DocsProtection
Anti-raid
How every new member is scored, and what happens at each level.
The score
Every new member gets a score from 0 to 100, built from signals in five groups. The strongest signal in each group counts, up to that group's cap, and the groups combine. So three weak signals in three groups count for more than three in one.
| Group | Signals |
|---|---|
| Identity | A new account, no avatar |
| Timing | Joins far above your normal rate, or joins at machine-regular gaps |
| Cohort | Accounts made minutes apart, look-alike names or avatars, the same message from several new members |
| Invite | An invite whose earlier joins were often flagged |
| Behaviour | A link or mass mention straight after joining, AutoMod blocks |
No single signal outside the honeypot can push a member to high risk alone.
What happens at each level
| Level | Score | In enforce mode |
|---|---|---|
| Suspicious | 30 | Nothing. Listed in any open raid incident |
| Elevated | 55 | A 1 hour timeout, only while a raid is open |
| High risk | 75, from 2 groups | Quarantine or a 24 hour timeout |
| Hostile | 90, from 3 groups during a raid | Your raid punishment, quarantine by default |
Raids
Scores fade by half every day without a new signal. A raid incident opens when joins spike or when a group of new members look alike, and closes after 15 minutes with no new high risk joins. You can let Astri pause invites for an hour during a large raid; it's off by default.