> ## Documentation Index > Fetch the complete documentation index at: https://docs.phishy-app.xyz/llms.txt > Use this file to discover all available pages before exploring further. # Phishy User Guide # Phishy User Guide Phishy is a Discord bot that protects your server from phishing links, scam images, and compromised accounts. It watches messages in your server and removes known threats automatically. If you turn it on, it can also isolate a member whose account looks compromised, so they can't spread scams while your team looks into it. This guide covers adding Phishy to your server, setting it up, every command, and the web dashboard. *** ## Contents 1. [Adding Phishy to your server](#adding-phishy-to-your-server) 2. [Setting up Phishy](#setting-up-phishy) 3. [What Phishy protects against](#what-phishy-protects-against) 4. [Scam alerts](#scam-alerts) 5. [Quarantine](#quarantine) 6. [Commands](#commands) 7. [The web dashboard](#the-web-dashboard) 8. [Plans and pricing](#plans-and-pricing) 9. [Troubleshooting](#troubleshooting) 10. [Privacy, terms and support](#privacy-terms-and-support) *** ## Adding Phishy to your server You can add Phishy to any server where you are the **owner**, or where you have the **Administrator** or **Manage Server** permission. 1. Go to the Phishy website at [phishy-app.xyz](https://phishy-app.xyz). 2. Sign in with Discord and open the **Dashboard**. 3. Under **Add Phishy**, find your server and click **Invite**. 4. Approve the permissions Discord asks for. ### Permissions Phishy needs | Permission | Why Phishy needs it | | - | - | | **Manage Messages** | To delete messages that contain scams or phishing links. | | **Manage Roles** | To create the Quarantine role, and to remove and restore a quarantined member's roles. | | **Manage Channels** | To create the `#quarantine` channel and hide your other categories from quarantined members. | | **View Channels / Read Message History** | To see the messages it needs to check. | > **Important:** Phishy can only manage members whose highest role is **below** Phishy's own role. After inviting Phishy, go to **Server Settings → Roles** and drag Phishy's role as high as you can, ideally above all of your member and moderator roles. *** ## Setting up Phishy Once Phishy is in your server, run `/setup` to choose how it behaves. Only members with the **Ban Members** permission can run this command. ```text theme={null} /setup channel:#mod-alerts urlcheck:True autoquarantine:True ``` | Option | Required | What it does | | - | - | - | | `channel` | Yes | The text channel where Phishy posts scam alerts. Pick a private channel your moderators can see. | | `urlcheck` | Yes | Turns link scanning on (`True`) or off (`False`). When it's on, Phishy deletes messages that contain links to known phishing sites. | | `autoquarantine` | Yes | When this is `True`, Phishy automatically quarantines any member who posts a detected scam. See [Quarantine](#quarantine). | You can run `/setup` again at any time to change your settings. Each run replaces your previous settings. ### What happens when you turn on auto-quarantine If you set `autoquarantine` to `True`, Phishy also does the following: * It creates a **Quarantine** role (shown in dark red). * It creates a private **#quarantine** channel. Only quarantined members (and Phishy) can see it, so you can use it to talk with a member while they are isolated. * It hides every category in your server from the Quarantine role, so quarantined members can't see your normal channels. * It also hides any **new** categories you create later from the Quarantine role automatically. > **Note:** Channels that don't sync their permissions with their category, and channels that aren't in a category, are not hidden automatically. Check those channels and deny **View Channel** to the Quarantine role yourself. Auto-quarantine needs the **Manage Roles** and **Manage Channels** permissions. If Phishy is missing either one, `/setup` tells you which permission to grant. You can also run `/setup` with auto-quarantine turned off. > **Tip:** Don't rename the **Quarantine** role. Phishy finds the role by its name. *** ## What Phishy protects against Phishy checks every message posted in channels it can see. ### Phishing links *This check only runs when `urlcheck` is turned on.* Phishy checks every link in a message against a regularly updated list of known phishing websites. It also catches subdomains of those sites (for example, `login.scam-site.com` when `scam-site.com` is on the list). It finds links whether they're posted as plain links, hidden behind text, or posted with embeds turned off. When Phishy finds a phishing link, it: 1. **Deletes the message** right away. 2. **Quarantines the author**, if auto-quarantine is turned on. 3. **Posts an alert** in your alert channel (supporter and partner servers). ### Known scam images Phishy keeps a growing list of known scam images, such as fake Nitro giveaways, fake crypto promotions and malicious QR codes. Every image posted in your server is compared against that list. Phishy