Anti-raid and security

Dispatch.IO security is made of five building blocks:

For every anti-raid protection, the bot follows the same path:

The protections fall into three families, detailed below: message filters, join control and server protections.

Turning the anti-raid on

1. Turn on the master switch: the button labelled Enabled in /config → Antiraid, or Enable Anti-Raid on the Anti-Raid page of the website. While it is off, no protection acts, the captcha included.
2. Pick the Anti-Raid log channel (called Raid logs channel in /config → Channels): this is where the bot reports everything it does.
3. Turn on the protections you want one by one. On a new server, all of them are off.

Raid mode and the flagged member alert work even while the anti-raid is off.

The bot's permissions

The bot needs specific permissions to sanction and repair. Keep the Administrator permission on it (it includes all of them) and put its role above the roles of the members it must watch (see Permissions and roles).

When a permission is missing, the action is skipped and the bot posts an error in the Server logs channel.

Who is never sanctioned

• The bot itself: its own actions (recreating a channel, unbanning…) trigger nothing.
• The server owner and the Dispatch.IO creators, for message filters and join control.
• Whitelisted members, roles and apps, for the protections covered by their scope.

Messages from other bots are filtered like members' messages. Messages sent through a webhook are not filtered.

Thresholds

Thresholds (number of messages, time window…) are the same for every server and set by the Dispatch.IO team. The values on this page are the defaults. Only the minimum age of recent accounts is set per server.

Message filters: warnings, then a timeout

For links, abusive mentions and forbidden words, each offending message is deleted and earns a warning: an infraction is recorded, the member gets a DM and the raid logs channel gets a log. On the 3rd warning within the protection's time window, the member gets a 24-hour timeout.

Spam is stricter: a 24-hour timeout on the first detection, with no warning.

Server protections: role removal, timeout and repair

For channel creation, channel deletion, invites, webhooks and server changes, the bot:

1. removes the offender's roles that have the Administrator permission (except roles managed by an integration);
2. gives them a 3- or 7-day timeout depending on the protection;
3. undoes the damage (channels deleted or recreated, invites or webhooks deleted, settings restored).

If the offender is an app whose integration role has the Administrator permission, it is banned instead of timed out.

Mass ban works slightly differently: the bot removes the offender's ADMIN and MODO staff roles registered for the server (see Permissions and roles), gives a 7-day timeout, then unbans the victims.

Infractions

Every anti-raid warning and timeout is recorded as an infraction issued by the bot. You can find them with /infractions (see Moderation). Deleting a warning lowers the counter that leads to a timeout.

Logs

Every warning and sanction is posted in the Raid logs channel: the member, the channel, the deleted message and, for a timeout, the reason and the sanction. Emergency mentions are added at the bottom (see below).

The filters check every new message and every edited message. They ignore the owner, the Dispatch.IO creators and members whitelisted with the Messages scope. They run in this order, and only the first one that detects something acts: links, spam, abusive mentions, forbidden words.

Anti-spam

• Trigger: a member's 5th message within 5 seconds, all channels combined. Message edits count too.
• Sanction: an immediate 24-hour timeout, and removal of the roles that have the Administrator permission. An administrator app is banned.
• For 10 seconds, every new message from that person is deleted as soon as it is sent.
• Clean-up: the bot deletes the latest messages of the channel, as many as the spammer's recent messages.

Links

• Trigger: anything that looks like a link, with or without https://: example.com, discord.gg/…, IP addresses, GIF links, but also words such as readme.md or script.py. The content of forwarded messages is checked too.
• Exceptions: the channels allowed for links and open ticket channels. Threads of an allowed channel are not exempt.
• Action: message deleted and a warning. On the 3rd warning within 60 seconds, a 24-hour timeout.
• Setting: the list of allowed channels (Channels allowed for links on the website, Edit allowed channels in /config). In /config, your selection replaces the whole list. A deleted allowed channel is removed from the list automatically.

Abusive mentions

• Trigger: a message with more than 5 mentions, or 3 messages containing mentions within 30 seconds. Member and role mentions, @everyone and @here count (even if the member is not allowed to use them). The automatic mention of a reply does not count.
• Action: message deleted and a warning. On the 3rd warning within 30 seconds, a 24-hour timeout.

Forbidden words

• The list: a built-in list of insults, hate speech, threats and a few scam phrases, in French and English, always active and not displayed, plus your own words (50 characters max each).
• Detection: case and accents are ignored. The bot also spots letters separated by spaces, dots or underscores (b.a.d) and digits or symbols used as letters in the message (3 for e, 0 for o, $ for s…).
• Action: message deleted and a warning; the log shows the detected word. On the 3rd warning within 24 hours, a 24-hour timeout.
• Setting: the Forbidden words list on the website, or Add a word / Remove a word in /config.

On every join, the bot checks the new member in this order:

App additions (Anti-App)

• Trigger: any app (bot) added to the server, whoever adds it, the owner included, unless the app is whitelisted with the App additions or Global scope.
• Action: the app is kicked, then a log is posted. If the person who added it is not an administrator, they get a warning and a second log shows who added it.
• Before installing an app, whitelist it: the Whitelist an app button on the website (you can paste the ID of an app that is not on the server yet) or /config → Whitelist → Add.

Mass joins (Anti-Join massif)

• Trigger: the 6th newcomer within 10 seconds (not counting members whitelisted with Joins / recent accounts).
• Action: every member who joined during those 10 seconds and is still there gets a DM, then is kicked. Each new join within the window repeats this. The log lists the kicked members.
• Raid mode does not turn on by itself: if the attack goes on, turn it on yourself.

