Skip to main content

​
Phishy User Guide

Phishy is a Discord bot that protects your server from phishing links, scam images, and compromised accounts. It watches messages in your server and removes known threats automatically. If you turn it on, it can also isolate a member whose account looks compromised, so they can’t spread scams while your team looks into it. This guide covers adding Phishy to your server, setting it up, every command, and the web dashboard.

​
Contents

  1. Adding Phishy to your server
  2. Setting up Phishy
  3. What Phishy protects against
  4. Scam alerts
  5. Quarantine
  6. Commands
  7. The web dashboard
  8. Plans and pricing
  9. Troubleshooting
  10. Privacy, terms and support

​
Adding Phishy to your server

You can add Phishy to any server where you are the owner, or where you have the Administrator or Manage Server permission.
  1. Go to the Phishy website at phishy-app.xyz.
  2. Sign in with Discord and open the Dashboard.
  3. Under Add Phishy, find your server and click Invite.
  4. Approve the permissions Discord asks for.

​
Permissions Phishy needs

Important: Phishy can only manage members whose highest role is below Phishy’s own role. After inviting Phishy, go to Server Settings → Roles and drag Phishy’s role as high as you can, ideally above all of your member and moderator roles.

​
Setting up Phishy

Once Phishy is in your server, run /setup to choose how it behaves. Only members with the Ban Members permission can run this command.
You can run /setup again at any time to change your settings. Each run replaces your previous settings.

​
What happens when you turn on auto-quarantine

If you set autoquarantine to True, Phishy also does the following:
  • It creates a Quarantine role (shown in dark red).
  • It creates a private #quarantine channel. Only quarantined members (and Phishy) can see it, so you can use it to talk with a member while they are isolated.
  • It hides every category in your server from the Quarantine role, so quarantined members can’t see your normal channels.
  • It also hides any new categories you create later from the Quarantine role automatically.
Note: Channels that don’t sync their permissions with their category, and channels that aren’t in a category, are not hidden automatically. Check those channels and deny View Channel to the Quarantine role yourself.
Auto-quarantine needs the Manage Roles and Manage Channels permissions. If Phishy is missing either one, /setup tells you which permission to grant. You can also run /setup with auto-quarantine turned off.
Tip: Don’t rename the Quarantine role. Phishy finds the role by its name.

​
What Phishy protects against

Phishy checks every message posted in channels it can see. This check only runs when urlcheck is turned on. Phishy checks every link in a message against a regularly updated list of known phishing websites. It also catches subdomains of those sites (for example, login.scam-site.com when scam-site.com is on the list). It finds links whether they’re posted as plain links, hidden behind text, or posted with embeds turned off. When Phishy finds a phishing link, it:
  1. Deletes the message right away.
  2. Quarantines the author, if auto-quarantine is turned on.
  3. Posts an alert in your alert channel (supporter and partner servers).

​
Known scam images

Phishy keeps a growing list of known scam images, such as fake Nitro giveaways, fake crypto promotions and malicious QR codes. Every image posted in your server is compared against that list. Phishy can also recognise a known scam image after it has been cropped, resized or slightly edited. When an image matches a known scam, Phishy:
  1. Deletes the message right away.
  2. Quarantines the author, if auto-quarantine is turned on.
  3. Posts an alert that includes a copy of the removed image (supporter and partner servers).

​
New and unknown scam images

Scammers keep making new images. When an image doesn’t match a known scam, Phishy checks it with automated scam detection. This check gives the image a score from 1 to 10, where 10 means it is very likely a scam. When an image scores 7 or higher, Phishy:
  1. Quarantines the author, if auto-quarantine is turned on.
  2. Posts an alert with the score and the reason it was flagged (supporter and partner servers).
  3. Sends the image to the Phishy team for review. If we confirm it’s a scam, we add it to the known scam image list, and Phishy will then delete it automatically in every server.
Note: For new and unknown images, Phishy does not delete the message automatically, because automated detection can sometimes be wrong. A moderator should review the alert and delete the message if it’s a scam.

​
Scam alerts

Alerts are posted in the channel you chose with /setup. Alerts are a supporter and partner feature. See Plans and pricing. There are three kinds of alert: Each alert contains:
  • Probability: how sure Phishy is. This can be “Known phishing domain”, a match percentage for known images, or a score out of 10 for new images.
  • Author: the member who posted the message.
  • Reason: why the message was flagged. For links, this includes the link itself.
  • Message: a link to the message, or a note that it was deleted. If the message still exists, the alert has a Jump to Message button.
  • Auto-Quarantine: shown when auto-quarantine is on. It says whether the author was quarantined, and the reason if quarantine failed.
  • Image: the flagged image, when there is one.

​
Quarantine

Quarantine isolates a member, for example when their account has been hacked and is posting scams. Quarantine is not a ban. The member stays in your server, but can only see the #quarantine channel until a moderator releases them.

