Protection
Anti-Raid
About this feature: Anti-Raid
In short
If 10 accounts join within 30 seconds, Bastion calls it a raid. For the next 10 minutes it pauses invites and kicks joining accounts that are less than 7 days old. A group of accounts made on the same day counts as a raid too, even if they trickle in. It's on by default.
What a raid is
A raid is many accounts joining at once to spam or harass. Raids are normally run with scripts and throwaway accounts. The accounts tend to join within seconds of each other and are almost always brand new.
Those two facts are how Bastion spots one: lots of joins, very close together, from young accounts.
Turn it on
It's already on. To change it, open Anti-Raid in the dashboard. The switch on the overview card turns it on or off. Only the server owner and trusted people can change Anti-Raid.
What happens
Bastion counts joins
It keeps a running count of how many accounts joined in the last 30 seconds. Bots aren't counted.
The count hits the limit
At 10 joins, Bastion calls it a raid. You get an alert in your security log channel.
Invites are paused
Nobody new can join while invites are paused, which cuts the raid off at the source.
Raid accounts are removed
New accounts that are part of the flood are kicked, including the ones that set it off. Older accounts are left alone. Each removal is saved as a case.
It ends on its own
After 10 minutes Bastion stands down and posts a second message to say the raid is over.
Settings
| Setting | What it does | Default |
|---|---|---|
| This many people joining | How many joins count as a raid. 3 to 200. | 10 |
| Within | How close together those joins must be. 5 to 600 seconds. | 30 seconds |
| During a raid | What happens to raid accounts: just tell me, time them out, kick or ban. | Kick |
| Only remove accounts newer than | Only act on accounts newer than this. 0 to 365 days. 0 removes everyone who joins. Under Advanced settings. | 7 days |
| Stay on alert for | How long Bastion stays on alert. 1 to 240 minutes. Under Advanced settings. | 10 minutes |
| Pause invites | Nobody can join until the raid is over. | On |
| Spot accounts made in one batch | Treats a group of accounts created within a day of each other as a raid, however slowly they join. Under Advanced settings. | On |
| Batch size that counts | How many such accounts make a batch. 3 to 50. Under Advanced settings. | 4 accounts |
| During a raid, also remove accounts with no picture | While a raid is active, accounts with no profile picture are acted on too, whatever their age. Under Advanced settings. | Off |
The four actions
- Just tell me. Post an alert and take no action.
- Time the raid accounts out. They stay in the server but can't talk for an hour. Good if you'd rather look at them before removing anyone.
- Kick the raid accounts. They can rejoin later if they were real. This is the default.
- Ban the raid accounts. They can't come back.
Accounts made in one batch
Raid accounts are usually created together, a few minutes apart, days before the raid. A patient attacker then sends them in one every few minutes to stay under the join limit.
Spot accounts made in one batch catches that. Bastion remembers who joined in the last 3 hours. If 4 of those accounts were created within 24 hours of each other, it calls a raid, even though they never joined fast.
- The alert says how many accounts made within a day of each other joined in the last 3 hours.
- The accounts in the batch are acted on, including the ones already inside.
- While the raid lasts, any account from the same batch that joins is acted on too, even if it's older than your age setting.
- Raise Batch size that counts if your server is new and lots of real people with fresh accounts join.
With During a raid, also remove accounts with no picture on, an account with the default picture that joins during a raid is treated as a raid account even if it's old. Leave it off unless raids keep getting through with aged accounts.
How the levels differ
| Setting | Relaxed | Balanced | Strict |
|---|---|---|---|
| Joins that count as a raid | 20 in 30 seconds | 10 in 30 seconds | 6 in 20 seconds |
| During a raid | Just tell me | Kick | Ban |
| Only remove accounts newer than | 7 days | 7 days | 30 days |
Before an event
A shout-out from a big creator looks a lot like a raid: many people joining at once. Real fans mostly have older accounts, so the 7 day rule protects them. If you still expect a surge:
- Raise This many people joining to a number above what you expect, or
- Set During a raid to Just tell me for the day.
TipKick is safer than ban here. A real person caught up in a raid can join again later.
What works well with it
- Join Gate turns away throwaway accounts one at a time, before they add up to a raid.
- Verification stops automated accounts from reaching your channels at all.
- Automod times out any raiders who get in and start spamming.
- Lockdown lets you close the server by hand with
/lockdown joinsor/lockdown start.
People say my invite link stopped working.
A raid was detected and invites are paused. Check your log channel. They come back when the raid ends.
My friends were kicked during a raid.
Their accounts were younger than the age setting and they joined while the raid was active. They can rejoin once it's over.
The raid was slow and Bastion missed it.
Check Spot accounts made in one batch is on. It catches slow raids from accounts created together. If the accounts were made on different days, lower This many people joining or raise Within. The Strict level uses 6 joins in 20 seconds.
It called a raid and only four people had joined.
Four accounts created within a day of each other joined in the last 3 hours. That's the batch check. Raise Batch size that counts, or switch Spot accounts made in one batch off.
Anti-Raid isn't doing anything.
Check Anti-Raid is on and that During a raid isn't set to Just tell me. Bastion also needs Kick Members, Ban Members, Timeout Members and Manage Server. Run /status to check.
Does it undo what raiders posted?
No. Use /purge to clear messages. See the command list.
Last updated