C.A.R.L SCAN

Check suspicious files, links and servers without leaving Discord.

Got a random file in your DMs, a link you don’t trust, or an invite to a server you’ve never heard of? You don’t need to open a browser and search around. C.A.R.L Scan checks it for you, right in the chat.

You can use it three ways: slash commands, right-clicking a message and choosing Apps, or sending a file or link straight to the bot in a DM.

Link check: /info or /read Opens the link from the bot’s side so you don’t have to. It shows where the link really goes (every redirect), what’s on the page, and scam warning signs like fake logins, fake captchas and IP loggers.

File inspection: /inspect Looks inside a file without running it.

Mods (.jar): finds downloaders and account/password stealers. Scripts: finds token grabbers, reverse shells and hidden code, then unscrambles the code and explains what it does. Zip files: opens every program, script and jar inside and checks each one. It also catches disguised files (like an .exe named .png), Office macros, PDFs that run code, dangerous shortcuts and password-protected archives. In pictures, it reads QR codes and checks the link inside.

Deep analysis: /deepscan Runs Modrinth, abuse.ch and Hybrid Analysis together and gives you one section for each. It only looks the file up and never uploads it. You can also pick a single service from the source dropdown:

Modrinth: is this an official upload? A good sign for mods. abuse.ch: is it a known malware sample or link? Hybrid Analysis: shows the sandbox report.

Server link check: /servercheck Paste a discord.gg invite to see the server’s name, age, size and badges. It warns you about brand-new servers and bait wording, and it never joins the server.

Decode and explain: /decode and /explain /decode unscrambles hidden text (base64, hex, character codes) and shows what was hidden. /explain takes a command or script, explains what it does step by step in plain English, and points out the exact lines that look risky. It reads Python, JavaScript/TypeScript, PowerShell, batch, shell, VBScript/VBA, C#, Java, Kotlin, C/C++, Go, Rust, PHP, Ruby, Perl, Lua/Luau, AutoHotkey/AutoIt, SQL and more.

VirusTotal scan: /scan (invite only) Checks a file or link against 70+ antivirus engines. VirusTotal limits how many scans the bot can run each day, so the bot owner approves who can use it. /queue shows who’s waiting and how much quota is left today. All the other commands work for everyone and don’t use this quota.

Good to know

Each command takes up to 3 files and 2 links, with files up to 250 MB. Your pictures, videos and audio are never uploaded or looked up. We don’t store your files or links. “No detections” doesn’t guarantee a file is safe. Use your judgment too.

Add it to your server to protect your community, or install it as a user app and use it anywhere. Run /commands to see the full list.