Guide · 8 minutes

How to stop spam bots and hacked accounts on Discord

It is 3 a.m. A member who has been on your server for two years posts a screenshot of a "withdrawal success" on a crypto casino — in every channel, one after the other. Their account was stolen, and by the time a moderator wakes up, a few hundred people have seen it. Here is how to catch that account on its first message with a honeypot channel, remove the scam pictures it posts everywhere else, and set it all up in SUPREO in a few minutes.

Why spam keeps getting through

Spam on Discord has changed, and the usual defences were built for the old kind:

The accounts are real. Most spam comes from hacked accounts of real members, not from fresh bots. They passed your verification months ago and have roles. Account age and join filters do not see them.
The spam is a picture. A fake withdrawal, a celebrity giveaway, a promo code — as an image. Word filters and Discord's AutoMod read text; they never look inside a picture.
It is fast. The account posts in every channel it can write to, within seconds. Banning it afterwards leaves the damage in place.

Two layers that do not depend on the text

The honeypot

A honeypot is an empty channel everyone can see and write in, with a clear warning not to. Real members read the warning and stay out. A hacked account or a spam bot does not read: it posts there like everywhere else, and that first message gives it away. The message is deleted and the account is dealt with before the second one.

The scam-picture filter

The honeypot catches the account; the scam-picture filter catches the picture wherever it lands. Every posted picture is compared with SUPREO's shared list of confirmed scam pictures — including cropped, framed and edited variants — and the same picture posted by one account in 3 channels within 30 seconds is removed even if nobody has seen it before. Pictures the honeypot catches feed that shared list, so a campaign caught on one server is recognised on the others.

Bots, the server owner, administrators and the roles you exempt are never acted on. Nothing in this guide touches your staff.

Before you start

SUPREO on your server, and Manage Server to open the dashboard. New here? Set up the bot first.
For the bot: Manage Messages to delete the bait message, Ban Members for the default softban, and Manage Channels if you let it create the channel. The Honeypot page lists anything missing.

The setup, step by step

Create the bait channel

On the dashboard, open Honeypot under Moderation and press Create it for me. SUPREO creates a #honeypot text channel everyone can see and write in, posts the red warning card, and sets it as the bait channel.

You can pick an existing channel instead, as long as it is empty and nobody needs it. Two rules: everyone must be able to see and write in it — that is what catches bots — and it should sit low in the channel list, so members are not tempted. Do not hide it in a collapsed or private category: an account that cannot see the channel cannot fall into it.

Choose what happens to an account that posts there

The message is always deleted. Then, for the account:

Softban (default) — removes the account and wipes its messages from the last 24 hours, so the spam it already posted elsewhere goes too. It can join again.
Ban — bans the account and removes its recent messages.
Kick — removes the account; it can join again.
Time out — mutes the account for the length you choose and keeps it in the server, for a human to look at.
Log only — deletes the message and records the catch; your staff decides.

Softban is the right default for most servers: the people behind hacked accounts are real members who will want to come back once they have secured their account.

Exempt trusted roles and pick a log channel

Exempt roles — never acted on: trusted members, other bots' roles.
DM the account to explain why — sent before the action, with advice to secure the account in case it was hacked. Keep it on: it is what turns an angry "why was I banned?" into a password change.
Log channel — every catch is posted there with the account, the message and the outcome. Use a staff-only channel.
Custom notice — your own text on the warning card. Keep it blunt: whoever writes here gets the action.

Enable the honeypot and save

Turn on Enable the honeypot and save. The notice is posted if it is not there yet; if someone deletes it, Post again puts it back.

