Scam Detection

AIO Agent can scan scam images, links, and sender context before the bot gives a normal ticket or chat reply. It is designed for staff review first: the feature is disabled by default, and the default mode is ask.

What It Checks

Scam Scanner looks at:

• image attachments
• message text and links
• account age and server join age
• roles and trust lists
• recent message context
• configured trust lists
• repeated image hashes and domains

Common categories include impersonation, fake giveaways, crypto/casino scams, phishing, fake Nitro, fake Steam, fake Roblox, fake payment, urgency, suspicious domains, and coordinated reposts.

Required Model Support

Image scanning uses your configured llm_provider and llm_model. There is no separate OCR dependency.

Use a model that accepts images:

If the selected model cannot accept images, AIO skips image-only scans and logs vision_unsupported.

Privacy

AIO does not store raw image files. It fetches attachments in memory only long enough to send the image to the model and compute a SHA-256 hash.

The scam scan log stores message/user/channel IDs, attachment URLs, image hashes, domains, confidence, action, and short evidence text.

Basic Config

scam_detection: {
  enabled: false,
  mode: "ask",
  min_confidence: 0.82,
  auto_delete_confidence: 0.94,
  scan_images: true,
  scan_links: true,
  scan_new_accounts_more_strictly: true,
  review_channel_id: "",
  log_channel_id: "",
  monitored_channels: [],
  excluded_channels: [],
  trusted_domains: [],
  trusted_users: [],
  trusted_image_hashes: [],
  actions: {
    delete_message: true,
    auto_delete_high_confidence: false,
    warn: true,
    timeout: true,
    timeout_minutes: 60,
    kick: false,
    ban: false
  }
}

An empty review_channel_id falls back to AIO’s moderation review channel. The optional scam log_channel_id stores scam evidence and decisions; Athena’s moderation plugin owns punishment history and moderation logs.

Review Buttons

In ask mode, AIO posts a staff review embed with:

• Approve Delete
• Dismiss
• Warn
• Timeout
• Ban
• Trust Domain
• Trust Sender
• Trust Image

Only AIO OWNER, ADMIN, and MODERATOR users can act on the review buttons.

Dismissed scans do not create a punishment. Approved warnings, timeouts, kicks, and bans run through Athena’s moderation plugin and appear in its normal history and log.

Example

A screenshot of a fake verified celebrity account promoting a crypto/casino giveaway should be flagged for impersonation, fake giveaway, crypto/casino, urgency, and suspicious domain evidence. AIO will also weigh whether the sender is new, whether the same image/domain appeared recently, and whether the message context shows it is a warning or educational discussion instead of a scam attempt.

Staff Commands