Reddit, Discord, or 4chan Brigading, Doxxing, and Deepfake Harassment Campaign: Locking Subreddits, AutoMod Regex, and Cloudflare Under Attack Mode¶

Discovering that your name, community, or small business has been posted as a target thread on an anonymous imageboard, raid forum, or hostile chat group is a high-velocity digital and physical safety crisis. Within minutes of a target thread going live, hundreds of coordinated accounts execute simultaneous cross-platform attacks: flooding your Discord server with bot-join waves and malicious framing content, brigading your Reddit community with vote manipulation and slur spam, uploading non-consensual AI deepfakes, publishing your home address and family telephone numbers (doxxing), and launching Layer-7 HTTP floods against your personal or company website. If anyone in your household faces immediate physical threats, armed harassment, or a suspected swatting call, dial your local emergency services immediately using our global emergency numbers directory, and pair this technical lockdown guide with our online harassment, doxxing, and cyberbullying, viral false accusation, cancel mob, and digital lockdown, and Discord server or community raid recovery guides.

Stopping a coordinated multi-platform raid requires shifting from manual human moderation to automated perimeter rejection inside the first 15 minutes. A human moderator team cannot click ban buttons faster than a Python script rotating residential proxies and disposable accounts. By engaging Discord's native Raid Protection and regex AutoMod filters, locking your Subreddit to Approved Users with strict Crowd Control, placing your web domains behind Cloudflare's "I'm Under Attack" JavaScript and Turnstile challenges, and capturing court-admissible cryptographic evidence (WARC web archives and SHA-256 digests) before attackers delete their coordination threads, you neutralize their operational advantage and protect your physical safety.

Do this now¶

1. Lock down your Discord server in 15 seconds using "Pause Invites" and "Pause DMs." Click your Server Name at the top left of Discord -> select Security Actions (or Server Settings -> Safety Setup -> Raid Protection) -> check both Pause Invites and Pause DMs for 24 Hours. Next, go to Server Settings -> Roles -> Default Permissions (@everyone) and toggle OFF Send Messages, Send Messages in Threads, Attach Files, Embed Links, Add Reactions, Create Public/Private Threads, and Mention @everyone, @here, and All Roles.
2. Switch your Reddit community (Subreddit) to "Restricted" or "Private" and set Crowd Control to "Strict." Open Mod Tools -> Community Type and slide the selector from Public to Restricted (only approved users can post or comment) or Private (only approved users can view the community) to cut off the brigade's oxygen. Immediately open Mod Tools -> Safety Filters -> Crowd Control and set both Post Level and Comment Level to Maximum / Strict, and enable the Ban Evasion Filter and Harassment Filter.
3. Turn ON Cloudflare "Under Attack Mode" and block direct origin IP connections on your personal or business website. Log into the Cloudflare Dashboard, select your domain, and toggle Under Attack Mode to ON on the Overview quick-actions sidebar. This forces every visitor to pass an interstitial JavaScript computation and browser-integrity challenge before reaching your web server, stopping automated HTTP POST form spam, credential stuffing, and bandwidth exhaustion dead in their tracks.
4. Call your local police non-emergency dispatch desk to place a proactive "Swatting / Premise Alert" on your residential address. If raiders have published your home address on a forum or imageboard, call your local police department's administrative or non-emergency dispatch line immediately. Explain calmly that you are the victim of an active online doxxing and harassment raid and request a Premise History Note / Swatting Advisory on your physical address requiring dispatchers to verify any 911/999/112 hostage or shooting call at your residence via your mobile number before deploying tactical units.
5. Preserve the attackers' coordination threads using Archive.today, Browsertrix / ReplayWeb.page (WARC), and SHA-256 cryptographic hashing BEFORE reporting them for deletion. Imageboard threads (4chan, Soyjak, Kiwi Farms, rogue Telegram channels) auto-prune (404) or get deleted by operators once reported. Capture full-page PDFs, raw HTML source code, HTTP response headers, and WARC archives immediately and log their SHA-256 file hashes so law enforcement and civil attorneys have verifiable chain-of-custody evidence.
6. Lock your personal social media profiles, revoke public telephone/address lookup listings, and enable a Verbal Family Safe-Word. Set personal Instagram, X (Twitter), Facebook, TikTok, and LinkedIn accounts to Private / Locked, hide your friend and follower lists, and give your parents, partner, and employer a secret Verbal Codeword so they never fall for AI voice-cloned emergency phone calls or spoofed emails claiming to come from you.

