Anti-Nuke
Detects attacks on your server, stops the attacker and undoes the damage as far as possible.
In the panel under: Moderation, Anti-Nuke
A nuke is when someone with permissions destroys everything in a short time: deleting channels, deleting roles, banning everyone. Anti-Nuke recognizes this by speed and pattern, not by a single action.
How it works
Every suspicious action raises a threat score for whoever caused it. If the Quarantine Threshold is exceeded, the bot steps in. If the Critical Threshold is exceeded, the incident counts as critical and can trigger the emergency lockdown.
So a single deleted channel isn't an incident. Ten in twenty seconds from an account that became admin yesterday definitely is.
Setup
Enable the module
Create the quarantine role
Click Create Quarantine Role. The bot creates the role and denies it access to every channel. Use Sync Quarantine Role later to add this for new channels.
Choose a log channel
Incident reports go there, along with buttons to pardon or confirm.
Maintain the whitelist
Add your leadership roles and trusted bots before you arm it.
Save and test
Watch the log channel for a few days before you tighten the thresholds.
The nine detection mechanisms
| Trigger | What it detects |
|---|---|
| Mass Channel Deletion | Many channels deleted in a short time |
| Mass Role Deletion | Many roles deleted in a short time |
| Dangerous Permission Granted | Someone hands out admin or similar permissions |
| Mass Ban | Many members banned in a short time |
| Mass Kick | Many members kicked in a short time |
| Unapproved Bot Added | Only for bots with elevated permissions that aren't on the whitelist |
| Bot Kicked or Banned | Someone other than the server owner removes a bot, only with the switch from the section below |
| Webhook Spam | Creating or abusing webhooks en masse |
| Dangerous Server Setting Change | For example, lowering the server's security level |
Whitelist
| Setting | Meaning |
|---|---|
| Whitelisted Roles | Members with one of these roles are never flagged as attackers |
| Whitelisted Users & Bots | Individual accounts that are never flagged |
The bot whitelist matters: without it, adding a legitimate bot counts as an incident.
Moderators who often ban or kick many members in quick succession (during a raid, for example) belong on the whitelist too. This applies to bans by hand just as much as to /ban and /kick through AlphaCloud: both count for the member who triggers them.
Blocking webhooks
A nuke bot likes to create webhooks and spam through them. A webhook stays even when the bot was kicked long ago. Two separate switches, both off by default:
| Setting | Meaning |
|---|---|
| Delete webhooks from bots right away | When a bot creates a webhook, AlphaCloud deletes it again right away |
| Delete webhooks from members right away | The same for members, the server owner is exempt |
Bots and members on the whitelist can still create webhooks. Following an announcement channel always stays possible. The deletion shows up with its reason in the Discord audit log, the bot needs the Manage Webhooks permission for it.
Important: bots like PluralKit, Tupperbox or NQN only work with webhooks. Put them on the whitelist before you switch on the block for bots.
Bots can only be removed by the server owner
An attacker often throws out the protection bots first. When Only the server owner may kick or ban bots is on (off by default), AlphaCloud treats anyone else who kicks or bans a bot as an offender right away, no matter how high their threat score is.
- A banned bot is unbanned again automatically.
- Only a person can bring a kicked bot back. The incident message in the log channel and the DM to the server owner contain the bot's invite link for that.
- Exempt are the server owner, the whitelist and bots that are acting as offenders themselves. So whoever throws out a nuke bot is not punished.
/kickand/banthrough AlphaCloud also count for the member who uses the command.
Discord doesn't let bots prevent a kick or ban, so AlphaCloud reacts right after it. If AlphaCloud itself is removed, it can no longer react.
Response
| Setting | Meaning |
|---|---|
| Action for Users | What happens to a human attacker: quarantine, kick or ban |
| Action for Bots | The same for a bot, for example a compromised integration |
| Quarantine Role | Takes all other roles away from the attacker and blocks their view of the server |
| Notify Server Owner | DM to the owner as soon as an incident is detected |
Quarantine is the recommended setting for humans: the attack stops right away, but you can give the roles back if it was a false alarm. A ban is final.
Auto-Revert
Automatically restores channels and roles the attacker just deleted.
Adaptive Risk
Two values that push an attacker toward the threshold faster:
| Setting | Meaning |
|---|---|
| Fresh Admin Window (minutes) | Anyone who got a dangerous permission within this window is scored higher for every destructive action |
| New Account Threshold (days) | Discord accounts younger than this are scored higher |
Both are the classic signs of a hijacked account or one created just for the attack.
Fleet-Wide Threat Intelligence
AlphaCloud runs on thousands of servers. Two separate switches:
| Setting | Meaning |
|---|---|
| Report Offenders | Shares the Discord ID, trigger type and time of a confirmed attacker with the network |
| Use Network Reports | Raises the risk score of members who have already been reported elsewhere |
Emergency Lockdown
Locks down the entire server. Either Auto-Lockdown on Critical or manually with Lockdown Now. Lift Lockdown reverses it.
Incidents
At the bottom of the page you'll find the list of all incidents with the offender, threat score and action taken. Two buttons per entry:
- Pardon lifts the measure and restores the previous roles.
- Confirm Ban makes the sanction final.
The same buttons are also under the incident report in the log channel, so your team can react right in Discord.
Command
/lockdown locks the server or lifts the lockdown without you having to open the panel. The command is only available when Anti-Nuke is active.
Required permissions
Administrator is strongly recommended here. Anti-Nuke needs to manage roles, manage channels, ban, kick and read the Discord audit log, and do it faster than the attacker.