimony and Expanding Cybersecurity Allegations Surrounding the Noblesse Incident

Subject: Reported attacks against Discord powerscaling communities, the Noblesse server incident, alleged moderator impersonation, and emerging cybersecurity concerns.

Status: Ongoing investigation. This update incorporates additional recorded testimony and identifies other allegations that require careful examination and independent corroboration.

Original investigation:

https://medium.com/@michaeljonhson2/inside-an-alleged-campaign-of-cyberattacks-against-the-powerscaling-community-80ffc2560d74

Relevant livestream:

https://www.youtube.com/live/TvwUMpnQoJk?si=gSnzHPi_s2JyQoQB

---

1. Introduction: New Material and a Developing Investigation

This article is an update to an ongoing investigation into allegations of cyberattacks, unauthorized server disruption, harassment, and related misconduct affecting online communities within the powerscaling scene.

The investigation initially focused on reports concerning the Noblesse Discord server, associated with the creator ZetaSolos. The incident raised questions about how an online community could experience substantial disruption, how access to administrative permissions may have been obtained, and whether the incident was connected to a wider pattern of malicious activity.

Additional recorded testimony has since become relevant to the investigation. In a livestream, ZetaSolos discusses the Noblesse incident and describes a sequence involving alleged moderator impersonation, the acquisition of server roles, and the subsequent disruption of the server.

Other livestreams reportedly contain explicit references to the online aliases MarkSolos985 and Marz in connection with the incident. These recordings should be examined together, with their original context and timestamps preserved.

Meanwhile, further allegations have emerged concerning possible doxxing, account compromise, website disruption, fraudulent requests for sensitive information, and other potentially serious forms of cyber abuse.

These matters warrant careful documentation. They should not, however, be treated as a single proven operation merely because they involve overlapping names or communities. Each incident requires its own evidence, timeline, and attribution assessment.

The objective of this update is to establish what the available material actually supports, identify questions requiring further investigation, and provide readers with the sources needed to assess the claims independently.

2. The Noblesse Incident: What the Recorded Testimony Describes

One of the most relevant sources is a YouTube livestream by ZetaSolos:

https://www.youtube.com/live/TvwUMpnQoJk?si=gSnzHPi_s2JyQoQB

At approximately 1:12:25–1:12:34, according to the transcript reviewed for this investigation, ZetaSolos discusses the incident and describes an alleged sequence in which an individual impersonated a moderator, claimed there was a problem involving account access, obtained server roles, and subsequently disrupted the server.

The account is significant because it addresses the alleged method through which the incident occurred, rather than merely documenting the aftermath.

The transcript also contains a reference to Marz's friend in the explanation. The identity of that person and the exact wording should be checked against the full recording before the passage is quoted as definitive evidence identifying a specific individual.

ZetaSolos also discusses the effects of the incident on the community. The transcript describes substantial losses in the server's membership and subsequent recovery efforts.

These details matter because server disruption can affect much more than a temporary conversation space. It can remove members, interrupt community activities, undermine trust in moderators, and require considerable time to restore the server's previous state.

What this source establishes

The recording provides material for documenting what ZetaSolos said publicly about the incident.

It also supplies a specific account of alleged moderator impersonation and the acquisition of server permissions. Those details can be compared with server logs, contemporaneous announcements, screenshots, and accounts from people directly involved.

What still requires corroboration

A recording of a person's statement does not automatically establish every factual assertion contained in that statement. The full recording, any relevant server records, and other independently verifiable material remain important when evaluating attribution.

The complete sequence should therefore be reconstructed using the strongest available sources rather than relying on a single excerpt.

3. The Identification of MarkSolos985 and Marz

This investigation concerns online aliases reported to include MarkSolos985, MarkSolos, and Mark, alongside Marz and TheMarzer.

According to the investigator, other livestreams explicitly mention MarkSolos985 in connection with the Noblesse raid and server disruption. These recordings may be particularly relevant when considered alongside ZetaSolos's account.

For publication, each recording should be documented separately, including:

• The original livestream URL.
• The timestamp at which the relevant statement begins and ends.
• The speaker's exact words.
• The surrounding conversation necessary to understand the statement.
• Whether the speaker claims firsthand knowledge or is repeating information from someone else.
• Any corroborating material that independently supports the attribution.

The distinction between identifying an alleged perpetrator and establishing the involvement of everyone associated with that person is important.

If a recording identifies MarkSolos985 in connection with the incident, that statement should be described accurately. If another recording discusses Marz or a possible relationship between the individuals, that material should be assessed independently.

