The Real World (Andrew Tate)
All Connections
4 total
All Connections
4 totalAndrew Tate's The Real World uses NMI (Network Merchants Inc.) as its card payment processor after mainstream processors dropped the account. This relationship is confirmed via change.org petition update referencing NMI by name as the payment facilitator for Tate's merchandise and subscription store.
The Real World uses Radom Pay as its cryptocurrency subscription processor, confirmed via multiple source references identifying Radom Pay as the crypto payment rail for Hustler's University and The Real World alongside NMI for card payments.
NMI (Network Merchants Inc.) connects The Real World branded platform and New Era Learning LLC (operator) in its payment gateway role — neither entity has a direct documented edge to the other in the graph, only through NMI and Radom Pay
Radom Pay uses HotJar (site ID 6433214) for user behavior analytics on their pay.radom.com checkout page. The TRW checkout (checkout.jointherealworld.com) also loads HotJar. Both platforms use the same analytics vendor for checkout funnel analysis, though their specific HotJar site IDs may differ.
All Findings
11 total
All Findings
11 totalfinancial (1)
The Real World subscription price escalated from $49.99 to $99.99/month over three years; platform uses high-risk gateway NMI and Radom Pay crypto processor after mainstream processors dropped it post-2022 deplatforming.
The Real World (TRW) subscription price has been raised multiple times: $49.99/month at launch (as Hustler's University 2.0), then $49 as The Real World, raised to approximately $77/month in mid-2025, $99.99/month as of February 2026 per member reports. The platform intentionally avoids mainstream payment processors. After its previous mainstream processor dropped it following the 2022 Meta/TikTok deplatforming, The Real World migrated to NMI (Network Merchants Inc., Schaumburg, Illinois), a high-risk-specialist payment gateway, and Radom Pay for cryptocurrency subscriptions.
digital (9)
jointherealworld.com domain secured via first SSL cert April 2019 — 4 years before TRW public launch — indicating early brand pre-positioning
Certificate transparency logs show jointherealworld.com received its first SSL certificate on 2019-04-14 from Cloudflare. The platform was not publicly launched until January 2023 (and Hustler's University not until May 2021). The domain was secured approximately 4 years before the public platform launch, indicating deliberate brand pre-positioning.
The Real World internal infrastructure runs on therealworld.ag (Antigua TLD), launched 2023-01-01; 30+ service subdomains mapped including api, rpc2 (AWS ELB), sentry, unleash, nmi relay
Certificate transparency logs show a wildcard Let's Encrypt cert for *.therealworld.ag issued 2023-01-01, and an Amazon RSA cert for therealworld.ag and trw.network issued 2023-01-04. The .ag TLD (Antigua and Barbuda) was chosen for the internal platform domain. All 30+ internal service subdomains (api, rpc, workers, sentry, mgmt, ingest, etc.) are hosted under this domain, all behind Cloudflare proxy (172.66.41.10 / 172.66.42.246).
nmi.therealworld.ag subdomain on Vercel confirms NMI payment gateway integration at DNS level; checkout also loads Kount (ssl.kaptcha.com) and 3DS Integrator (cdn.3dsintegrator.com)
The domain nmi.therealworld.ag resolves via CNAME to cname.vercel-dns.com, confirming a dedicated Vercel-hosted subdomain named after the NMI payment processor. Combined with ssl.kaptcha.com (Kount fraud detection) and cdn.3dsintegrator.com (3D Secure) loading in the TRW checkout page, this constitutes direct DNS-level confirmation of the NMI payment gateway integration.
TRW checkout stack confirmed: Next.js/Vercel frontend, NMI card processing, Kount/Equifax fraud detection (ssl.kaptcha.com), 3DS Integrator for 3D Secure, HotJar analytics, internal ingest.therealworld.ag telemetry
URLScan scan 73d6635c (2023-12-21) of the TRW checkout page recorded external domains cdn.3dsintegrator.com, ssl.kaptcha.com, ingest.therealworld.ag, and hotjar.com. ssl.kaptcha.com is Kount (Equifax's fraud detection platform, acquired 2021), confirmed by kaptcha.com DNS pointing to AWS ELBs named 'colle-elast-*' (collector) with a subdomain mqa → collector.qa06.private.kount.com.
Live TRW checkout URL captured: checkout.jointherealworld.com/checkout/plan/contender with affiliate ID hckfpcqj; supports USDC/USDT crypto payments and card (via NMI)
URLScan scan e55a4cac (2024-01-16) captured a live TRW checkout URL: https://checkout.jointherealworld.com/checkout/plan/contender?a=hckfpcqj?subid=ads. The page loaded from Vercel (IP 76.76.21.164). Crypto payment icons (usdc.3e92b3cf.svg, usdt.6d35925e.svg) confirm USDC and USDT ERC-20 support. URL structure reveals: plan name 'contender', affiliate ID 'hckfpcqj', traffic source 'ads'.
TRW affiliate TikTok clip tool (cliptok.jointherealworld.com) runs on trw-afm.online, hosted on Hetzner Germany (128.140.103.112), registered via Porkbun
cliptok.jointherealworld.com CNAME points to trw-afm.online. Certificate (id from ct.sh 2025-08-10) shows CN=cliptok.jointherealworld.com with SAN=trw-afm.online. trw-afm.online resolves to 128.140.103.112 (Hetzner Online GmbH, ASN 24940, Nuremberg, Germany). Registrar: Porkbun. 'Cliptok' appears to be a TikTok clip reposting / affiliate marketing tool.
Live Radom Pay checkout (pay.radom.com/checkout/{uuid}) confirmed redirecting to Telegram after payment — consistent with TRW's crypto-then-community onboarding flow
URLScan scan 019b07fd (2025-12-10) captured a live Radom Pay checkout URL: https://pay.radom.com/checkout/4e0186d8-e912-468f-b543-ae28786846e1. The page loaded and then redirected to t.me (Telegram, IP 149.154.167.99). This pattern — Radom checkout → Telegram redirect — is consistent with TRW's onboarding flow (pay → join Telegram/Matrix community).
therealworld.com is owned by MTV/Viacom (Paramount), not Andrew Tate; HTTP 301 redirects to www.mtv.com/series/all-content; Tate's platform runs on jointherealworld.com
therealworld.com resolves to three AWS ALB pool IPs (100.28.104.175, 54.157.108.158, 98.83.184.133, ASN AS14618 Amazon Data Services NoVa, Ashburn VA) but returns a 301 redirect to www.mtv.com/series/all-content. The Shodan-scanned SSL certs on those IPs belong to AMC Networks, Viacom, and Dentons law firm — shared ALB tenants. MTV/Viacom owns therealworld.com as the brand domain for their long-running reality TV show.
TRW content library hosted on Hetzner dedicated server (91.98.19.94) in Dubai, UAE — operationally consistent with Tate's UAE base
library.jointherealworld.com resolves to 91.98.19.94 (Hetzner Online GmbH, ASN unknown, city: Dubai, UAE). Hostname: static.94.19.98.91.clients.your-server.de. This is a Hetzner dedicated server in the UAE, serving the TRW content library. Consistent with Andrew Tate's stated operational base in Dubai.
operational (1)
The Real World suffered a data breach exposing nearly 1 million user accounts (emails, passwords) in May 2024 due to a misconfigured database.
A misconfigured database exposed the personal data of 968,447 user accounts for The Real World platform in May 2024. Leaked data included email addresses and account passwords. This is a significant consumer-harm signal and suggests backend infrastructure operated with minimal security controls at a platform claiming hundreds of thousands of active subscribers.