Check the scam-picture filter

Open Scam pictures. The filter is on by default, on every plan, and needs no setup. Three settings are worth a look:

What counts as a scam — known scams only, or known scams and floods (the default, which also removes the same picture posted in 3 channels within 30 seconds).
Action on the account — by default the same as the honeypot, or a 24-hour timeout on a server without one.
Read the text in pictures (Premium) — recognises a scam from what the picture says: a withdrawal, a promo code, a casino bonus. It catches new campaigns before anyone reports them, and photos of a screen that a fingerprint cannot match. Text that is only suspicious is acted on when the account also behaves like a hacked one; otherwise the picture just goes to review. English text.

Pair it with verification

If you run member verification, an account that writes in the trap before passing verification is almost always a bot, so it is banned instead of receiving your action (unless the action is Log only). The log entry says so. Turn off Ban accounts that have not passed verification to apply your action to everyone.

Test it safely

Do not test with your main account — the owner is never acted on anyway — and do not test with a friend on the default softban. Instead:

Switch the action to Log only and save.
From a second account that is not staff, write anything in the bait channel.
Check that the message disappears, the catch shows under Recent catches and in your log channel.
Switch the action back and save.

What happens after a catch

The member gets a DM explaining that their account posted in a channel marked as a trap, with advice to change their password, turn on two-factor authentication and remove apps they do not recognise. With a softban they can rejoin as soon as that is done. Your staff sees the catch in the log channel, and the last 90 days of catches stay listed on the Honeypot and Scam pictures pages, with the action taken or why it failed.

Every honeypot and scam-picture action is also recorded as a numbered case in the moderation history, next to your manual sanctions. See how to set up moderation on Discord.

Tips that make it work better

Name it plainly. #honeypot or #do-not-post. A tempting name like #free-nitro catches curious members, not bots.
Mention it in your rules. One line — "never write in #honeypot, it removes your account" — and nobody can say they were not warned.
Keep it visible to new members. If verification hides most channels, let the unverified role see the bait channel too: spam bots that join and post straight away are caught before they verify.
Mind the role order. The bot can only act on members whose highest role sits below its own.

The honeypot and the scam-picture filter (known scams and floods) are free on every server. Reading the text inside pictures is part of Premium. See pricing.

When something does not work

A catch is marked as failed. The bot lacks the permission for the action, or the account's highest role is above the bot's. The log entry gives the reason; move the bot's role up in Server Settings → Roles.
The warning card is gone. Someone deleted it. Press Post again.
A scam picture stayed up. Staff with Manage Messages and exempt roles are never checked. Otherwise it is a new campaign that is not on the list yet: floods catch it if it is posted in several channels, and reading the text catches it on the first post.
A softbanned account is still banned. The unban failed a few times in a row; the log says so. Unban it from Server Settings → Bans.

The full reference is in the docs: honeypot and scam pictures. Still stuck? Ask on the SUPREO support server.

Frequently asked questions

Will the honeypot catch real members?

Only members who write in a channel that tells them, in a red warning card, not to. It happens, rarely. With the default softban they are removed and can join again straight away, and the DM tells them why.

Why softban instead of ban?

Most accounts caught are hacked accounts of real people, not bots. A softban removes the account and wipes its last 24 hours of messages, which takes the spam with it, but lets the owner come back once the account is secured.

Does Discord AutoMod not already do this?

AutoMod filters words and links in text. Hacked accounts now mostly post pictures — a fake withdrawal on a crypto casino, a giveaway — and no text filter looks inside a picture. The honeypot does not look at content at all: posting in the trap is the signal.

Are the pictures stored?

No. Pictures are checked as they are posted. For a likely scam, SUPREO keeps a fingerprint the picture cannot be rebuilt from, and a small thumbnail for up to 14 days while it is reviewed.

Is it free?

Yes. The honeypot and the scam-picture filter with known scams and floods are on every plan. Reading the text inside pictures is Premium.

Who is never acted on?

Bots, the server owner, administrators and the roles you exempt. The scam-picture filter also skips staff with Manage Messages.

Catch the next hacked account on its first message

Add the bot, sign in with Discord, and create the bait channel in one click. Free on every server.

Next: keep fresh spam accounts out with member verification.