Notices a trusted account that suddenly posts the same scam everywhere.
A hijacked account posts the same scam into many channels within seconds. Defendr recognises the repetition instead of the wording: when the same message, link or picture appears in several channels inside the burst window, every copy is removed, the member is timed out and receives a recovery guide by DM, and one case records what happened.
Three copies of the same link in three channels within 60 seconds are removed together.
A honeypot is a channel nobody should post in. Everyone can see and write there, a pinned warning says what happens, and any message by a member who is not a moderator is treated as spam. Automated accounts that post everywhere reveal themselves there first.
A bot posts in the trap channel, the message is removed and the account is timed out.
A member whose account was contained receives one direct message: change the password, turn on two-factor authentication, review Authorized Apps and devices, never scan a QR login code, and how to appeal. It is sent at most once per member per day and never repeats the message that was removed.
A member contained twice in one afternoon receives the guide once.
Roles, channels and members listed here are not checked for bursts. The trap channel is never exempt: it stays a trap for everyone. A member with a bypass permission is still checked, but the response is limited to removing the message and alerting the team, so a hijacked admin account is still contained.
An announcement bot role is exempt, the trap channel still catches it.
Every action posts a card like this in your log channel.
in #defendr-logs
Each one starts with a sensible value. You can change them in the dashboard or in Defendr's setup in Discord.