can also recognise a known scam image after it has been cropped, resized or slightly edited. When an image matches a known scam, Phishy: 1. **Deletes the message** right away. 2. **Quarantines the author**, if auto-quarantine is turned on. 3. **Posts an alert** that includes a copy of the removed image (supporter and partner servers). ### New and unknown scam images Scammers keep making new images. When an image doesn't match a known scam, Phishy checks it with automated scam detection. This check gives the image a score from **1 to 10**, where 10 means it is very likely a scam. When an image scores **7 or higher**, Phishy: 1. **Quarantines the author**, if auto-quarantine is turned on. 2. **Posts an alert** with the score and the reason it was flagged (supporter and partner servers). 3. Sends the image to the Phishy team for review. If we confirm it's a scam, we add it to the known scam image list, and Phishy will then delete it automatically in every server. > **Note:** For new and unknown images, Phishy does **not** delete the message automatically, because automated detection can sometimes be wrong. A moderator should review the alert and delete the message if it's a scam. *** ## Scam alerts Alerts are posted in the channel you chose with `/setup`. Alerts are a **supporter and partner** feature. See [Plans and pricing](#plans-and-pricing). There are three kinds of alert: | Alert | When it's posted | | - | - | | 🔗 **Phishing Link Removed** | A message with a known phishing link was deleted. | | 🚫 **Blacklisted Scam Image Removed** | A message with a known scam image was deleted. | | ⚠️ **AI Scam Detection Alert** | A new image looks like a scam (score 7/10 or higher). The message has **not** been deleted. | Each alert contains: * **Probability:** how sure Phishy is. This can be "Known phishing domain", a match percentage for known images, or a score out of 10 for new images. * **Author:** the member who posted the message. * **Reason:** why the message was flagged. For links, this includes the link itself. * **Message:** a link to the message, or a note that it was deleted. If the message still exists, the alert has a **Jump to Message** button. * **Auto-Quarantine:** shown when auto-quarantine is on. It says whether the author was quarantined, and the reason if quarantine failed. * **Image:** the flagged image, when there is one. *** ## Quarantine Quarantine isolates a member, for example when their account has been hacked and is posting scams. Quarantine is not a ban. The member stays in your server, but can only see the `#quarantine` channel until a moderator releases them. ### What happens when a member is quarantined * All of their roles are removed and replaced with the **Quarantine** role. * Phishy saves the roles they had, so it can give them back later. * Roles that Discord manages, such as **Server Booster** or roles that belong to other bots, are left in place. Discord doesn't allow bots to remove these. * The quarantine is recorded with the reason and the person (or Phishy) who issued it. It appears on the [web dashboard](#the-web-dashboard). A member can be quarantined in two ways: * **Automatically**, when auto-quarantine is turned on and they post a detected scam. * **Manually**, when a moderator runs `/quarantine`. ### Releasing a member Run `/unquarantine` to release a member. Phishy removes the Quarantine role and gives back the roles the member had before. Phishy will skip a role if: * The role has since been deleted. * The role is now above Phishy's own role. Phishy tells you how many roles it restored and how many it skipped. If it skipped any roles, you'll need to give those back to the member yourself. > **Tip:** Before you release a member, make sure they have secured their account. They should change their password, turn on two-factor authentication, and log out of all other devices. *** ## Commands All Phishy commands are slash commands. The table below shows who can use each command by default. Server admins can change this in **Server Settings → Integrations → Phishy**. | Command | Default access | Description | | - | - | - | | `/setup` | Ban Members | Choose your alert channel and turn link scanning and auto-quarantine on or off. | | `/quarantine` | Moderate Members | Manually quarantine a member. | | `/unquarantine` | Moderate Members | Release a member from quarantine and give back their roles. | | `/supporter` | Ban Members | Check this server's subscription status. | | `/ping` | Everyone | Check that Phishy is online and how quickly it's responding. | ### `/setup` ```text theme={null} /setup channel: urlcheck: autoquarantine: ``` See [Setting up Phishy](#setting-up-phishy). ### `/quarantine` ```text theme={null} /quarantine user: reason: ``` This command quarantines a member. If you don't give a reason, Phishy uses "No reason provided". Only you can see Phishy's reply. Phishy will refuse to quarantine a member if: * `/setup` has not been run with auto-quarantine turned on, so the Quarantine role doesn't exist. * The member is already quarantined. * The member's