Scam Guard (anti-raid)

Scam Guard protects against the most common raid: a compromised account that pings @everyone and drops the same malicious link across many channels in seconds. It reacts to behaviour, not text, so it also catches scams shipped as an image or QR code that a word filter can never see.

Beta — tested, still young.

Set it up

1. Enable the Scam Guard plugin in the Plugin Market.
2. Open Anti-Spam (in the Moderation group) → Scam Guard tab, and choose the action to take when a raid pattern is detected.

What it detects

• Mass mentions — a single message pinging @everyone / @here or a pile of user mentions.
• Multi-channel flooding — the same message (with a link, a file, or text of 20+ characters) posted in several channels within a few seconds. Short chatter like "gg" never counts.
• Character walls — block and Braille characters (█ ▓ ⣿) that fill a message and push the readable chat off screen.
• Scam links (optional, off by default) — a message containing one of the domains you list.

Any of these patterns trips the guard.

Flood hits and character walls each have their own action (Flood action, and Action under character walls), set to Timeout by default — even when your main action is a ban. Those two can misfire, and the offending message is deleted either way, so a reversible answer is the right one. Mass mentions and scam links use the main action.

Defaults

Setting	Default	Range
Mention threshold (user mentions)	5	1–100
Flood: channels	3	2–50
Flood: within seconds	10	1–300
Character walls: min. characters	200	50–2000
Character walls: min. share	60 %	10–100 %
Main action	Ban	—
Timeout	60 minutes	1–40320 (28 days)

Action when it fires

Pick one action (configurable per network):

• Ban — also deletes everything the member posted in the last hour, server-wide. With Ban Sync on, a ban on your main server is enforced on the sub-servers automatically; a ban on a sub-server stays there. Recommended for the fastest stop, since these are usually hacked accounts the real owner can appeal to recover.
• Kick — remove them (they can rejoin once the account is secured).
• Timeout — mute them for a set number of minutes.

The offending messages are removed and every trigger is written to the Scam Guard log. Each option in the dropdown says in plain words what it does, so you don't have to guess.

Optionally turn on DM the user to send a notice before the action. The message can use {user_mention}, {user_name} and {guild_name}.

The timeout length and the quarantine role are shared: one field each, used by every signal set to that action. They appear as soon as any active signal needs them — also when only flood or character walls use them.

Who is never affected

Scam Guard never acts on:

• members with the Manage Server permission,
• users on your network's Whitelist (trusted users),
• users you added as admins by Discord ID in Project settings (holding the admin role is not enough).

Note that this is a permission, not a role: a moderator role without Manage Server is not covered by it.

Announcement roles and @everyone

Scam Guard used to treat a single @everyone as a raid signal regardless of your mention threshold. It no longer does:

• Anyone who is allowed to mention @everyone in that channel can do so freely — having the permission and being punished for using it made no sense.
• You can also list exempt roles per server on the Sub-Servers page ("Mention exempt"). Holders can post @everyone and large mention lists without tripping the guard.

Both exemptions apply to mass mentions only. Multi-channel flood detection stays active for everyone, and that is on purpose: it is the check that catches a trusted account after it has been hijacked — which is exactly the case Scam Guard exists for.

Quarantine

Besides ban, kick and timeout there is Quarantine: the member keeps their place on the server but gets a role you choose (typically one that can only see a help channel). It needs a quarantine role — the dashboard won't save a quarantine action without one.

Scam links (optional)

Off by default. When enabled, you supply a list of domains; a message containing one of them trips the guard. Unlike the behavioural signals this one only looks at text, so it does nothing against image scams.

Character walls

Pushing the chat off screen is a raid tactic in its own right: nobody can moderate what they can't read. Scam Guard counts characters from four Unicode blocks — box drawing, block elements, geometric shapes and Braille — and trips when a message has both enough of them and a high enough share.

Both conditions are needed. Share alone would flag a lone ⣿; count alone would flag a long, perfectly readable post that happens to contain an ASCII table. The share is measured against the message without whitespace, because the usual way to build a wall is to stretch it vertically with blank lines.

ASCII art made of #, / and \ is deliberately not covered. A check wide enough to catch that would eventually delete someone's birthday card. If you need those gone, the word filter is the right tool — it does what you tell it to.

Give the bot Ban Members, Kick Members, Moderate Members, Manage Messages and Manage Roles (for quarantine) so every action option works, and make sure its role sits above the members it should act on. Pair Scam Guard with the honeypot and account-age filter for layered raid defense.