When the trap fires: ban, softban, timeout or escalate
What stingsby does to an account caught in the honeypot: ban, softban, timeout or escalating strikes, the DM, the clean-up, the report and how to undo a ban.
The accounts stingsby catches are usually real members whose accounts were hacked. Choose what happens to them in /config:
| Action | What happens | Getting back in |
|---|---|---|
| Ban (default) | Permanent ban. Discord deletes their last delete_hours of messages | Staff press 🔓 Unban on the report, then send a new invite |
| Softban | Banned and unbanned straight away: the messages are deleted and they're removed from the server, but not banned | They rejoin with any invite link, no staff needed |
| Timeout | Muted for timeout_days (1–28). Stingsby deletes their messages from the last delete_hours itself, checking the newest 200 messages of each channel | Staff press 🔊 Remove timeout on the report, or it ends by itself. Needs Timeout Members |
| Escalating | A harsher step each time the same account is caught (a strike): 1st → timeout for 1 day, 2nd → timeout for 7 days, 3rd → softban, 4th and later → permanent ban | Depends on the step, as above |
Escalating, in detail
- Strikes reset after 90 days without being caught (configurable in ⏱️ Durations), so someone hacked again much later starts from the first step.
- A burst of spam counts as one strike, and a timed-out account can't post, so strikes can't pile up in seconds.
- The DM and the report show which strike it was and what happens next time. That's a strong nudge to secure the account.
- 🔓 Unban and 🔊 Remove timeout undo the punishment but keep the strike. 🕊️ Forgive on the report clears the user's strikes.
- Without Timeout Members, the timeout steps become softbans, and
/security scanwarns about it. - A timed-out member can't post but stays in the server and can still DM members. If that worries you, choose Softban.
New accounts: whatever the action, an account younger than the 🆕 New accounts setting (default 1 day) is banned straight away, without strikes. These are almost always throwaway spam accounts, not hacked members. The report and the DM say why.
- DM to the account: just before the action, stingsby messages the user: which server it was, what happened and why, how to secure their account (change the password, turn on 2FA, remove unknown authorized apps), and how to get back in afterwards. It has to come first, because Discord blocks DMs once the user shares no server with the bot. If their DMs are closed, the action goes ahead anyway.
- The action, with the reason “stingsby: posted in the honeypot channel (likely compromised account)”. It shows in your Audit Log.
- Clean-up: everything the user posted in the last
delete_hoursis deleted, in every channel. - Event log: a ban, softban or timeout event is saved with the user's name, ID and the message that triggered it.
- Report in the log channel: avatar, username and ID, account age, join date, how much history was deleted, the trigger message, and a button to undo it: 🔓 Unban after a ban, 🔊 Remove timeout after a timeout (a softban needs none). A brand-new account is a red flag; an old one usually means a real member's account was compromised.
- Cool-down: for 30 seconds, more messages from the same user are ignored, so a burst of spam doesn't cause repeated bans.
If the action fails (missing permission, or the user's role is above the bot's), stingsby deletes the trigger message, logs a failure and posts an orange “ban FAILED” or “timeout FAILED” report so staff can act by hand. If a softban's unban step fails, the account stays banned and the report says so, with an Unban button.
Undoing a ban: press 🔓 Unban on the ban report. It needs Ban Members, turns grey with the name of whoever used it, and is recorded in the event log. It keeps working on older reports after the bot restarts. You can also use Server Settings → Bans → select the user → Revoke Ban. Either way, the person needs a new invite link to rejoin, and deleted messages can't be restored.