Decision tree: Triaging a coordinated cross-platform raid and harassment campaign¶

Use this operational triage tree during the first 15 minutes to isolate each attack surface in priority order: physical safety first, community platforms second, web infrastructure third, and forensic evidence fourth.

flowchart TD
    RaidAlert["Coordinated Raid, Doxxing Thread, or Deepfake Attack Detected"] --> PhysicalCheck{"Has Your Home Address, Phone, or Workplace Been Doxxed?"}
    PhysicalCheck -->|"Yes: Physical Address or Family Targeted"| PoliceAlert["STEP 1: Call Local Police Non-Emergency Line to Place Swatting Premise Alert -> Freeze Credit Bureaus -> Warn Employer HR & Family With Safe-Word"]
    PhysicalCheck -->|"No: Digital Platforms & Communities Only"| PlatformTriage["STEP 1: Identify Targeted Platforms (Discord, Reddit, Web Domain, Social Media)"]
    PoliceAlert --> PlatformTriage
    PlatformTriage --> DiscordNode["DISCORD SERVER: Enable 'Pause Invites' & 'Pause DMs' -> Strip @everyone Send/Attach/Webhook Perms -> Deploy AutoMod Regex & Highest Phone Verification"]
    PlatformTriage --> RedditNode["REDDIT SUBREDDIT: Set Community to Restricted/Private -> Crowd Control to Maximum -> Deploy AutoMod Account-Age/Karma Gate & Regex Slur/Doxx Filter"]
    PlatformTriage --> WebNode["PERSONAL / COMPANY WEBSITE: Enable Cloudflare 'Under Attack Mode' -> Add WAF Geo/ASN/Rate-Limit Rules -> Rotate Origin Server IP & Lock Contact Forms"]
    DiscordNode --> DeepfakeCheck{"Are Attackers Posting Deepfakes or Non-Consensual Imagery?"}
    RedditNode --> DeepfakeCheck
    WebNode --> DeepfakeCheck
    DeepfakeCheck -->|"Yes: Synthetic NCII or Impersonation"| NCIITakedown["Hash Images at StopNCII.org / TakeItDown.ncmec.org -> File Emergency DMCA & Platform NCII Takedowns -> File Police Report"]
    DeepfakeCheck -->|"No: Spam, Defamation, or DDoS"| EvidenceLock["Capture WARC Archives, Full-Page Screenshots, & SHA-256 Hashes of Source Raid Threads Before Reporting for Removal"]
    NCIITakedown --> EvidenceLock

Part 1: Locking down a Discord server in 15 seconds (Raid Mode, AutoMod Regex, and Wick)¶

When an imageboard thread drops a Discord invite link or targets a community server, raiders use two simultaneous methods: human raiders joining to post shock imagery, doxxing data, or false Terms-of-Service framing material, and automated Python/Golang token raid tools firing 50 requests per second through residential proxies.

1. The 15-Second Discord Emergency Perimeter Lock¶

Execute these exact clicks in order to seal the server perimeter immediately:

+-------------------------------------------------------------------------+
|               DISCORD 15-SECOND EMERGENCY RAID LOCKDOWN                 |
+-------------------------------------------------------------------------+
| [00:03s] Server Name -> Security Actions -> [X] Pause Invites (24h)     |
|                                          -> [X] Pause DMs (24h)         |
| [00:08s] Server Settings -> Safety Setup -> Verification Level: HIGHEST |
|          (Requires Verified Phone Number on Discord Account)            |
| [00:12s] Server Settings -> Roles -> @everyone -> Clear Permissions     |
|          (Toggle OFF: Send Messages, Attach Files, Embed Links,         |
|           Add Reactions, Create Threads, Mention @everyone)             |
| [00:15s] Server Settings -> Integrations -> Webhooks -> Delete Unknown  |
+-------------------------------------------------------------------------+

1. Engage Pause Invites and Pause DMs:
2. Pausing invites disables every permanent invite code, temporary link, and your Server Tier 3 custom Vanity URL (discord.gg/yourname) simultaneously without deleting the links. Raiders clicking the link on the imageboard receive an instant "Invites are currently paused for this server" rejection.
3. Pausing DMs prevents accounts that slipped into the server prior to the lock from sending unsolicited direct messages containing malware, gore, or doxxed residential addresses to your community members.
4. Lock Channel-Specific Permission Overrides (The #general Override Trap):
5. If a channel like #general has a local Green Checkmark (Allow) set for @everyone on Send Messages, global role changes will not mute that channel. Right-click the channel -> Edit Channel -> Permissions -> @everyone, click the Red X (Deny) on Send Messages, Send Messages in Threads, and Add Reactions, and set Slowmode to 6 Hours.
6. Disable Reaction Harassment (Add Reactions & Use External Emoji):
7. Raiders often spell out slurs or doxxing initials under #announcements posts using letter emojis when chat is locked. Make sure both Add Reactions and Use External Emoji are toggled OFF on @everyone globally and inside #announcements overrides.

