Public phishing lists
Known scam domains from open, MIT-licensed lists, refreshed every 6 hours. A listed domain also matches all of its subdomains.
Discord anti-phishing bot that deletes scam links before anyone clicks
Fake gifts, fake login pages and fake “staff” messages are how accounts get stolen — and a stolen account then posts the same link everywhere. BotGG checks every link against phishing databases, deletes the message and deals with the sender, while treating hacked regulars more gently than throwaway scammers.
automod-logDiscord preview
hey everyone, check this out 👀 ‹link removed by BotGG›
What you get
Look-alike detector
Catches imitations of discord.com and steamcommunity.com — one or two letters off, 0 for o, rn for m, or the same name on another domain ending.
Fair to hacked members
A member who has been in the server for a while is probably compromised, not a scammer: they get a timeout instead of a kick or ban.
Scam names too
Usernames, display names and nicknames are checked on join and whenever they change — alert, time out, kick or ban.
Your own lists
Add domains to your blocklist or allowlist: 20 entries on Free, 500 on Pro.
Test a URL
Paste a link in the console to see whether it would be blocked and why — before a member ever posts it.
How it works
Turn on phishing protection
In the BotGG console open Moderation → Protection → Phishing and switch it on. The phishing database is free for every server.
Pick the actions
Choose what happens after a known phishing link is deleted (nothing, timeout, kick or ban), how to treat suspected look-alikes, and the action for scam member names.
Add your lists and exemptions
Block extra domains, allow your own sites, exempt staff and chosen roles, and pick a log channel — by default the AutoMod log, else the mod log.
Watch the log
Each hit is posted as an embed with the domain, why it matched and what BotGG did; a timeout, kick or ban also gets a numbered moderation case.
Where BotGG looks for scam links
Links are taken from the message text, embeds (titles, descriptions, fields, author and footer) and attachment URLs — including masked links, bare domains without https://, “defanged” hxxp links and links hidden with zero-width characters. Edited messages are checked again, so adding a link later doesn’t slip through.
Your allowlist is checked first, then your blocklist, then the public lists, then the look-alike detector. Official Discord and Steam domains and well-known Discord sites are never flagged, and popular sites like YouTube or GitHub can’t be blocked by a broken upstream list.
- Known phishing → the message is deleted and your chosen action applies.
- Suspected (look-alikes and the “suspicious” list) → off, alert only, or delete and alert — never a punishment.
- A domain added to a public list less than 24 hours ago gets a timeout at most, in case the listing is wrong.
- One action per member per 15 seconds: messages keep being deleted, the log stays readable.
What it needs and what it doesn’t do
Reading ordinary messages requires Discord’s Message Content intent. Without it, BotGG still scans member names and messages that mention the bot, and the console shows a banner explaining the gap.
BotGG doesn’t DM the sender — a scam bot doesn’t need to know it was caught. Downloading the public lists sends nothing about your server or members. Phishing protection is part of Moderation; hits also show up in your server logs, and our automod setup guide covers the link and invite filters that complement it.
Slash commands
Generated from the bot’s real command definitions. Full list on the commands page.
/banuserreason?delete_messages?duration?evidence?Ban a user — add a duration for a temporary ban/caseView, edit or delete a moderation case3 subcommands
/case viewnumberShow a case/case editnumberreasonevidence?Change a case's reason (and add evidence links)/case deletenumberDelete a case
/kickmemberreason?evidence?Kick a member from the server/lockchannel?reason?Lock a channel: members can no longer send messages/lockdownLock the whole server down during a raid2 subcommands
/lockdown startreason?duration?Start a lockdown now/lockdown endEnd the lockdown and restore the channels
/modlogmemberA member's moderation history/notemembertextAdd a private moderator note to a member/panicPanic button: lock the whole server right now2 subcommands
/panic startquarantine?Lock every channel, pause invites and optionally quarantine a member/panic endEnd the panic: unlock channels and resume invites
/purgecountuser?contains?bots?reason?Bulk-delete recent messages in this channel/slowmodedurationchannel?Set or turn off slowmode in a channel/softbanmemberreason?delete_messages?Ban and immediately unban to wipe a member's recent messages/timeoutmemberdurationreason?evidence?Time out a member for a while (e.g. 10m, 2h, 1d)/unbanuser_idreason?Unban a user/unlockchannel?reason?Unlock a locked channel/untimeoutmemberreason?Remove a member's timeout/warnmemberreason?evidence?Warn a member (counts toward automatic escalation)Frequently asked questions
How do I stop scam links on my Discord server?
Turn on phishing protection in BotGG, keep the action on ban for throwaway accounts and let long-time members get a timeout instead. Add the AutoMod link and invite filters for anything that isn’t phishing, and remind members that Discord never hands out gifts through random links.
Is the phishing link filter free?
Yes. The phishing database, the look-alike detector, name scanning and the log are free for every server. Only the size of your own block and allow lists depends on the plan: 20 entries on Free, 500 on Pro.
Why did a member get a timeout instead of a ban?
Members who have been in the server for at least the number of days you set (30 by default) are treated as likely compromised: they lose the message and get a timeout so they can recover their account, instead of being banned.
Which phishing lists does BotGG use?
The open Discord phishing and suspicious link lists by nikolaischunk on GitHub (MIT licence), mirrored every 6 hours. The log tells you which list or rule matched each link.
What if a safe site gets blocked?
Add it to your allowlist — it is checked before everything else. You can test any URL in the console first to see exactly which rule would match.
Does it work without the Message Content intent?
Partly. Without it Discord sends BotGG no text for ordinary messages, so only member names and messages that mention BotGG can be scanned. With it, every message and edit is checked.
Ready to level up your server?
Add BotGG for free, then switch features on in the web console.