Phishing is the fastest way Web3 Discords get breached. Use this practical guide to harden settings, block Unicode and link spoofing, and train members to spot scams.
Most Web3 server compromises begin with phishing, not with technical exploits. Attackers impersonate staff, post fake mint links, push Nitro giveaways, or lure mods into scanning QR codes that hijack Discord sessions. Once a single staff account is compromised, attackers pivot to announcement channels and ping everyone, which converts quickly because trust is already established. Wallet drainers use lookalike domains and Unicode tricks to bypass casual checks, and link shorteners make destination URLs hard to read. Treat phishing as a constant pressure, not a one time event, and design your server so that a single mistake does not turn into a server wide breach. The goal of Discord anti phishing work is layered defense, which combines server configuration, role and channel design, filters that block spoofing, strong link controls, clear member education, and a fast incident response plan.
Start with the basics that reduce reach and speed. In Server Settings, set Verification Level to High or Highest to slow bot entries. In Moderation, enable AutoMod Block Spam Content and Block Mention Spam with a low threshold so mass pings do not land. In Safety Setup, require a Rules Screening and a minimum account age for new members. In Roles, remove Mention Everyone permissions from everyone and staff who do not need it. In Default Notification Settings, choose Only Mentions to reduce exposure to unsolicited messages. Encourage members during onboarding to disable Allow direct messages from server members, since this setting lives on the user side. In Server Settings, set Media Content Filter to Scan media content from all members to reduce malicious attachments. These changes do not stop everything, but they raise the work required for attackers and buy moderators time to act.
Create a clear separation between chat, support, and announcements. Only a small, vetted role should be able to post in announcement channels, and publishing to following servers should require a second person review. In general chat, restrict Attach Files and Embed Links for the base member role. Members can still paste a URL, but without an embed it attracts fewer clicks. Use Slowmode in large channels during mints or sensitive events so a burst of malicious links cannot flood the feed. Create a dedicated channel for official links and pin it in the welcome flow. Lock link posting in sensitive channels like verification, support, and AMA stages to staff roles only. The goal is to grant the minimum permissions needed to talk, while forcing links to flow through a few predictable paths that you can monitor and moderate quickly.
Phishing messages often hide lookalike characters, such as Cyrillic letters that resemble Latin letters, or insert zero width characters that break your eyes from recognizing the domain. Right to left override marks can also flip parts of a string so a file or URL appears safe. If your server has AutoMod Regex rules, add patterns that detect invisible characters. Example Regex pattern to block invisible characters: [\u200B-\u200F\u202A-\u202E\u2066-\u2069\uFEFF]. This catches zero width joiners and common bidirectional marks. Set the action to Block message and Alert a mod channel. If Regex is not available, deploy a reputable moderation bot that can scan for Unicode control characters and homoglyphs, then quarantine the message. Train staff to spot lookalikes by copying a suspicious URL into a plain text editor that reveals characters, or by using a trusted link decoder on a separate device. These controls do not affect normal chat, but they catch the tricks scammers rely on.
Most successful scams rely on a clickable link. Publish a short, unchanging list of your official domains in a read only #official-links channel, and put the same list in your server description and on your project website. Use your own redirect domain for all announcements, for example links.yourbrand.xyz, and route it through a Cloudflare or Vercel page that shows a branded warning and then 301 redirects to the final page. This gives you one switch to cut off a compromised link. In AutoMod, create a Keyword rule that blocks known shorteners like bit.ly, tinyurl.com, t.co, goo.gl, is.gd, and linktr.ee. Add common drainer TLDs that target your audience, then review monthly. If you can use Regex, allowlist your official domains and block unknown top level domains in announcement channels only, not server wide. Remove Link Preview embeds for the base role, since previews can disguise the real target with a convincing thumbnail. Finally, require staff to paste the destination URL in plain text under any shortened or redirected link, so members have both views.
Technical filters help, but member habits decide most outcomes. Bake security education into onboarding. Add a Security 101 message that states, we never DM first, no stealth mints, no surprise collabs, and no Nitro giveaways. Pin it in #start-here, #announcements, and #support. In your server banner and welcome screen, include a short line that repeats these rules. Run a monthly five minute Security Saturday post that spotlights a current phishing tactic with screenshots, such as QR code session hijacks or fake OpenSea support. Teach members to check role color and role badge for staff, to click a name and review the join date, mutual servers, and recent messages. Encourage turning off server DMs and reporting suspect messages through a simple flow, for example react with a red flag emoji or use a short /report command that opens a mod only thread. Positive repetition builds a culture where scams feel obvious and reportable.
Configure AutoMod to alert a private mod channel when a message is blocked for links, Unicode control characters, or mass mentions. Give one or two senior mods access to a live feed channel that mirrors high risk channels such as announcements and general. Consider a specialized anti phishing bot that checks posted URLs against community blocklists like CryptoScamDB, Chainabuse, or OpenPhish. If you deploy a bot with domain intelligence, run it in Audit mode for a week to tune false positives, then switch to Quarantine and Alert. Set up saved searches in Discord for new messages that match your brand name with common typos, which helps catch lookalike scammers who impersonate your team. Track a simple set of metrics in a spreadsheet, including blocked messages by rule, time to first moderator action, and repeat offender rates. Use these numbers to adjust thresholds, add new keywords, and decide where to invest more training.
When a phishing message lands, speed matters. Lock down by removing Send Messages from the compromised channel, disable @everyone mentions for all staff, and reduce rate limits with Slowmode in general. Remove the message, ban the source, and search server wide for the domain to purge duplicates. If a staff account is involved, remove high risk roles, rotate their API tokens and OAuth app connections, and require a password reset and 2FA check before restoring access. Post a clear incident notice in announcements that explains what happened, the window of risk, and the action members should take, for example revoke any recent website approvals, disconnect suspicious dapps, and scan devices. Update your #official-links with fresh redirects if needed. After containment, review logs, tune rules that failed, and add the new domain to your blocklists. Keep the postmortem short, factual, and focused on next steps that reduce recurrence.
Create a private staging server that mirrors your live role and channel structure. Test AutoMod rules, Regex patterns, and bot settings with realistic sample messages that include zero width characters, right to left marks, and shortener links. In production, schedule a quarterly phishing drill. A senior mod posts a safe test message using a lookalike domain and logs the time to detection, the path of escalation, and the time to resolution. Review the outcomes in a 30 minute meeting, then update runbooks and checklists. Keep a change log for security rules, so you know who changed what and when. Finally, rotate your official links redirect key every quarter, audit staff 2FA and recovery codes monthly, and archive inactive integrations. Consistent small improvements lower risk without slowing community growth.
Learn Discord anti phishing tactics for Web3 servers. Block Unicode spoofs, malicious links, and QR scams with AutoMod rules, allowlists, and playbooks.