> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wardforge.org/llms.txt
> Use this file to discover all available pages before exploring further.

# Anti-Phishing & /report

> Three-layer phishing detection combined with community-powered reporting and an instant Global Ban network.

# Anti-Phishing & /report

Phishing — fake links sent in DMs or channels designed to steal Discord tokens, cryptocurrency
wallets, or personal data — is the most common threat Discord communities face in 2025.

WardForge fights it on two fronts: an **automated scan layer** that checks every posted link in
real time, and a **community intelligence pipeline** powered by the `/report` command.

***

## Automated Link Scanning

Every URL posted in any channel WardForge can see is automatically scanned against three databases:

| Database                 | Type                     | Coverage                                    |
| ------------------------ | ------------------------ | ------------------------------------------- |
| **PhishTank**            | Community-curated        | Discord-specific phishing, fake Nitro sites |
| **Google Safe Browsing** | Machine learning         | Broad web threats, malware distribution     |
| **VirusTotal**           | Aggregated (70+ engines) | Deep analysis for known malicious domains   |

### What Happens on Detection

```
Member posts a link
        │
  WardForge scans URL (< 200 ms median)
        │
  ┌─────┴─────┐
Not Found   Detected as Phishing
  │               │
Ignored     1. Message deleted
            2. Member DM'd with explanation
            3. Staff alert in #guardian-logs
            4. Member warned or banned (configurable)
```

<Tip>
  Configure the response action with `/antiphishing action [warn|kick|ban]`. The default is
  `warn` on first offense, `ban` on second.
</Tip>

***

## Community Intelligence: `/report`

The `/report` command turns your members into an active security network. When a member receives
a suspicious DM from another user, they can report it directly from Discord.

### How to Use It

```
/report user:@username reason:Sent me a fake Nitro link link:https://suspicious-url.com
```

| Argument | Required | Description                                             |
| -------- | -------- | ------------------------------------------------------- |
| `user`   | ✅        | The Discord user to report (mention or ID)              |
| `reason` | ❌        | Free-text description of the scam                       |
| `link`   | ❌        | The suspicious URL (WardForge will scan it immediately) |

### Anti-Abuse Safeguards

To prevent false reports or coordinated harassment, `/report` has several built-in protections:

* **Minimum TrustScore of 20** required to submit a report
* **10-minute cooldown** per reporter — prevents spam flooding
* **Self-report blocked** — you cannot report yourself
* **Already-blacklisted check** — if the target is already in the Global Ban list, you're shown
  the existing record instead of creating a duplicate

### What Happens After You Submit

<Steps>
  ### Immediate link scan

  If a link was provided, WardForge instantly queries all three phishing databases.

  ### Automatic Global Ban (if link confirmed)

  If the link is found in the phishing database:

  1. WardForge adds the user to the **Global Blacklist**
  2. The user is **banned from every server** in the WardForge network where WardForge has permission
  3. Your server's staff is notified with a confirmation embed showing the number of servers affected

  ### Staff review (if link not confirmed)

  If the link is unknown or no link was provided, a **priority embed** is posted to your configured
  report channel for staff review:

  ```
  📢 Report — Pending Staff Review
  ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
  🎯 Reported User : @suspicious_user
  📣 Reporter      : @trusted_member
  📝 Reason        : Sent me a fake Nitro link
  🔗 Link          : https://example-scam.com
  ⚡ Action        : Awaiting staff decision

  🔥 Priority: HIGH — 3 independent reports in 24 hours
  ```
</Steps>

***

## Priority System

The priority level on a staff review embed reflects **how many different members** have
independently reported the same target in the last 24 hours:

| Reports in 24 h | Priority Level |
| --------------- | -------------- |
| 1               | Normal         |
| 2               | Medium         |
| 3 or more       | **HIGH**       |

<Warning>
  A HIGH priority flag means multiple unrelated members independently reported the same account.
  This is a strong signal of a real threat, not a coordinated false report. Treat HIGH priority
  reports as urgent.
</Warning>

***

## Global Blacklist

The **Global Blacklist** is a shared database of confirmed scammers and phishing accounts,
maintained collectively by the WardForge network.

### How a User Gets Blacklisted

1. A `/report` with a **confirmed phishing link** triggers an automatic blacklist entry
2. Staff can manually add an entry via `/blacklist add @user [reason]`
3. WardForge's automated scanner adds entries when it detects a pattern across multiple servers

### What Happens to Blacklisted Users

* Any blacklisted user who attempts to join **any WardForge-protected server** is **automatically banned**
* The join attempt is logged in `#guardian-logs`
* The Global Ban applies retroactively — if the user is already in the server, a staff alert is sent

### Checking the Blacklist

```bash theme={null}
/blacklist check @user     # Check if a user is in the global list
/blacklist add @user [reason]   # Manually add (Admin only)
/blacklist remove @user    # Remove an entry (Admin only)
```

***

## Configuring Report Channels

By default, WardForge posts report embeds to `#guardian-logs`. To use a dedicated channel:

```
/report-config set-channel #security-reports
```

View aggregate statistics with:

```
/report-config report-stats
```

This shows total reports submitted, confirmed phishing cases, and activity over the last 7 days.