highest role is the same as or above Phishy's role. * Phishy is missing the **Manage Roles** permission. ### `/unquarantine` ```text theme={null} /unquarantine user: reason: ``` This command releases a quarantined member and gives back the roles they had before. If Phishy has no record of the member's earlier roles, it only removes the Quarantine role. This can happen if someone gave the member the Quarantine role by hand. ### `/supporter` This command shows whether your server is a **Partner**, has an active **Supporter** subscription, or has no subscription. ### `/ping` This command shows how long Phishy took to respond, so you can check that it's online and working. *** ## The web dashboard The dashboard at [phishy-app.xyz/dashboard](https://phishy-app.xyz/dashboard) lets you manage Phishy from your browser. ### Signing in Click **Log in** and approve the request in Discord. Phishy only asks to see your basic profile and the list of servers you're in. It can't read your messages or act on your behalf. Click **Log out** at the top of the dashboard to sign out. ### Your servers The dashboard lists every server you own, or where you have **Administrator** or **Manage Server**: * **Protected by Phishy:** servers where Phishy is already installed. Click a server to manage it. * **Add Phishy:** servers you manage that don't have Phishy yet. Click **Invite** to add it. ### Server page Each server page shows: * **Plan:** *Not Premium*, *Pro* or *Partner*. If your server isn't on a paid plan, the **Upgrade to Pro** button opens a secure checkout. * **Overview tab:** member count, online count, server ID, server owner, and the date the server was created. * **Quarantined Users tab:** every member who is currently quarantined, with the reason and the date and time they were quarantined. *** ## Plans and pricing | | **Community** | **Pro Shield** | | - | - | - | | Price | Free | \$5 / month per server | | Phishing link removal | ✓ | ✓ | | Known scam image removal | ✓ | ✓ | | Quarantine and auto-quarantine | ✓ | ✓ | | Detection of new scam images | ✓ | ✓ | | Scam alerts in your own channel | — | ✓ | | Priority support | — | ✓ | **Partner** servers are servers that work closely with the Phishy team. They get all Pro Shield features at no cost. ### Upgrading 1. Open your server on the [dashboard](#the-web-dashboard). 2. Click **Upgrade to Pro** and complete checkout. 3. Your server is upgraded as soon as payment is confirmed. Run `/supporter` in your server to check. ### Cancelling You can cancel your subscription at any time. When it ends, your server moves back to the Community plan. Payments are non-refundable unless the law requires a refund. *** ## Troubleshooting **Phishy isn't posting alerts.** * Alerts are only posted for supporter and partner servers. Run `/supporter` to check your plan. * Make sure you've run `/setup`, and that the alert channel still exists. * Make sure Phishy can **view** and **send messages** in the alert channel. **Phishy isn't deleting phishing links.** * Link scanning is off by default. Run `/setup` with `urlcheck:True`. * Make sure Phishy has **Manage Messages** in that channel. **"The `Quarantine` role does not exist."** Run `/setup` with `autoquarantine:True`. If you renamed the Quarantine role, change its name back to **Quarantine**. **"I cannot quarantine this user because their highest role is above or equal to my highest role."** Go to **Server Settings → Roles** and move Phishy's role above the member's highest role. Phishy can't quarantine the server owner. **"An error occurred during setup. Make sure my bot role is at the top of the hierarchy."** Move Phishy's role higher in **Server Settings → Roles**, then run `/setup` again. **Quarantined members can still see some channels.** Find any channel that is outside a category, or that doesn't sync with its category. Give it a permission overwrite that denies **View Channel** to the Quarantine role. **Some roles weren't given back after `/unquarantine`.** Those roles were deleted, or they're above Phishy's role. Give them back to the member yourself. **Phishy flagged something that isn't a scam, or missed a scam.** Let us know through the [Contact page](https://phishy-app.xyz/contact) and choose **Report a False Positive/Negative**. *** ## Privacy, terms and support * **Privacy:** Phishy only processes messages and images briefly, to check them for threats. We only keep content that is flagged as malicious, and we never sell your data. Read the full [Privacy Policy](https://phishy-app.xyz/privacy). * **Data deletion:** Server administrators can ask us to delete their server's data at any time. Use the [Contact page](https://phishy-app.xyz/contact) and choose **Data Deletion Request**. * **Terms:** Using Phishy means you agree to the [Terms of Service](https://phishy-app.xyz/terms). Phishy greatly reduces risk, but no tool catches every threat. * **Support:** Reach us through the [Contact page](https://phishy-app.xyz/contact) or the Phishy Support Discord server. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.