Honeypot

Requires the HONEYPOT feature.

A honeypot is a channel no human should post in - hidden at the bottom of the list, named accordingly, with a pinned warning if you like. Compromised accounts and spam bots mass-post into every channel they can see; the moment one posts in a trap channel, HepBoat actions it automatically and cleans up the mess.

plugins:
  honeypot:
    enabled: true
    exempt_roles: [411175551308398592]   # extra roles to exempt
    action_bots: true
    channels:
      665875009507426304:
        action: ban              # kick / softban / ban
        delete_message_days: 1   # on a ban, also purge the offender's recent messages
        log_channel: 665875009507426305
        notice: true             # sticky warning embed with a running counter

Setting one up well

1. Create a channel everyone can see and post in, but that reads as obviously off-limits (#do-not-post-here).
2. Add it under channels, exempt your staff roles, enable the plugin.
3. The trigger, the action, and the cleanup all land in your mod log like any other moderation event; set a log_channel if you also want a dedicated notification with the captured message.

Setup → Honeypot configures the same thing with channel pickers.

Undoing a false positive

Sometimes the "scambot" is just a member who did not read the room. When a trap bans someone, the log_channel notification carries an Unban button: one click lifts the ban, records a normal unban infraction under the clicking moderator's name, and edits the notification to show who reversed it. Only moderators can use it, it keeps working after bot restarts, and pressing it twice is harmless - if the ban was already lifted (by unban, an appeal, or a manual unban), it simply says so.

Moderators and above never trip a honeypot, and neither does the bot itself - exempt_roles is for the extra roles you want to add on top of that.

Webhook posts are always actioned, whatever action_bots says, and they are handled by deleting the webhook rather than by punishing an account. The sticky notice's counter follows the action you configured, so it reads Bans, Kicks, or Softbans rather than always Bans.