​
What happens when a member is quarantined

  • All of their roles are removed and replaced with the Quarantine role.
  • Phishy saves the roles they had, so it can give them back later.
  • Roles that Discord manages, such as Server Booster or roles that belong to other bots, are left in place. Discord doesn’t allow bots to remove these.
  • The quarantine is recorded with the reason and the person (or Phishy) who issued it. It appears on the web dashboard.
A member can be quarantined in two ways:
  • Automatically, when auto-quarantine is turned on and they post a detected scam.
  • Manually, when a moderator runs /quarantine.

​
Releasing a member

Run /unquarantine to release a member. Phishy removes the Quarantine role and gives back the roles the member had before. Phishy will skip a role if:
  • The role has since been deleted.
  • The role is now above Phishy’s own role.
Phishy tells you how many roles it restored and how many it skipped. If it skipped any roles, you’ll need to give those back to the member yourself.
Tip: Before you release a member, make sure they have secured their account. They should change their password, turn on two-factor authentication, and log out of all other devices.

​
Commands

All Phishy commands are slash commands. The table below shows who can use each command by default. Server admins can change this in Server Settings → Integrations → Phishy.

​
/setup

See Setting up Phishy.

​
/quarantine

This command quarantines a member. If you don’t give a reason, Phishy uses “No reason provided”. Only you can see Phishy’s reply. Phishy will refuse to quarantine a member if:
  • /setup has not been run with auto-quarantine turned on, so the Quarantine role doesn’t exist.
  • The member is already quarantined.
  • The member’s highest role is the same as or above Phishy’s role.
  • Phishy is missing the Manage Roles permission.

​
/unquarantine

This command releases a quarantined member and gives back the roles they had before. If Phishy has no record of the member’s earlier roles, it only removes the Quarantine role. This can happen if someone gave the member the Quarantine role by hand.

​
/supporter

This command shows whether your server is a Partner, has an active Supporter subscription, or has no subscription.

​
/ping

This command shows how long Phishy took to respond, so you can check that it’s online and working.

​
The web dashboard

The dashboard at phishy-app.xyz/dashboard lets you manage Phishy from your browser.

​
Signing in

Click Log in and approve the request in Discord. Phishy only asks to see your basic profile and the list of servers you’re in. It can’t read your messages or act on your behalf. Click Log out at the top of the dashboard to sign out.

​
Your servers

The dashboard lists every server you own, or where you have Administrator or Manage Server:
  • Protected by Phishy: servers where Phishy is already installed. Click a server to manage it.
  • Add Phishy: servers you manage that don’t have Phishy yet. Click Invite to add it.

​
Server page

Each server page shows:
  • Plan: Not Premium, Pro or Partner. If your server isn’t on a paid plan, the Upgrade to Pro button opens a secure checkout.
  • Overview tab: member count, online count, server ID, server owner, and the date the server was created.
  • Quarantined Users tab: every member who is currently quarantined, with the reason and the date and time they were quarantined.

​
Plans and pricing

Partner servers are servers that work closely with the Phishy team. They get all Pro Shield features at no cost.

​
Upgrading

  1. Open your server on the dashboard.
  2. Click Upgrade to Pro and complete checkout.
  3. Your server is upgraded as soon as payment is confirmed. Run /supporter in your server to check.

​
Cancelling

You can cancel your subscription at any time. When it ends, your server moves back to the Community plan. Payments are non-refundable unless the law requires a refund.

​
Troubleshooting

Phishy isn’t posting alerts.
  • Alerts are only posted for supporter and partner servers. Run /supporter to check your plan.
  • Make sure you’ve run /setup, and that the alert channel still exists.
  • Make sure Phishy can view and send messages in the alert channel.
Phishy isn’t deleting phishing links.
  • Link scanning is off by default. Run /setup with urlcheck:True.
  • Make sure Phishy has Manage Messages in that channel.
“The Quarantine role does not exist.” Run /setup with autoquarantine:True. If you renamed the Quarantine role, change its name back to Quarantine. “I cannot quarantine this user because their highest role is above or equal to my highest role.” Go to Server Settings → Roles and move Phishy’s role above the member’s highest role. Phishy can’t quarantine the server owner. “An error occurred during setup. Make sure my bot role is at the top of the hierarchy.” Move Phishy’s role higher in Server Settings → Roles, then run /setup again. Quarantined members can still see some channels. Find any channel that is outside a category, or that doesn’t sync with its category. Give it a permission overwrite that denies View Channel to the Quarantine role. Some roles weren’t given back after /unquarantine. Those roles were deleted, or they’re above Phishy’s role. Give them back to the member yourself. Phishy flagged something that isn’t a scam, or missed a scam. Let us know through the Contact page and choose Report a False Positive/Negative.

​
Privacy, terms and support

  • Privacy: Phishy only processes messages and images briefly, to check them for threats. We only keep content that is flagged as malicious, and we never sell your data. Read the full Privacy Policy.
  • Data deletion: Server administrators can ask us to delete their server’s data at any time. Use the Contact page and choose Data Deletion Request.
  • Terms: Using Phishy means you agree to the Terms of Service. Phishy greatly reduces risk, but no tool catches every threat.
  • Support: Reach us through the Contact page or the Phishy Support Discord server.