A claim that two people acted together requires evidence supporting their respective roles. Association, friendship, or appearing in the same discussion does not independently establish coordination.

The investigation should therefore present the strongest available attribution evidence while clearly explaining its source and limitations.

4. Allegations of Doxxing and Retaliation

Additional allegations associated with the broader dispute concern the exposure or threatened exposure of private information, harassment of community members, and pressure directed at moderators.

These allegations are serious because publishing private information without consent can create risks that extend beyond an online argument. It can expose affected people to unwanted contact, harassment, impersonation, or threats to their personal safety.

The investigation has previously discussed allegations concerning a Noblesse moderator identified as KD. Any account of this incident should distinguish between the original material, the moderator's own statements, and interpretations offered by other community members.

The most useful evidence would include original messages, unedited screenshots with sufficient context, contemporaneous reports, and firsthand statements from the affected person.

Private information should not be reproduced in this article merely to demonstrate that it allegedly exists. Sensitive information should be redacted, and the investigation should avoid encouraging readers to identify, contact, or confront anyone.

Questions that require examination

• What specific conduct was reported?
• When did it occur?
• Is there an original record of the alleged communication?
• Can the affected person confirm the account?
• Is there evidence connecting a particular online alias to the conduct?
• Have alternative explanations been considered?

Until those questions can be answered with appropriate evidence, individual claims should be attributed to their sources rather than presented as conclusively established findings.

5. Reports of Account Compromise and Unauthorized Access

Other allegations concern possible unauthorized access to accounts and attempts to obtain access through deception.

The Noblesse testimony is relevant to this subject because it describes alleged moderator impersonation and the acquisition of elevated server permissions.

However, different forms of unauthorized access should not be conflated. Impersonating a moderator to persuade someone to grant server roles is not necessarily the same as stealing login credentials, compromising an account, or exploiting a technical vulnerability.

Each scenario has different evidentiary requirements.

For example, a claim of account compromise may be supported by login alerts, account-provider security notifications, session histories, audit logs, or a firsthand account from the account owner. A claim involving unauthorized server permissions may be supported by Discord audit logs and records showing which account granted the permissions and when.

Such records may help establish a timeline. They do not necessarily establish the real-world identity of the person operating an account, so attribution still requires care.

The investigation should also distinguish between evidence that an event occurred and evidence identifying who caused it.

6. Allegations Involving Websites and Other Online Services

Further claims have reportedly emerged concerning the disruption or takedown of websites and online services.

These claims require incident-specific documentation.

A website becoming unavailable does not, by itself, establish that it was attacked. Outages can result from technical failures, hosting problems, configuration errors, maintenance, or other causes.

Where a deliberate attack is alleged, relevant evidence might include a statement from the affected site's administrator, a hosting provider's incident report, reliable service-status records, or technical findings from a qualified investigator.

The investigation should record the affected service, the approximate time of the incident, the reported impact, and the source of the attribution.

It should not infer that the same person caused multiple outages simply because the incidents occurred within the same online community or around the same period.

Where evidence remains incomplete, the appropriate description is that an incident has been reported and its cause or attribution has not yet been independently established.

7. Allegations Involving Fraudulent Requests for Sensitive Information

Among the most serious additional allegations are claims involving stolen government email accounts and fraudulent emergency data requests.

These claims require particular caution.

An emergency data request is a formal process associated with specific legal and procedural requirements. The existence of an email address that appears to belong to a government employee does not establish that the account was stolen, that a request was submitted, that a provider acted on it, or that private information was obtained.

A responsible investigation would need evidence addressing the individual steps of the alleged incident, while avoiding publication of sensitive personal information or material that could compromise an ongoing investigation.

Potentially relevant evidence could include a statement from the affected organization or service provider, a verified incident report, or records authenticated by an appropriate investigator.

Unless such evidence is available, claims about stolen government email accounts or fraudulent emergency requests must remain explicitly identified as unverified allegations.

These allegations should not be attributed to MarkSolos985 or Marz as established facts without evidence connecting them individually to the specific conduct.

8. Why the Allegations Must Be Evaluated Separately

The reported incidents span several distinct categories:

• Disruption of an online community.
• Alleged impersonation and manipulation of server permissions.
• Alleged harassment and exposure of private information.
• Reports of possible account compromise.
• Alleged website disruption.
• Claims involving fraudulent requests for sensitive information.

These categories can overlap, but they are not interchangeable. Evidence supporting one does not automatically prove the others.

For example, a recording discussing the Noblesse incident may be relevant to the question of who was accused of participating in that incident. It would not independently establish that the same person was responsible for an unrelated website outage or a fraudulent request for private information.

