Setup the bot

The bot requires the following permissions to function:

• View Channels - Scam Hunter needs to be able to see channels to manage messages in them.
• Send Messages - required when Scam Hunter needs to warn a user that their actions may get them removed if they don't stop.
• Send Messages in Threads - required when Scam Hunter needs to warn a user that their actions may get them removed if they don't stop.
• Manage Messages - the bot needs to be able to remove malicious messages.
• Embed Links - used by the bot to log actions taken in a clean format.
• Read Message History - required to clean up malicious messages sent in the past once a user is deemed malicious.
• Bypass Slowmode - used by the bot to warn users regardless of rate limiting.

The bot also needs at least one of the following permissions (depending on what action you intend the bot to take for malicious users):

• Kick Members - used when "Kick" is the behavior you set for the server (this is the default behavior).
• Ban Members - used when either "Kick" or "Ban" is the behavior you set for the server. Note that if the bot should kick users, if it has the Ban Members permissions, the bot will soft ban (ban then immediately unban) the user from the server.
• Moderate Members - used when "Timeout" is the behavior you set for the server.

A best practice when adding a bot is to create a dedicated "BOT" role with no extra permissions, move that above all roles that regular users can get, and assign that role to the bot.

A common misconception is that permissions only work if the role with those permissions are high up in the hierarchy, so many server owners will add a bot, then move that bot's auto-created role above other user roles.

The problem with this approach is if you ever re-invite the bot (when debugging an issue or wanting to easily add new permissions the bot requires), Discord will move that bot's role back to the bottom of the list. So long as you remember to move the role up again, then there's no problem.

A simpler solution is to add a permissionless "BOT" role to the bot and move that role up instead. The bot's permissions are additive across all roles, and which users the bot can manage is only dictated by how high up their highest role is (regardless of that role's actual permissions).

tldr - my advice is:

• Create a dedicated permissionless "BOT" role.
• Move that role above regular user roles.
• Give that "BOT" role to your bots.

I highly recommend you make a private (or public, up to you) channel where the bot can log any actions it takes. This can help you with debugging if the bot flagged a false positive or help diagnose missed scams.

The command to designate a channel that the bot can use to log it's findings is: /log to:CHANNEL

Scam Hunter runs a series of rulesets and logic, each tuned to handle different scenarios. By default, all rules are enabled, with "kick" being the action the bot will take.

You can customize which rules are enabled in one of two ways:

• Via logging into this site, visiting the dashboard, selecting your server, and adjusting the bot behaviors at the bottom of the page.
• Via the /behaviors [...options] command

The behaviors the bot supports and what they do are as follows:

• Nitro/Steam Spam - removes "free nitro" and "free steam" messages that point a user to a link that is not Discord or Steam
• Malicious redirects - removes messages that contain website links that are pretending to be Discord or Steam. This rule is not always effective if the malicious site has inspection prevention.
• Image Spam - removes image spam when spammed across channels such as the Mr Beast crypto scams.
• Link Spam - removes link spam when spammed across channels.
• Text Spam - removes large text spam across channels using similarity detection, so even if the message changes slightly, the bot can still identify it and remove it.
• Profile Spam - removes the "check my bio" style spam. Also uses similarity detection.
• Removal Action - whether the bot should kick, ban, or timeout a user that has been flagged as malicious.

Keep in mind: Scam Hunter is designed to scope all actions it takes against a given user to that server. This is so the bot cannot be abused to harass a user across multiple servers.

I have seen users recover their accounts often enough that I generally recommend "kick" as the action the bot should take. If your server is one of the unlucky few were botted users are re-joining post kick and continuing their malicious behavior, you may want to change the bot's removal action to ban or timeout.

Self hosting is an option if you'd like more fine-grained control. See the GitHub repo for more detailed instructions on how to run a copy of the bot on your own hardware.

If you run into any issues, need help, or want to provide feedback on what is working and what is not, please join the support server. We'd love to hear from you!