2. Copy-Paste Discord AutoMod Regex Filters (Blocking Doxxing, Slurs, and Raid Links)¶

Discord's native AutoMod (Server Settings -> Safety Setup -> AutoMod) evaluates messages on Discord's backend servers before they render in chat. Even if a sleeper account has permission to speak, AutoMod blocks the message at the gateway level, logs the attempt to your private #mod-log channel, and applies an automatic 24-hour Timeout.

Create custom AutoMod Keyword & Regex Rules (using Rust-flavor regular expressions) for these four raid vectors:

Also configure Discord's built-in Block Mention Spam rule inside Safety Setup -> AutoMod: set the limit to 3 unique mentions per message with Block Message + 24-Hour Timeout.

3. Configuring Verification Gates and Anti-Nuke Bots (Wick, DoubleCounter, or Native Onboarding)¶

If you must reopen your Discord server while a slow-burn harassment campaign continues for weeks: 1. Place all newly joined accounts into an isolated Quarantine / Verification Zone: - Make sure the @everyone role can see zero community channels. - Require new members to pass either Discord's native Phone-Verified Onboarding + Server Rules Screening or a dedicated anti-alt/anti-proxy verification bot (such as Wick or DoubleCounter, which detect VPN/datacenter ASN proxies and flag browser fingerprint alt-accounts) before receiving the @Member role. 2. Never trust a "QR Code Verification" prompt: Remind your members via a pinned announcement that legitimate verification bots never ask users to scan a QR code with the Discord mobile app.

Part 2: Locking down a Reddit community (Subreddit) against brigading and doxxing¶

When a subreddit (r/YourCommunity) is linked from an external site, a hostile rival subreddit, or an off-site chat group, raiders flood the new queue with gore, deepfakes, or personal information while mass-downvoting legitimate threads and abusing the "Reddit Cares" (u/RedditCareResources) self-harm reporting button to harass moderators.

1. The 4-Step Subreddit Emergency Shield¶

1. Flip Community Type to Restricted or Private (Mod Tools -> General Settings -> Community Type):
2. Restricted: Everyone can still read existing posts, preventing raiders from claiming they took down your community, while only Approved Users can submit new posts or comments.
3. Private: Hides all posts, comments, and moderator usernames on the sidebar from non-approved accounts.
4. Set Crowd Control to Maximum (Mod Tools -> Safety Filters -> Crowd Control):
5. Turn ON Crowd Control for Posts and Comments at the Strict level, and toggle ON Hold crowd-controlled comments for review. This automatically holds submissions from accounts with negative subreddit karma, brand-new Reddit accounts, and users who have not joined your subreddit.
6. Enable Harassment Filter and Ban Evasion Filter (Mod Tools -> Safety Filters):
7. Set Ban Evasion Filter to High + Moderate Confidence (Within the last year) and select Filter (Hold in Mod Queue) to catch banned raiders spinning up throwaway alt accounts via Reddit's server-side device fingerprinting and IP telemetry.

2. Copy-Paste Reddit AutoModerator YAML Emergency Raid Rules¶

Open https://www.reddit.com/r/YOURSUBREDDIT/about/wiki/config/automoderator and paste these YAML blocks at the top of your configuration:

