Dealing with a raid.md

Dealing with a raid

Things to be aware of before a raid

When a raid happens things tend to go extremely fast so here are some things you can familarize yourself with in advance :

• Does the server have any automated countermeassures?

  • if so what are their limits?

  • What are the min limits for it to act? No system is perfect so what things will it handle for you and what not?

  • Does it work based on people sending too many or duplicate message: don't enable slowmode as this might make it harder for the system to detect the spam and deal with it

  • Can you enable more agressive limits when a raid does happen to make it deal with it better?

• Can you lock down the server or some channels to make the spam stop while you are handling it?

  • If you have manage server you can temp increase the verification level of the server to phone verification to stop most raiders

    • GearBot also has a verification command to do this, however this is locked to admin and above by default, will need to be unlocked to moderators in advance to be able to use this.

• Can you revoke invites?

  • if the server isn't public with a vanity invite they often make their own invite to join with. Revoking the public invite you have in a million places online usually ends up doing more damage but if they made their own you can often just revoke that one to instantly kill the raid.

• How to quickly get userids to manually deal with them?

  • In the case of GearBot you can use the !uid command for this, feed it into mban to ban all of them for example, all the clean commands that work user based also can take multiple userids at the same time

• What cleaning options do you have available?

  • Most bots have several clean commands that work differently and not all are as useful in all situations

    • For GearBot the most useful ones are probably:

      • !clean until takes a message id or messsage jump link, needs to be executed in the channel itself, it will remove all messages from now up until and including that message

      • !clean between very similar like clean until above, just in between 2 messages. Useful if you stopped the raid and people started talking again before you had time to clean everything up, with this it just deletes in between the messages you give it, leaving more recent chat intact.

      • !clean everywhere give it one or more users and it will remove their last messages in all channels

During a raid

Let's hope it doesn't come to this, but raids do happen (and can be pretty scare, especially if you are the only mod online at the time) so let's see what we can do about it shall we?

• Take a deep breath, raids can be ugly and scary, but panicking only makes it worse to deal with, and don't forget: in a few few minutes the worst will be over, if not all of it. People also have a short memory, it might be a complete disruption to the server atm but it will be

• Are other mods/admins/... aware?

  • If you have automated countermeasures pinging the role(s): Great everyone is aware and should be popping in as soon as they can

  • If not: ping the role(s) first, you don't need a fancy message detailing everything somthing as simple as "@moderators we are being raided, i need help" works plenty. But make sure you do it, don't assume users will do it for you. They might and probably will but they also might not if they already see you are handling it.

• How many mods are around atm?

  • If you're not alone then you can spread out the work and deal with it much faster, if you are alone focus on making it stop and worry about cleaning up the spam later, users will understand.

• You don't have to reply to users pinging you about the raid

  • If a bunch of you ping you feel free to ignore it while you deal with it, alternatively a simple "on it" tells them atleast one mod is aware and handling it, details can come later if you really want to share but there are other priorities atm.

• Leverage the automated countermeasures if any

  • If you see users are already getting banned and cleaned up because of anti-spam bot settings, let them. Less work for you to clean up. Focus on dealing with whatever the bot isn't picking up on.

• Think before you lock down a chat

  • First instinct might be to lock down a chat and revoke send message perms in that channel, but before you do that think of a few things:

    • Is this a bot or a human raid?

    • Does this look like a bunch of spambots or actual people copy pasting/spamming messages?

    • Locking a single channel can be highly effective against bots, they don't tend to addapt that fast, however if it is actual humans they can switch to another channel pretty quickly and it turns into a game of wack a mole. If more mods are available that is not a problem though, one can play wack a mole while others clean it up

• Use your tools, it might at first sight be faster to go around in chat right clicking and banning anyone you see spamming but it isn't always. Leverage commands like uid and mban when possible. Focus on putting a stop to the raid and cleanup after, or if you have several mods available have one stopping it while another cleans up the mess

After the raid

• Give yourself and the other mods some pats on the back, you did it. The raid is over and everyone survived.

• Take a deep breath, good job

• If you have automated countermeasures make sure they properly disengaged and will not be acting on new people joining that are not raiders

• Restore settings to what they where, unlock chats, set verification level back to what it was (or leave it extra high temp until you are sure there isn't a 2nd attempt)

• Take a quick look at the logs, especially the start and end of the raid. Do any users stand out as maybe not being raiders but just unlucky people who joined and got hit with the automated countermeasures?

• Stay alert, know they might try again, or they might just give up cause they realized it's futile, you never know. Just don't fall into paranoia and watch logs like a hawk just in case. Bots can do that for you while you enjoy more fun activities.

• Talk about what happened with the mods involved. What went right, what went wrong? bot settings to tweak to be better prepared for next time? Any moderators who where unsure of what to do?