Raid Protection

A raid is a wave of joins in a short space of time — usually freshly created throwaway accounts that spam the server straight afterwards. By the time somebody on the team wakes up and reacts, ten minutes have gone by and the damage is done.

The raid protection reacts within seconds.

The actual problem

It is not the detecting. It is the telling apart: a successful post on Reddit looks exactly like a raid in the numbers — thirty joins in one minute.

Hence two principles:

The protection does not act harshly on suspicion. By default it raises the verification level. That does not affect anybody permanently and is undone within seconds. Throwing accounts out is a decision you have to take deliberately.

It opens up again on its own. Protection that keeps the doors shut until the next look at the dashboard costs genuine members — and nobody notices.

Setting it up

/raidschutz setup

Three things to decide:

• Schwelle (threshold) — how many joins within which time window count as a wave. Default: 10 in 60 seconds. Better to start high. Protection that is too sensitive shuts the doors with every advertising campaign, and after the third false alarm somebody switches it off.
• Mindestalter der Konten (minimum account age) — during a raid, younger ones are turned away. 7 days is a good default; throwaway accounts are almost always brand new.
• Meldekanal (reporting channel) — without it nobody finds out that the protection has kicked in. It is mandatory.

The measures

Setting	What happens
Verifizierung hochsetzen	New members need a confirmed phone number. Affects everyone, but is gentle.
Zu junge Konten abweisen	Only new accounts that are too young are thrown out. Targeted, but hits hard.
Beides	Belt and braces
Nur melden	The bot touches nothing and only alerts you

By hand

/raidschutz an
/raidschutz aus
/raidschutz status

an is for the case where you notice the wave before the bot does — for example because it comes slowly enough to stay below the threshold. status shows the settings and how often the protection has kicked in so far.

Opening up again

The clock runs from the last join, not from the trigger. As long as the wave carries on, things stay shut. Only once it has been quiet for the configured length of time does the bot restore the old verification level — exactly the one that applied before.

With 0 you switch that off; then only /raidschutz aus opens up.

Permissions

Server verwalten (manage server) for the verification level, Mitglieder kicken (kick members) for turning accounts away. If one of them is missing, /raidschutz status tells you.