---
# RULE 1: EMERGENCY BRIGADE LOCKDOWN GATE (Blocks non-established accounts)
type: any
author:
    account_age: "< 60 days"
    comment_karma: "< 100"
    combined_subreddit_karma: "< 15"
    is_contributor: false
    satisfy_any_threshold: true
action: filter
action_reason: "RAID LOCKDOWN: New account or low karma [{{match}}]"
---
# RULE 2: ANTI-DOXXING & RAID LINK INTERCEPTOR (Silent Removal + Modmail Alert)
type: any
title+body (regex, includes):
    - '\b(?:\+?1[-.\s]?)?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}\b'
    - '(?i)\b(?:victim_last_name|victim_street_name|victim_employer)\b'
    - '(?i)(?:kiwifarms|4chan\.org|4channel\.org|soyjak|t\.me/)'
action: remove
action_reason: "DOXXING / RAID LINK INTERCEPTED: [{{match}}]"
modmail_subject: "URGENT: AutoMod Blocked Doxxing / Raid Link by /u/{{author}}"
modmail: "Removed {{kind}} by /u/{{author}} matching [{{match}}]. Permalink: {{permalink}}"
---
# RULE 3: MASS-REPORT BRIGADE PROTECTION (Prevents auto-removal of mod announcements)
type: any
reports: 5
author:
    is_moderator: false
action: filter
action_reason: "High report volume (5+ reports) held for review"
---
# RULE 4: SHADOW-FILTER KNOWN TROLL ACCOUNTS WITHOUT TIPPING THEM OFF
type: any
author:
    name: ["RaiderAccountOne", "RaiderAccountTwo"]
action: remove
action_reason: "Silent shadow-filter on active raid account"
---

3. Stopping "Reddit Cares" Abuse and Escalating to r/ModSupport¶

• Blocking u/RedditCareResources Harassment: Open the message from u/RedditCareResources, click Report this message (which flags the false reporter's account for report abuse), and reply STOP.
• Escalating to Reddit Admins: Send a Modmail to r/ModSupport (https://www.reddit.com/message/compose?to=/r/ModSupport&subject=Active+External+Brigade+and+Doxxing+Emergency) with archived links to the external raid thread, 10 to 20 brigading usernames/permalinks, and the UTC start time so Reddit's Safety team can apply subreddit brigade shields and suspend sockpuppet clusters.

Part 3: Protecting your personal or business website with Cloudflare "Under Attack Mode" and WAF rules¶

When a raid targets an independent creator, journalist, open-source developer, or small business, attackers almost always pivot to the target's personal or company website (yourdomain.com). They pursue three objectives: 1. Origin IP Discovery & DDoS: Knocking your site offline via HTTP floods or piling up massive serverless/cloud bandwidth bills (Denial of Wallet) on platforms like AWS, Vercel, Firebase, or Netlify. 2. Contact Form / Comment / Checkout Spam: Flooding your email inbox, WordPress comments, or Stripe checkout endpoint (card-testing attacks that get your Stripe account suspended for fraudulent declines). 3. WHOIS & DNS History Reconnaissance: Scraping your historical domain registration records (WHOIS) or MX/TXT records to find your home address or personal Gmail address.

1. Activate Cloudflare "Under Attack Mode" (UAM) in 10 Seconds¶

If your domain's DNS nameservers point to Cloudflare (even on the $0 Free Plan): 1. Log into dash.cloudflare.com and select your domain. 2. On the right-hand Quick Actions sidebar of the Overview tab, toggle Under Attack Mode to ON (or go to Security -> Settings -> Security Level -> I'm Under Attack). 3. What this does immediately: Every visitor requesting any page on your domain is intercepted at Cloudflare's global edge network (300+ cities) and served an interstitial Managed Challenge / JavaScript Proof-of-Work page for 3 to 5 seconds before a single packet ever touches your origin web server. Basic Python scripts, curl floods, headless scrapers, and cheap DDoS booters fail this challenge at the edge, dropping your origin server CPU load back to near zero.

2. Three Important Cloudflare WAF Custom Rules and Rate Limits (Free Tier)¶

Go to Cloudflare Dashboard -> Security -> WAF -> Custom Rules -> Create Rule and deploy these three surgical defenses:

Next, open Security -> WAF -> Rate limiting rules -> Create rule: - If incoming requests match: URI Path contains "/" (All traffic) or Request Method equals POST. - When rate exceeds: 30 requests per 10 seconds per IP address. - Then take action: Block (or Managed Challenge) for 10 seconds (Free plan) or 1 Hour (Pro plan).

