Anti-Phishing

Lunova checks every message for known phishing and scam links. Detected messages are deleted immediately and the sender is actioned. No configuration beyond setup is required — it runs passively on all messages.

Setup

/antiphishing setup action: delete_warn log-channel: #phishing-log

Parameter	Description
action	What to do when a phishing link is detected. See action types below.
log-channel	Channel where phishing detections are logged with domain, user, and action taken.

Administrator

Action Types

Action	What happens
delete	Message is deleted silently. User receives a DM explaining why. No case created.
delete_warn	Message deleted + warn case created + user is DM'd. Contributes to the strike count.
delete_kick	Message deleted + user is kicked + case created + DM sent.

How detection works

Lunova uses two layers of detection:

Local pattern list — a built-in list of common phishing patterns: typosquatted Discord and Steam domains, fake Nitro gift URLs, and scam redirect patterns. This check is instant.
sinking.yachts API — a live phishing domain database. Every message with a URL is checked against this API. If it returns a positive match, the message is actioned.

✓ Detection is domain-aware — it extracts the hostname from any link in the message, including links masked with Markdown or embed suppression.

Checking Status

/antiphishing status

Shows whether phishing detection is enabled, the current action, and the log channel.

Disabling

/antiphishing disable

Turns off phishing detection. Existing cases are unaffected.

Ghost Ping Detection

Lunova also catches ghost pings — messages that mention users, roles, or @everyone/@here and are then deleted. When detected, an orange alert embed is posted to the message logs channel showing who sent it, what channel, who was pinged, and the original content.

Ghost ping detection is automatic with no setup required. It activates as long as a message logs channel is configured in Logging.