Workflow & handelingen

How AntiScammer processes messages, detections, and reports.

Message scanning flow

1. Incoming message – A message is sent in a channel where the bot has read access.
2. Normalization – The message is normalized (lowercase, stripped obfuscation, etc.).
3. Pattern matching – Content is checked against:
   • Users blacklisted (URLs, keywords, user IDs)
   • Scam patterns and heuristics
   • ML-based detection (if enabled)
4. Scoring – A risk score (0–100) is assigned.
5. Threshold – If the score exceeds the server threshold (configurable), an action is taken.

Possible actions

Action	Description
Log only	Message is logged; mods are notified. No automatic punishment.
Delete	Message is deleted. User may be warned.
Ban	User is banned (local or global, depending on config).
Global ban	User is added to the global watchlist; future servers auto-ban.

Report workflow

1. User or mod uses /report or clicks report on a message.
2. Report is sent to the configured report channel.
3. Moderators can triage in the dashboard: open, in review, resolved, dismissed.
4. If confirmed scammer, moderators can escalate to request a global ban.

Trusted URL handling

• Use /report_false_positive with the message or URL that was wrongly flagged.
• Trusted URLs are reviewed to improve patterns and reduce noise.