3. The "Origin IP Leak" Audit (Why Cloudflare Fails If Attackers Know Your Real Server IP)¶

Putting Cloudflare in front of your website (the Orange Cloud Proxied icon in DNS) hides your web server's real IP address behind Cloudflare's anycast IPs. However, if your website previously ran without Cloudflare, tools like SecurityTrails, Censys, and Shodan have a permanent historical log of your web server's true origin IP address. Raiders look up your historical IP and send DDoS traffic directly to your server IP, bypassing Cloudflare completely. - How to seal your Origin Server permanently: 1. Verify every A, AAAA, and CNAME record in Cloudflare DNS has the Orange Cloud (Proxied) turned ON. Delete any unproxied (Grey Cloud) subdomains like direct.yourdomain.com, ftp.yourdomain.com, or mail.yourdomain.com that point to the same IP as your web server. 2. Request a fresh Elastic / Floating IP address from your web host (AWS EC2, DigitalOcean, Linode, Hetzner, Vultr, or cPanel host) and assign the new IP to your server, updating the A record inside Cloudflare. Because the new IP has zero historical DNS records in SecurityTrails, attackers cannot discover it. 3. Configure your server firewall (ufw, iptables, or AWS Security Groups) to ALLOW port 80 and 443 ONLY from Cloudflare's official IPv4/IPv6 CIDR ranges (cloudflare.com/ips) (or enable Cloudflare Authenticated Origin Pulls mTLS) and DROP all other incoming connections on ports 80/443.

Part 4: Surviving Deepfake Harassment and Non-Consensual Synthetic Imagery (NCII)¶

Modern harassment raids increasingly use open-source diffusion models, face-swap software, and voice-cloning engines to manufacture: - Synthetic Non-Consensual Intimate Imagery (Deepfake Pornography / NCII) posted to imageboards, Reddit, X, and Telegram; - Fabricated Voice Recordings or Fake Chat Screenshots claiming the victim made illegal or career-ending statements, which raiders mass-email to the victim's employer or sponsors.

1. Immediate Takedown of Deepfake Intimate Imagery (StopNCII.org & TakeItDown)¶

If raiders have generated or threatened to post sexually explicit deepfakes: 1. Generate a local cryptographic image hash at StopNCII.org (adults 18+) or TakeItDown.ncmec.org (under 18): - Both systems process the file locally inside your web browser (never uploaded to external servers) to generate a perceptual fingerprint (PDQ / TMK hash) broadcast to participating platforms (Meta, Reddit, TikTok, OnlyFans, Pornhub, RedGIFs, Snapchat), automatically blocking matching uploads globally. 2. Use Dedicated Platform "NCII" Emergency Portals: - Every major platform maintains a priority 24-hour NCII & Synthetic Media Removal Pipeline (see our defamatory viral video, non-consensual intimate imagery, and DMCA takedown guide). 3. File a Google Search "Explicit / Doxxed Personal Content" De-Indexing Request: - Submit URLs hosting deepfakes or doxxed contact info to Google's Remove explicit or doxxed personal information portal (support.google.com/websearch/troubleshooter/9685456) and Bing Content Removal.

2. Defending Your Job and Sponsors Against Fabricated Audio/Screenshots ("Employer Brigading")¶

When a raid thread organizes an "Employer / Sponsor Email Campaign," raiders call your company's HR department, flood Google Maps reviews with 1-star ratings (see coordinated 1-star review extortion and platform escalation), and email forged screenshots or AI audio clips to your manager. - Pre-empt the brigade with a calm, 4-sentence HR / Legal briefing BEFORE the raiders' emails arrive: - Meet urgently with HR, Corporate Security, and your Direct Supervisor. - Provide a 1-page incident summary containing: (1) The Police Incident / Premise Alert Number, (2) Redacted screenshots of the attackers' thread instructing members to "call their boss / send fake screenshots," and (3) Request that IT temporarily quarantine external emails containing your name and remove your extension from the public directory.

Part 5: Preserving court-admissible forensic evidence (WARC archives and SHA-256 hashes)¶

Reporting a raid thread for deletion before capturing forensic evidence, or taking only cropped screenshots, weakens future subpoenas because defense lawyers argue screenshots can be altered via browser Inspect Element. Follow this 3-Step Digital Forensics Preservation Protocol before a raid thread 404s:

1. Capture an RFC-Compliant WARC (Web ARChive) File Locally¶

A .warc or .wacz file (ISO 28500 standard) records the raw HTTP request, response headers, TLS certificate chain, DOM, and embedded media in a tamper-evident bundle: 1. Install the open-source ArchiveWeb.page extension by Webrecorder (webrecorder.net) in Chromium/Chrome. 2. Start recording, load the raid thread (via a VPN so your home IP is never logged by embedded images), scroll top to bottom so all comments and media load, and click Stop -> Export as .wacz or .warc.gz. 3. Save an independent third-party timestamped mirror on archive.today (archive.ph) and web.archive.org/save.

