Skip to main content

Discord scammers get their bots verified, and you don't

Imagine a place where serios and malicious scams get treated better than legitimate users and developers.

Where you get denied hundreds of times for your bot verification, and then you see a scammer getting verified with all intents...

It's The Reality​

I usually don't rant about stuff because I got better things to do, but this time I just can't hold it in anymore.

I was working as I got an automod message. A scam. I decided to investigate it to take a little break from focus. Attention span of a coconut.

Discord automod message about a scam message

Of course, it's a CyberLeek GTA VI leak related thing because it's so interesting like omg gta vi omggg :oo

So I joined, and saw a typical scheme. A verification bot and the entire server locked out unless the user gets "verified" (read: hacked and scammed).

Discord scam server screenshot

But one thing pissed me off in particular: the bot was verified. And had all intents approved. Including the MESSAGE_CONTENT intent, which I needed to get for years, and never got approved.

Verified impersonated bot intents

Verified impersonated bot creation date

Of course, the quick verification link pointed to an AI-cloned website.

Scam website screenshot

And of course, the website then impersonates Discord with a phishing login form opened in a popup to confuse the user. Entering any credentials will send them in plaintext to the scammer, and take over the account, and probably make it so the user can't even recover it.

Scam website login form screenshot Notice the about:blank. Super common phishing technique.

Whoever proceeds to enter their credentials will have their account stolen, and the scammer will then use it to scam others, and probably get it banned by Discord.

Who asked?​

Me. Anyway, what I'm upset about is that those scams still exist, have massive servers, with thousands of members bots, and Discord does nothing about it. And they gladly verify their bots (somehow) with all intents, while my bot (marCloudBackup) or other bots (e.g. YAGPDB, for instance) have troubles fighting over the right to get the intent.

Intent application rejected screenshot

But apparently having prefix commands is a crime, and having a bot that actually does something useful is a crime, and having a bot that actually cares about the users is a crime. And actually fights against malicious use cases and actively protects the Discord as a whole is a crime.

YAGPDB situation: Prefix commands are so scary Prefix commands are so scary

I guess doing BaaS (bot as a service) is the way now, or opensource your bot and let others run it. :/

Thank you for reading my rant.

As always, stay safe and cautious online. If you have any questions about such scams or want to discuss this topic, feel free to join our Discord server: https://discord.gg/yaftWcn

Best, Marcelektro