Protection
Three detectors run independently on messages. Each has its own enable switch, its own punishment action and its own duration, so you can delete quietly in one category and ban outright in another.
Punishment actions
Every protection module offers the same ladder, and all of them run through the same engine the manual commands use so the log entry and the member's DM look identical whether a human or a filter acted.
| Action | Effect |
|---|---|
delete_only | Removes the message. No punishment, no DM. |
warn | Removes the message and records a warning. |
timeout | Removes the message and times the member out for the configured duration. |
kick | Removes the message and kicks the member. |
ban | Removes the message and bans the member. |
Timeout durations are set in hours, up to 696. Discord itself caps a timeout at 28 days.
Link Protection
Links are extracted from every message and checked against a database built from ten public threat-intelligence feeds, refreshed every 24 hours. The feeds are split into six categories you enable separately:
- Phishing — credential and account-theft pages, including Discord-specific ones.
- Malware — links serving malicious files.
- IP loggers — services whose only purpose is capturing a visitor's address.
- Gambling — betting and casino sites.
- NSFW — adult sites.
- Scams — fraud and fake-giveaway links.
What actually gets blocked
A feed either names a whole domain or one specific link, and Graffiti blocks exactly what it was given. A flagged domain blocks every link on it. A flagged link blocks that link and anything under it — so a single bad repository, file or paste is blocked without taking the platform hosting it with it.
Two lists shape that. The whitelist guarantees a domain is never flagged at all. The shared-host list covers multi-tenant platforms — code hosts, file hosts, pastes, link shorteners — which are only ever blocked one link at a time, never as a whole site. If a link is falsely flagged, report it in our support server.
Enable the categories that match your server's rules, not all six by reflex. Gambling and NSFW are policy filters, not threat filters, and switching them on in a server that permits those links only creates noise.
Image Protection
Images are compared by perceptual hash, not by file. A hash describes what the picture looks like, so a scam image that has been screenshotted, resized, recompressed or lightly cropped still matches the original.
- Match confidence — how close a match has to be, from 50% to 100%. Lower catches more variants and risks false positives; higher is stricter. Start near the default and adjust if you see either problem.
- Global database — opt in to a shared, curated list of images reported across servers, on top of your own.
Add an image to your server's own list with
/threat_image add, and remove one with
/threat_image remove.
Cross-channel spam
A compromised account usually posts the same thing everywhere at once. Graffiti fingerprints each message its text plus any attachment sizes and counts how many distinct channels that fingerprint appears in inside a time window.
- Channel threshold — how many channels before it counts as a raid. Between 2 and 20.
- Time window — how long the fingerprint is remembered, from 5 seconds to 1 hour.
Once triggered, every copy is removed and the account is dealt with once, not once per channel.
What gets logged
Every automatic action writes to your mod log channel with the rule that fired, the message content or image involved, and whether the member's DM was delivered. If no log channel is set, actions still happen you just cannot review them afterwards, so set one.