2. Generate and Timestamp a SHA-256 Cryptographic Digest¶

Immediately compute the SHA-256 cryptographic hash of your .wacz archive, full-page PDF printouts, and raw Audit Logs: - Linux / macOS: sha256sum raid_evidence.wacz full_thread.pdf > evidence_hashes.txt - Windows PowerShell: Get-FileHash .\raid_evidence.wacz -Algorithm SHA256 - Email evidence_hashes.txt to yourself via a provider that signs headers with DKIM (such as Gmail or Proton Mail) to prove to the second when that exact 64-character SHA-256 digest existed.

3. Extract Permanent Platform Account IDs (Not Display Names)¶

Always record immutable database identifiers: - Discord: Enable User Settings -> Advanced -> Developer Mode, right-click raiders and messages, and click Copy User ID / Copy Message ID (18-to-19-digit Snowflake ID). - Reddit: Save the full comment permalink and /u/username before removing the post. - Rogue Domains: Query lookup.icann.org to identify the Domain Registrar (abuse@namecheap.com, abuse@tucows.com) and Hosting Provider for formal Terms of Service Doxxing Takedowns.

Regional emergency numbers and law enforcement protocols¶

When online brigading escalates to doxxing, swatting threats, credible death threats, non-consensual deepfake pornography (NCII), or extortion, engage these official agencies:

• United States: Call 911 for immediate physical danger. Call your local police non-emergency dispatch number to place a Premise Alert / Swatting Warning on your residential address in their CAD database. File a federal cyberstalking (18 U.S.C. § 2261A) and DDoS (18 U.S.C. § 1030) complaint with the FBI Internet Crime Complaint Center (ic3.gov), and report underage exploitation to the NCMEC CyberTipline (report.cybertip.org, 1-800-843-5678).
• Canada: Call 911 for emergencies or your municipal police non-emergency line for a Swatting Address Flag. Report criminal harassment (Criminal Code s. 264) and non-consensual intimate imagery (s. 162.1) to local police and the Canadian Anti-Fraud Centre (1-888-495-8501).
• United Kingdom: Call 999 in an emergency or 101 (non-emergency police) to log a harassment or Online Safety Act 2023 deepfake offense. Report DDoS/extortion to Action Fraud (actionfraud.police.uk, 0300 123 2040) and contact the Revenge Porn Helpline (0345 6000 459) or National Stalking Helpline (0808 802 0300).
• European Union: Call 112 for emergency response. Submit expedited illegal-content and cyberstalking notices under the EU Digital Services Act (DSA) and report to your national police cybercrime unit.
• Australia and New Zealand: In Australia, call 000 (emergency) or 131 444 (police non-emergency), file a 24-hour removal complaint with the eSafety Commissioner (esafety.gov.au), and report cyberattacks to ReportCyber (1300 292 371). In New Zealand, call 111 (emergency), 105 (non-emergency), and contact Netsafe (netsafe.org.nz, 0508 638 723).
• Asia-Pacific: In India, call 112 (emergency) or 1930 (cybercrime helpline) and file at cybercrime.gov.in. In Singapore (999) and Japan (110), contact national police cyber units; see our full directory at emergency numbers.

Frequently asked questions¶

Why should I never visit or reply to an imageboard or forum thread that is doxxing me?¶

Visiting or replying to a hostile raid thread compromises both your tactical position and your technical security. First, raid communities operate on an attention economy: any defensive post, anger, or pleading proves the attack is working and recruits dozens of additional participants to prolong the campaign for months. Second, many third-party raid forums and imageboard threads embed external tracking pixels or forum signatures hosted on attacker-controlled servers; loading the page from your home Wi-Fi without a VPN immediately exposes your residential IP address, ISP, and browser fingerprint to the server operator.

How do I protect my home from a "Swatting" attack if my physical address was leaked online?¶

Call your local police department's non-emergency dispatch number today and ask to speak with a dispatch supervisor or Watch Commander. Explain clearly that your identity and residential address were recently published online by a cyber-harassment group and request that a "Swatting Advisory / Premise Alert Note" be attached to your address in their Computer-Aided Dispatch (CAD) database. Provide your mobile phone number and a secondary household contact number so that if an anonymous caller using a VoIP relay claims a hostage situation or shooting is occurring at your address, dispatchers know to call your verified phone first and apprise responding officers before approaching.

