vmphase

Image-based scam campaigns have become a common moderation challenge across Discord communities.
A typical campaign follows a familiar pattern:

• Either a random account joins a server, waits a few hours (sometimes days), and starts posting scam messages;
• Or a legitimate account gets compromised and suddenly begins posting the exact same scam across multiple channels.

Regardless of how the campaign starts, one characteristic remains remarkably consistent: the media attachment.

Whether it's the well-known MrBeast scam, fake nitro giveaways, or other phishing attempts, attackers rarely generate entirely new assets. Instead, the same image or GIF is repeatedly reused,

vmphase

[tool.ruff]
exclude = ["docs/"]
target-version = "py312"

[tool.ruff.lint]
select = [
    "E",
    "F",
    "W",
    "I",

vmphase

I was lurking in a group chat last week where people were arguing about Wordle. Apparently someone got it in 2 and everyone lost their mind. I hadn't played Wordle in my life (genuinely zero interest) but the math angle of the argument caught me.

---

The idea

Wordle gives you 6 tries to guess a 5-letter word. After each guess, you get colored feedback:

vmphase

The Problem

Discord's Audit Log only creates an entry if a moderator deletes someone else's message.
If a user deletes their own message, the audit stays silent, what creates a logic gap:

How do you tell the difference between a user or moderator cleaning up the message?

PoC described

I've never seen a definitive solution that actually handles the stacked deletion problem, so I created this gist.
By caching the state of the last known deletion action, we can pinpoint exactly when a new action occurs, even if multiple moderators are active or if one moderator is deleting messages rapidly (one by one, not bulk).