I've seen it all around Discord — you probably have too — honeypot channels.
They look something like this:
Sometimes they have random channel names, but the function is the same: when a user posts a message there, action them with a kick, ban, timeout, etc., and delete the user's messages [in the past X mins].
This is — really good on paper. It's a simple solution for a massive Discord scam/spam problem — but how long will it continue to be effective?
The problem with honeypots
In my mind, I see a few ways the developers of these scam/spam tools could easily set up an indicator to detect these types of channels. A few things to look for could be:
- Channel named "honeypot"
- Able to send messages in a channel, but only has one message in it, and that message often contains words like "ban," "kick," and so on
- Channel at the very top of the channel list
That's just a few easy, possible indicators — but once the developers of these tools figure it out, the honeypot strategy is rendered useless.
Pixie's approach
I have thought this way for a long time, and when developing Pixie's automated moderation tools, this was a topic I dedicated a lot of time to brainstorming.
What I came up with is simply detecting common indicators across different types of scams.
Example here being the Mr. Beast scam. Always 4 images, sent across channels rapidly. In Pixie, alerts show up like this:
Another example being just common hacked-account spam, or dedicated spam accounts. I don't know what the main goal of these is — but I suspect a pig butchering scam.
These scams follow the same pattern: posting the exact same message content in multiple channels rapidly, with a ping.
And my final example is unique: these types of "scams" aren't usually bot-operated, but instead there is a real person behind the accounts in most cases. Meaning this type of "bot" has a brain, and wouldn't fall for a honeypot channel.
These are CSAM sellers. Not scams, just people that intend to direct users off-platform to sell illicit content.
Pixie uses a scoring system to determine whether a message is a CSAM seller advertisement, and does not look for an indicator of rapid cross-posting — because in most cases they are posted in a single general chat.
Help us stay ahead of it
This is Pixie's approach to the scam epidemic. Resources and reports about emerging scams are always appreciated. You can contact us here.
LOVE U