What is the difference between setting a Subreddit to "Restricted" versus "Private" during a raid?¶

Setting a subreddit to "Restricted" keeps all existing posts and comments publicly readable by everyone on the internet, while blocking anyone who is not on your Approved Users list (or who fails your AutoModerator filters) from creating new posts or comments. Setting a subreddit to "Private" completely locks the door so that non-approved users see only a landing screen and cannot view posts, comments, or the list of moderator usernames on the sidebar. Choose "Restricted" if you want your community's helpful content to stay online while starving raiders of the ability to post, or choose "Private" if raiders are scraping your threads and targeting individual members and moderators by username.

Why did my website still go down after I turned on Cloudflare "Under Attack Mode"?¶

If your website remains overloaded after activating Cloudflare "Under Attack Mode," attackers are likely bypassing Cloudflare entirely by sending traffic directly to your web server's true Origin IP address (which they found in historical DNS records on SecurityTrails or Shodan, or via an unproxied `mail.` or `dev.` subdomain). To stop direct-to-origin attacks, verify that every DNS record pointing to your server has the Orange Cloud (Proxied) enabled, ask your hosting provider to assign a brand-new IP address to your server, and configure your server's firewall (`ufw` or security groups) to drop all incoming connections on ports 80 and 443 except from Cloudflare's official IP ranges (`cloudflare.com/ips`).

Can Discord or Reddit detect when a banned raider creates a brand-new alt account on a VPN?¶

Yes, when you enable the platform's highest native security layers. On Discord, setting Verification Level to "Highest (Must have a verified phone on their Discord account)" stops VPN-based botnet generation because each account requires a unique non-VoIP SIM number, and pairing this with anti-alt bots like DoubleCounter or Wick catches shared browser/hardware fingerprints. On Reddit, turning on the "Ban Evasion Filter" inside Mod Tools -> Safety Filters uses Reddit's internal client telemetry, app installation IDs, and browser fingerprinting to automatically flag and hold comments from newly created accounts belonging to previously banned users even when they switch IP addresses.

How do I prove to police or a court that screenshots of a deleted raid thread are authentic and not forged?¶

Instead of relying on simple cropped screenshots, capture the live raid thread using the open-source Webrecorder `ArchiveWeb.page` browser extension, which exports an ISO-standard `.wacz` / `.warc` archive containing the raw HTTP response headers, server TLS signatures, and unaltered DOM assets. Immediately run `sha256sum` (or `Get-FileHash -Algorithm SHA256` on Windows) on the `.wacz` file and full-page PDF printouts, email the resulting 64-character cryptographic hash to yourself via a DKIM-signed email provider to establish an immutable timestamp, and also save a third-party mirror on `archive.today`.

Related guides¶

• Discord server or community raid: Compromised bot token, webhook spam, and audit-log recovery
• Online harassment, doxxing, and cyberbullying
• Viral false accusation, cancel mob, employer brigading, and digital lockdown
• Defamatory viral video, non-consensual intimate imagery, and DMCA takedown
• Reporting illegal and harmful content online
• Emergency numbers

Sources and official guidance¶

• Discord Safety Center (discord.com/safety): Protecting Your Server From Raids (Safety Setup, Pause Invites & DMs, Verification Levels, and AutoMod Rust Regex Documentation).
• Reddit Moderator Help Center (support.reddithelp.com): Managing Unexpected Traffic Spikes and Brigades (Crowd Control, Ban Evasion Filter, Harassment Filter, and AutoModerator Full YAML Reference).
• Cloudflare Documentation (developers.cloudflare.com): Responding to DDoS Attacks (Under Attack Mode, WAF Custom Rules, Rate Limiting Rules, and Protecting Origin Servers With Authenticated Origin Pulls).
• StopNCII.org (SWGfL / UK Revenge Porn Helpline) & NCMEC Take It Down (takeitdown.ncmec.org): Client-Side Perceptual Hashing Protocols for Non-Consensual Intimate Imagery and Synthetic Deepfakes.
• Cybersecurity and Infrastructure Security Agency (CISA) & FBI Internet Crime Complaint Center (ic3.gov): Mitigating Distributed Denial of Service (DDoS) Attacks, Doxxing Defense, and Preserving Digital Forensic Evidence (ISO 28500 WARC & FIPS 180-4 SHA-256).