Block scam links

[marko-radosavljevic]

Is your feature request related to a problem? Please describe.

There is too much scam links (nitro, steam, etc) posted on the discord, and it's taking a lot of moderation time, while annoying and harassing the whole server. Sadly, people still fall for these phishing attempts, so it's also a security issue we should address.

Describe the solution you'd like

Block the scam links with our bot, and possibly temporarily remove offending members. (if false-positives are rare enough)

Describe alternatives you've considered

To waste time indefinitely until discord does something about it.

Additional context

Phishing link can look like this (list will be edited):

https://disceord.gift/EF2Zx27xxxx

On the same IP, these domains can be found:

• dlscors.gift
• dlscorb.gift
• disczrd.gift
• discorcl-nitro-gift.com
• discoerd.gift
• discerd.gift
• disceord.gift
• disccord.gift

How it looks in chat:

Text phrases usually found in link previews:

You've been gifted a subscription!
Discord has gifted you Nitro for 1 month

I can host a full website example, or just html page if needed.

[Zabuzard]

Nitro scam from the last 6 months.

DO NOT CLICK ANY OF THESE LINKS!

(they will steal your discord account)

🤩bro steam gived nitro - https://nitro-ds.online/LfgUfMzqYw

@​everyone, Free subscription for 3 months DISCORD NITRO - https://e-giftpremium.com/

@​everyone
Discord Nitro distribution from STEAM.
Get 3 month of Discord Nitro. Offer ends January 28, 2022 at 11am EDT. Customize your profile, share your screen in HD, update your emoji and more!
https://dlscrod-game.ru/promotion

@​everyone
Gifts for the new year, nitro for 3 months: https://discofdapp.com/newyears

@​everyone yo , I got some nitro left over here https://steelsseriesnitros.com/billing/promotions/vh98rpaEJZnha5x37agpmOz2

@​everyone
:video_game: • Get Discord Nitro for Free from Steam Store
Free 3 months Discord Nitro
:clock630: • Personalize your profile, screen share in HD, upgrade your emojis, and more.
:gem: • Click to get Nitro: https://discoord-nittro.com/welcome
:Works only with prime go or rust or pubg

@​everyone, Check this lol, there nitro is handed out for free, take it until everything is sorted out https://dicsord-present.ru/airdrop

@​everyone
• Get Discord Nitro for Free from Steam Store
Free 3 months Discord Nitro
• The offer is valid until at 6:00PM on November 30, 2021. Personalize your profile, screen share in HD, upgrade your emojis, and more.
• Click to get Nitro: https://dliscord.shop/welcome

airdrop discord nitro by steam, take it https://bit.ly/30RzoKw

Steam is giving away free discord nitro, have time to pick up at my link https://bit.ly/3nlzmUi before the action is over.

@​everyone, take nitro faster, it's already running out
https://discordu.gift/u1CHEX2sjpDuR3T6

[Zabuzard]

Patterns I see are:

• @everyone (8 of 11)
• keywords nitro (11 of 11), discord (7 of 11), steam (6 of 11), free (5 of 11)
• a link whose host is similar to discord (6 of 11)

[Tais993]

Owh my gosh, thanks for the Nitro @Zabuzard! I can't login into my account anymore though?

1 idea of the implementation.

Our bot deletes the message, mutes the author, and sends the content in a mod-log channel.
This message contains a ban + unmute button, this way we can never really ban the wrong person.

After banning/muting we can just disable the buttons so everyone knows it's already been handled.

This makes it nearly impossible, even when our bot fails, to ban the wrong people.

[Zabuzard]

Good idea.

I am still hoping to fix this proper with either Discord help or an actual proper scam-blocker-bot.

But a low hanging fruit seems to be to build some simple detection out of the above pattern and call it a day.

In particular a combination of an @everyone, nitro and a url is a dead giveaway and already covers 72% of the scam.
And nitro with a url that is bit.ly, contains text similar to discord, nitro, premium (but is not discord.com) covers the rest.

[marko-radosavljevic]

Yup, I agree on the flow Tais993 discussed. The bot should handle it, post in audit log, and then we can monitor it and revert the action quickly, if needed.

Nitro scam from the last 6 months.

All the links I clicked are no longer valid. You can't even get scammed properly these days. :(

Another probable pattern that is very consistent and predictable is phishing HTML they use. It's basically the same discord page with login, and there are characteristic elements like logo, login fields, text about nitro gifts, styling… etc.

If we analysed a few of them, I'm sure we would find at least 5 elements that are identical, that we can use as a fingerprint. Curl the domain, check the raw HTML of the page, grep/jsoup fingerprint and base evaluation on that.

[Zabuzard]

Another probable pattern that is very consistent and predictable is phishing HTML they use.

Do you actually have to enter data first? I thought it steals the session directly, i.e. just clicking it is already too much.

If thats the case, it will be hard for us to analyze the websites 😆

[marko-radosavljevic]

Another probable pattern that is very consistent and predictable is phishing HTML they use.
Do you actually have to enter data first? I thought it steals the session directly, i.e. just clicking it is already too much.

If thats the case, it will be hard for us to analyze the websites laughing

I can do it safely, just find me a few recent links that are alive. ^^

I have the last one saved, can share the HTML, or host the whole website for analysis.

[marko-radosavljevic]

Full html of the last scam, unsanitized. (no js or css)

discord-nitro-scam-phishing-website-default-theme-2 (copy).txt

Images that go with it: (click)

How it looks with css: (click)

[Tais993]

Another probable pattern that is very consistent and predictable is phishing HTML they use.

Do you actually have to enter data first? I thought it steals the session directly, i.e. just clicking it is already too much.

If thats the case, it will be hard for us to analyze the websites 😆

It can't, session is stored in the app / your browser.
And a website can't access your PC like that, that'd be an extreme danger, and would mean that every site can hack you.

there's 2 types of scams;

Nitro scams, you've to login on a website, they gain FULL access to your account, can't change account details.
App scams, you need to "try" their "game", gains them access to the token / session, can't change account details

[marko-radosavljevic]

I can write an HTML analyser/fingerprinter later on. I just need a few more scam links to establish a pattern, since this is the only data I have for now. ☺️