Discord Honeypot Channels: The Trap That Catches Hacked Accounts

Most Discord spam does not come from new accounts. It comes from real members whose accounts were taken over, usually by malware, and the first thing the account does is post the same link in every channel it can reach. By the time a moderator sees it, it has been in twelve channels and every direct message the account can open.

A honeypot channel is the cheapest possible answer to that. You create a channel that nobody has any reason to post in, tell your members not to post in it, and act on anyone who does. Real members read the notice and move on. Automated spam does not read anything.

The idea is not ours. A free, open source bot called Honeypot has been doing exactly this for a while and does it well. Tickety's version exists because most servers would rather not run a fifth bot for one channel, and because the interesting part is not the trap, it is what happens in the ten seconds after it trips.

Why it catches what filters and age gates miss

Discord already gives you two tools that sound like they should cover this, and both of them miss for the same structural reason.

Keyword filters read the message. AutoMod is genuinely good and you should use it, but it matches what a message says (AutoMod FAQ). Scam text is rewritten daily, domains rotate hourly, and characters get swapped for lookalikes specifically to get past word lists. You are playing a game where the other side moves last.

Verification levels and age gates read the account. They ask how old the account is, whether the email is verified, whether a phone number is attached (Verification Levels). A hacked account passes all of it. It is three years old, it has a verified email, a phone number, roles, and a message history in your server going back to last spring.

A honeypot reads neither. It reads behaviour: this account posted in a channel that every human was told not to post in. There is nothing to rewrite and nothing to age past. A sweeping bot posts everywhere it can, which is the entire tactic, and that tactic is what gives it away.

The cost of being wrong is also unusually low. There is no false positive class to speak of, because a legitimate member has no reason to be there and the channel says so at the top.

Where to put it

Placement is the difference between a trap that catches something in its first week and one that sits empty for a month.

• High in the channel list. Plenty of spam scripts do not enumerate every channel, they take the first few they can post in. A honeypot at the bottom of your ninth category will only catch the thorough ones.
• Visible to everyone, and postable by everyone. This is the one people get wrong. If you deny Send Messages to the members, nothing can trip the trap, and you have built an ordinary read only channel. Leave permissions alone. The notice is the lock, not the permission overwrite.
• Named like a channel, not like a trap. Something that reads as a real channel a bot would want to post in. Avoid naming it honeypot: it is the first word a spam script would skip.
• Not next to a channel people use. The one member you might catch is somebody who clicked one line too high in the sidebar. Put a separator or an unused category between it and your busiest channel.
• One is enough for most servers. More helps when your server is large enough that the top of the list looks different to different people. Tickety runs one bait channel on the free plan and up to five on premium.

What to make it do

Deciding what happens to the caught account matters more than it looks, because the account usually belongs to somebody who has done nothing wrong.

Action	What Discord does	Choose it when
Nothing	The trip is logged and counted, and nobody is touched.	You are testing placement, or you want a week of evidence before arming it.
Timeout	The account can read but cannot send, react or join voice until it expires (Time Out FAQ).	Small, close knit servers where you would rather stop the spam and talk to the person.
Kick	Removes the account. It can come back with any valid invite.	You want the account out now and the door left unlocked.
Softban	Bans and then immediately unbans. The ban is how you ask Discord to delete the account's recent messages; the unban is how you avoid keeping a victim locked out.	The default, and the right answer for most servers. The spam disappears everywhere at once and a cleaned up member can walk back in.
Ban	Removes the account, deletes its recent messages, and keeps it out.	Large or high value servers where an account that has already sprayed one link does not get a second chance.

Softban is the default in Tickety because it separates two decisions that servers usually make together. Deleting the spam is urgent. Deciding whether this person is welcome is not, and it should not be made automatically at three in the morning. Tickety purges the last hour of the account's messages by default and you can set that from nothing up to seven days, which is Discord's own ceiling on a ban (Discord developer docs).

The settings that stop it hurting real members

• Exemptions. Administrators are exempt by default, and you can exempt roles on top of that. Staff are the people most likely to poke the trap deliberately, and a bot that removes your own moderators gets uninstalled the same day.
• A direct message before the action lands. Order matters: the message has to go out while the account still shares a server with the bot. Tickety's message says which server, what happened, and links to the recovery guide, because the person reading it is about to need it and does not yet know why.
• An optional rejoin link. If you softban, hand them an invite. A member who cleans up their account and comes back the next day is the outcome you want, and the alternative is a support ticket for every catch.
• A log channel. Every trip, including exempt ones, with an Unban button on the entries where it applies. If Tickety could not carry out the action, the log says so, and the usual cause is its role sitting below the caught member's role.
• The notice in the channel itself. It is what turns the channel from a trick into a rule, and it carries a counter showing how many accounts have been caught. Members press it more often than you would expect.

Reading the numbers

Four figures, and each one means something different.

• Triggers is every trip, exemptions and failures included. It is the honest count of how often the trap is doing anything at all.
• Caught is the trips where an action landed. This is your real catch rate.
• Exempted is trips by somebody your configuration protects. A high number here usually means a staff role is curious, not that anything is wrong.
• Failed is trips where the action could not be carried out. It should be zero. If it is not, the bot's role is too low in the list or it is missing Ban Members, and fixing that turns every future failure into a catch.

A trap that catches nothing for a month is not broken. It is a smoke alarm, and the reasonable reaction to a quiet smoke alarm is not to remove it. What is worth watching is the shape: catches arrive in bursts, because compromised accounts arrive in waves whenever a phishing campaign lands. A day with six catches usually means six of your members clicked the same thing.

Setting one up with Tickety

The honeypot is free, all of it: the trap, every action, exemptions, the notice, the direct message, the counter, the log channel and the rejoin link. A safety feature that costs money does not get installed, and the server that skipped installing it is the one that gets raided.

1. Add Tickety to your server, or open the dashboard if it is already there.
2. Go to the Honeypot module in your server dashboard. Create the bait channel or point it at one you already have. Tickety refuses politely if it cannot see or post in the channel, which saves you a silent failure later.
3. Pick the action. Leave it on softban unless you have a reason.
4. Check that Tickety's role sits above the roles it needs to act on, and that it has Ban Members.
5. Watch the log channel for a week before you tune anything.

Premium adds more bait channels, custom message layouts, quoting the offending message in the log, and adding the caught account to your server blocklist so it cannot open a ticket or enter a giveaway if it returns. None of that is the trap. The trap is free.

What a honeypot will not do

It catches accounts that spray channels. It does not catch a person who posts one scam link in general chat and stops, it does not see direct messages, and it cannot act on somebody whose highest role sits above the bot's. It is one layer. Run it next to AutoMod, a sensible verification level, and a way for members to report things quietly.

What it does do is close the window between an account being taken and your server finding out, from however long it takes a moderator to wake up down to a few seconds, at the cost of one empty channel. Add Tickety and set one up.