The strongest investigation is one in which each claim can be traced to a source and assessed on its own merits.

A useful evidence record should distinguish:

Directly documented material: Original recordings, authenticated messages, server logs, or other records that can be examined directly.

Firsthand testimony: Statements from people who say they personally witnessed an event or were directly affected.

Secondhand accounts: Reports from people describing information they received from someone else.

Inference: A conclusion drawn from multiple facts, which should be explained rather than presented as a directly observed event.

Unverified allegation: A claim for which sufficient supporting evidence has not yet been obtained.

This classification does not dismiss the reports. It makes it possible to investigate them seriously without overstating what is known.

9. Impact on the Powerscaling Community

Although powerscaling communities are generally organized around fictional characters, debates, and shared interests, their members can still experience significant consequences when disputes escalate into alleged cyber abuse.

Server disruption can damage community infrastructure. Harassment can make members reluctant to participate. The threatened exposure of private information can create fear and uncertainty. Alleged unauthorized access can undermine confidence in moderation systems.

These risks are not limited to one server.

Community administrators should review permission structures, limit administrative access to people who need it, protect accounts with strong authentication, preserve audit records, and establish a clear process for reporting suspicious activity.

Members who believe their accounts or private information have been compromised should preserve relevant evidence and seek help from the affected platform or an appropriate trusted adult or authority when necessary.

No one should attempt to retaliate by hacking accounts, publishing private information, threatening alleged perpetrators, or targeting unrelated communities.

10. Source Transparency and Verification

This update builds on an earlier article and additional material reported by the investigator.

Original investigation:

https://medium.com/@michaeljonhson2/inside-an-alleged-campaign-of-cyberattacks-against-the-powerscaling-community-80ffc2560d74

Related Tumblr publication:

https://www.tumblr.com/michaeljonhson2/830181257749118976/inside-the-alleged-cyberattack-campaign-targeting?source=share

Related Blogger publication:

https://marksolos985andmarz.blogspot.com/2026/10/inside-alleged-campaign-of-cyberattacks.html

Relevant ZetaSolos livestream:

https://www.youtube.com/live/TvwUMpnQoJk?si=gSnzHPi_s2JyQoQB

The investigator has also reported publishing related material on X and Reddit. Those posts should be linked individually when their exact post URLs are available, so readers can distinguish original evidence from commentary and summaries.

Readers should prioritize original recordings and primary documentation wherever possible. Reposts, summaries, and automated descriptions may help locate material, but they are not substitutes for reviewing the underlying source.

11. What Further Evidence Would Help?

The investigation would benefit from additional material that can be authenticated and independently assessed.

Particularly useful contributions would include:

1. Original recordings with timestamps and sufficient context.
2. Firsthand accounts from people affected by the Noblesse incident.
3. Relevant server audit logs or contemporaneous administrative records.
4. Evidence supporting or contradicting the alleged sequence of moderator impersonation and permission acquisition.
5. Original documentation of any separate alleged doxxing, account compromise, or website disruption.
6. Verified records from affected service providers or organizations where other serious allegations are concerned.

Contributors should not send passwords, authentication tokens, private keys, or unnecessary personal information. Sensitive evidence should be shared only through appropriate, secure channels with people qualified to handle it.

Anyone submitting material should explain whether they witnessed the event personally, received the information from another person, or inferred the conclusion from other evidence.

Corrections and contradictory evidence should also be considered. An investigation becomes more reliable when it tests its conclusions instead of collecting only material that supports an existing theory.

12. Conclusion: A Serious Incident That Requires Evidence-Based Attribution

The Noblesse incident remains a central subject of this investigation. ZetaSolos's recorded account describes alleged moderator impersonation, the acquisition of server permissions, and subsequent server disruption. The investigator has also identified other livestreams reportedly naming MarkSolos985 in connection with the incident.

Those sources deserve to be examined together and documented precisely.

At the same time, additional allegations involving doxxing, account compromise, website disruption, and fraudulent requests for sensitive information require their own supporting evidence. Their seriousness makes accurate attribution especially important.

The purpose of this investigation is to document reported incidents, preserve relevant source material, examine possible connections, and help the community understand the risks involved.

It is not a call for harassment or retaliation. Readers should assess the original evidence, distinguish testimony from independently corroborated findings, and avoid spreading private information.

Further verified documentation may clarify what happened, who was involved, and whether apparently separate incidents are connected. Until then, the investigation will continue to distinguish established records from allegations that remain under examination.