Recent accounts (Anti-Recent account)

• Trigger: a Discord account created less than 7 days ago (adjustable from 0 to 365 days: Min. age (days) on the website, Configure account creation threshold in /config).
• Action: a warning, a DM (account creation date and the date from which they can come back), then a kick. On the 3rd attempt within that period, the account is banned.
• The log shows the same information.

Captcha (Security Captcha)

The captcha asks every newcomer to copy a code before they can use the server.

• Conditions: anti-raid on, captcha protection on and a Captcha channel (text channel) picked. Otherwise the join goes on as usual. Bots skip the captcha.
• How it goes:
  1. The bot posts in the captcha channel an image with a 6-character code (letters and digits, without I, O, 0 or 1), mentions the member and says they have 3 minutes.
  2. The member types the code in the channel. Each of their messages is deleted right away. Case does not matter, but there must be no extra space.
  3. After a wrong code, the message shows "Incorrect Code" and the number of attempts left.
• Success: the captcha message disappears, a log is posted in the Captcha logs channel, then the member gets the welcome message and the welcome roles.
• Failure (wrong code on the last attempt or 3 minutes elapsed): the member gets a DM, a log is posted, then they are kicked.

These protections watch what staff members do (or a hacked staff account). The bot reads the audit log to find the author: it needs the View Audit Log permission.

Details:

• Channel deletion: only the 3rd deleted channel is recreated, with its name, category, position, permissions, topic and settings, but without its messages. If the bot used it (log channel, welcome channel, channel allowed for links…), the new channel takes over that role.
• Mass ban: bans made with the bot's /ban do not count against the moderator (the bot is the one banning).
• Server changes: the icon, the banner and other settings are not watched. To rename the server yourself, make sure you are whitelisted (see the warning in the Whitelist section).
• Webhooks: with the default threshold, this protection almost never triggers. Webhook edits and deletions count too.

The offender gets a DM and every sanction is posted in the raid logs channel.

Raid mode is an emergency button: while it is on, every newcomer gets a DM, then is kicked. There are no exceptions: whitelisted members, apps and bots are kicked too.

Turning it on and off

The command is detailed in Server management.

On a Community server, the bot also applies Discord's safety actions until raid mode ends: invites are paused and DMs between members are paused. On a server without Community, only the kicks apply.

When raid mode ends

• Raid mode stops on its own at the scheduled time. No message is posted at that moment, and the website page may still show Enabled until you reload it.
• No protection turns raid mode on by itself: it is always a staff decision.

What gets logged

• Turning it on and off is posted in the Raid logs channel, with the emergency mentions.
• Each kick is posted in the Join/leave logs channel ("Automatic Kick - Raid Mode"). This log does not name the kicked member: the join log right above it does.

The whitelist exempts members, apps or roles from some protections. Each entry has a scope: Global (every protection) or a list of specific protections.

• On the website (Security page): add users or roles, pick their scopes, then save at the bottom of the page.
• In /config → Whitelist: add or remove members and apps, always with the Global scope. Roles do not show up there.
• Nothing exempts from raid mode or the captcha.
• A member sanctioned with /timeout, /kick or /ban (or the same action from the website) is removed from the whitelist.
• Additions and removals made in /config are noted in the Server logs channel.

Emergency mentions alert your staff as soon as an important log is posted: the bot adds mentions at the bottom of the log, which send a real notification.

Logs concerned: everything posted in the Raid logs channel and the Sanction logs channel, plus, in the Server logs channel, the logs of a deleted channel, a deleted role and a server change.

By default, alerts are on with no recipient: the owner is then mentioned on every log concerned, even for a simple link warning.

Everything is set on the Basic configuration page of the website (see Server home):

• The DM copy needs the Basic or Ultimate plan (see Premium plans and limits). Without it, your choice stays saved and comes back with the plan.
• Each person gets at most one DM every 30 seconds per server: during an attack, not every following log is copied.

On every join, the bot checks whether the account is reported on DangerCord (a report database shared between servers) or on the Dispatch.IO blacklist. This check runs even when the anti-raid is off.

If the account is reported, an alert is posted in the Join/leave logs channel: the member, the services reporting them, the reason (for the Dispatch.IO blacklist) and a warning. The emergency mentions are added and send a notification.

• The bot does not sanction the member by itself: your staff decides.
• The Ban this user button bans the account, even if it has already left the server. It needs the Ban Members permission (or an ADMIN or MODO staff role). The ban is noted in the Sanction logs channel.

These channels must be text channels: announcement channels receive nothing. With no channel picked, the log is simply not posted. More in Logs.

• Texts do not follow the thresholds: the bot's messages quote fixed numbers ("5 messages sent in less than 5 seconds", "3 links within one minute"…), even if the Dispatch.IO team changes a threshold.
• Apps added by staff: Anti-App also kicks apps added by the owner or an administrator. Whitelist the app before adding it.
• Deleted channels: while the protection is on, the first two deletions by a non-whitelisted member do not show up in the Server logs channel.
• Losing the Administrator permission: the anti-raid turns itself off. Give the permission back to the bot, then turn the anti-raid on again.
• /infractions: warnings for recent accounts and app additions show a technical text (antiRaid.recent_account.infraction.reason) instead of a sentence.
• Thresholds set at bot level: only the minimum account age is set per server; for everything else, use the whitelist to relax a protection.

• Bot configuration: every option of /config → Antiraid and Whitelist.
• Security and anti-raid: the Anti-Raid and Security pages of the website.
• Server management: the /raid-mode command.
• Moderation: /infractions and manual sanctions.
• Permissions and roles: bot permissions and ADMIN and MODO staff roles.
• Logs: every log channel.