howie.lol
Howie is still in development. These docs describe how Howie works at launch. Details may change over time.
The scams Howie looks for, how it decides and what it does about them.
Scam types
| Type | What it looks like | Status |
|---|---|---|
| Casino and crypto giveaways | Screenshots of a celebrity, often MrBeast, "giving away" money through a casino or crypto site, usually with a promo code and a fake withdrawal screen. | Available |
| Fake Nitro and Steam gifts | "Free Nitro" or "Steam gift" links that lead to look-alike login pages. | Planned |
| QR-code login scams | "Scan to verify" or "scan for a reward" QR codes that log the scammer into the victim's account. | Planned |
| Invite and adult-content spam | Invites to other servers promising leaks, adult content or free stuff. | Planned |
Planned types appear in /setup once Howie has enough real examples to catch them reliably.
How detection works
Howie runs cheap checks first and stops as soon as it's confident.
1. AutoMod
Howie keeps Discord AutoMod keyword rules updated with known scam domains and phrases. Discord blocks matching messages before they post. AutoMod checks text only and limits how many rules a server can have, so Howie fills it with the scam terms that do the most damage.
2. Scam links
Casino and crypto giveaway scams are always screenshots, so Howie only checks posts that include an image. In the message itself, it only looks for links to known scam domains, whether pasted or behind a named link. It ignores the rest of the message, so ordinary chat about casinos or promo codes is never flagged.
3. Image fingerprints
For each image, Howie computes two kinds of fingerprint:
- Exact: a SHA-256 hash, which matches a byte-for-byte copy of a known scam image.
- Perceptual: dHash and aHash, which match images that look the same after resizing, recompression or small edits. Howie compares them by how many bits differ and only counts close matches.
Fingerprints are checked against a shared list of confirmed scam images. When Howie confirms a scam image in one server, every server catches it on the first post.
4. Text inside images
Many scam posts are re-cropped or recompressed copies of screenshots Howie already knows, and hijacked accounts usually post the same screenshot in several channels at once. In those two cases, Howie reads the text inside the image to confirm, checking for known scam domains, phrases and combinations of words, such as "promo code" next to "withdraw." It normalizes the text first, so tricks like extra spaces, symbols and look-alike characters don't hide a match. Common words like "casino" or "crypto" are never enough on their own, so ordinary screenshots that mention them are left alone.
Scoring
Every match adds points. An exact fingerprint match or a known scam domain is enough on its own. Weaker signals, like the word "casino," need company. Howie acts only when the total shows it's confident the post is a scam. If the evidence falls short, Howie leaves the post alone.
Bursts
A hijacked account usually posts the same scam in many channels within seconds. Howie treats the whole burst as one event: it checks the first copy, applies one verdict and cleans up every copy.
Speed
Howie's targets are under 1 second for known scams and under 3 seconds for new variants, measured from when Discord delivers the message.
Actions
| Action | What happens |
|---|---|
| Ban | Bans the account and deletes the scam posts. |
| Kick | Kicks the account and deletes the scam posts. The account can rejoin with a new invite. |
| Timeout | Gives the account a 1-hour or 24-hour timeout and deletes the scam posts. A 1-hour timeout is the default. |
| Delete only | Deletes the scam posts and leaves the account alone. |
Hijacked accounts belong to real people who usually get them back. A timeout or kick gives them a way back in after they secure the account. Ban is the strongest option. Howie DMs the account a link to its appeal page, where the owner can undo Howie's ban, kick or timeout in every server that allows appeals once they've secured the account. Howie never undoes a moderator's own action. See Appeals for the limits and how to turn appeals off.
Reports
If you turn reports on, Howie posts one to your chosen channel each time it acts. A report includes:
- The account's username and ID, the channel and the message ID.
- The action Howie took, or why it couldn't act, such as a missing permission or role position.
- The detection score.
When someone appeals one of Howie's actions in your server, your report channel also gets a card saying how it went: Howie undid it, couldn't undo it (with the reason), left it alone because a moderator has since acted, or didn't undo it because the appeal page's limits stopped it. In that last case, you can still lift it yourself if you trust them.
Reports never include the scam itself. Howie doesn't repost the images or the message text, so your report channel can't turn into a second copy of the scam.
Near misses aren't posted to server report channels. Signals stay in Howie's private diagnostics.
If your moderators want to see exactly what was posted, add a bot that logs deleted messages, such as Dyno or MEE6. Messages Howie deletes show up in its log like any others.
Reports are optional. Even with them off, every ban, kick, timeout and deletion Howie makes appears in your server's Audit Log, under Server Settings, with Howie listed as the one who did it.
What gets shared between servers
Only fingerprints of scam images, the scam type and how often they've been seen. Never user IDs, usernames, message text or which server a detection came from.
Fingerprints from exact or known-signature matches are shared right away. Fingerprints from fuzzy matches are shared only after Howie confirms them in at least three separate servers, or after a review, so one mistake can't spread.