Documentation

Protection

Link threat intelligence, the malicious image database and cross-channel spam detection, and how to tune them.

Three detectors run on every message, before anything else in Graffiti looks at it. When one fires, the message is removed first and the punishment applied straight after; the mod-log entry, the member's DM and the record follow in the background, so a slow log channel never delays a removal. Each detector has its own response:

A member who trips the same detector several times within a few seconds is punished once, not once per message.

Link protection

Graffiti keeps one database of known-bad links, pulled every day from public threat-intelligence feeds. Every link in a message, and in a message edited to add one, is checked against it. Links fall into six categories, each with its own switch and response:

• Phishing — fake login and "free Nitro" pages.
• Malware — downloads and pages that infect devices.
• Scams — fraud that isn't strictly phishing.
• IP loggers — links that record whoever opens them.
• Gambling and adult sites — off by default like the rest; switch them on if your server wants them gone.

A link several feeds disagree about is filed under every category they give it, and Graffiti acts on the most severe one you have switched on — so a domain listed as both malware and phishing is caught whichever of the two you enable.

Some links point at one file on a big platform, like a single repository on a code-hosting site. Those are blocked one link at a time, so the rest of the platform keeps working. Well-known sites are on an allowlist and never flagged. Entries that no feed has listed for 30 days expire, so a domain that changes hands doesn't stay blocked forever.

Image protection

Add a known scam image to your server's image database from the Image protection page, and Graffiti catches it whenever it's posted again — including resized, recompressed or slightly cropped copies. Each image is fingerprinted twice:

• an exact fingerprint (SHA-256), which identifies a byte-for-byte copy without even opening the image;
• a perceptual fingerprint, which matches images that look the same. Match confidence sets how close is close enough: 100% means near-identical; the default of 88% catches re-encoded copies without false matches on similar-looking images.

Switch on Use Graffiti's shared database to also check images Graffiti's team has flagged across Discord. Every image in your database has a page showing who added it, when and why, and its full history. You can rename it, disable it without losing it, or delete it.

In Discord, staff with Manage Messages can use /threat_image add and /threat_image remove to manage the same database without leaving the conversation.

Anti-spam

Compromised accounts and raids paste the same thing into channel after channel. When a member posts the same text, or the same attachments, in more channels than you allow inside your time window, every copy is removed and the member is dealt with once. The defaults are 3 channels within 120 seconds.