wiretrip

What is wiretrip?

Self-bots multitask in ways humans physically can't. They fire typing indicators across five channels in the same millisecond, send message bursts to three rooms before a human could finish a single word. Wiretrip watches the timing. That's it.

No message content is read. No privileged intents. The bot never sees what anyone wrote, only when events arrived and across how many channels.

How it catches them

Every typing event gets timestamped. If the same user triggers activity in two different channels within the correlation window (150ms by default), that's a detection. A score accumulates: faster bursts score higher, more channels involved scores higher, fresh accounts score higher.

Messages work the same way. And if you mark one channel as a "canary" (a room that should never see normal traffic), any message there triggers an immediate flag, no timing analysis needed.

Enforcement modes

Log – passive. Detections appear in your log channel, nothing gets banned. Run this for a week first, see what it finds.

Enforce – auto-ban when the score crosses your threshold. 7-day message purge on ban.

Timeout – auto-mute instead of ban. Duration is configurable.

Hybrid – your moderators get a card with a one-click ban button. The detection is logged, the human decides.

Safe by default

Every server starts in log mode. Nothing gets banned automatically until you choose to switch. /wiretrip test posts a synthetic detection so you can see what the cards look like before anything real happens.

Commands

• /wiretrip setup – guided configuration panel
• /wiretrip status – current mode, thresholds, permission check
• /wiretrip history – recent detections with scores
• /wiretrip stats – lifetime pipeline counters

Technical

Written in Rust. No external ML services. No message content, no member list intent. Uses GUILDS, GUILD_MESSAGES, and GUILD_MESSAGE_TYPING only. Detection runs locally, sub-millisecond response.

website DF