Skip to main content
Sloth Lee — friendly cartoon ninja sloth in a black gi with a red headbandSloth LeeThe slowest ninja alive · watching your Discord
Add to DiscordDashboard Login

Field Guide

The Bestiary

Six bandits that plague the Eternal Canopy. Sloth Lee has been watching them since long before he became a bot — knows their patterns, their tells, the hour they show up. This is the field guide. Save it. Read it before they arrive.

“A bandit you've named is a bandit you've already half-stopped. The trick is knowing which one you're looking at before it's in your grove.”

  1. Spambat — cartoon illustration of the spambat bandit

    Spambat

    Moderate threat

    Repeats itself until somebody stops it.

    Found in colonies. Spambats don't really plan — they just say the same thing in fifty channels and hope someone clicks. Mostly harmless individually; in numbers they can drown out a conversation in seconds. They mimic real members' avatars when desperate.

    Tactics
    Mass-posts identical (or near-identical) messages across channels. Often promotes a sketchy invite, a fake Nitro link, or a 'free skins' lottery. Surges at weekends and during big game launches.
    The Slow Style answer
    Sloth Lee has been watching message rates since before they arrived. AutoMod scores every message for similarity to recent peers; once a Spambat's third copy lands, the rule fires and every echo gets deleted along with the wing it came from. The whole flock is gone before most members notice.
    Habitat
    Lurks in the canopy near link previews. Hates daylight (well-moderated channels with active staff).

    See it in action: AutoMod →

  2. Scamcoyote — cartoon illustration of the scamcoyote bandit

    Scamcoyote

    High threat

    Patient enough to wait for someone alone.

    Smarter than a Spambat and twice as patient. A Scamcoyote will sit quietly in a server for weeks, watching for a vulnerable target — a new member who just joined, someone visibly frustrated in a help channel, a kid bragging about Nitro. Then it strikes via DM with a fake support persona.

    Tactics
    DM-based social engineering. 'Hey, I noticed you had trouble with X — I'm from the mod team, click this link to verify.' Will use stolen avatars, pretend to share mutual servers, and reference real messages the target has posted.
    The Slow Style answer
    Two layers. Captcha verification gates new joins by account age and behaviour pattern (a coyote's brand-new account doesn't pass). For ones who slip through, the audit-timeline flags suspicious DM patterns even when the bot itself can't read the DM — pattern recognition on who's messaging whom, in what cadence.
    Habitat
    Edges of large servers, especially gaming and crypto communities. Avoids well-lit help channels.

    See it in action: Verification & Captcha →

  3. Mischief-monkey — cartoon illustration of the mischief-monkey bandit

    Mischief-monkey

    Low threat

    Not malicious. Just chaotic.

    Often a real member having a bad day. Spams emojis, pings @everyone for jokes, posts walls of text. Not the same threat as a Spambat — there's a person behind it — but the chaos drains staff time. The Slow Style treats them as people first, problems second.

    Tactics
    @everyone for non-emergencies, emoji spam, intentional rule-breaking 'for the lulz', occasional vote-brigading from one server to another.
    The Slow Style answer
    Graduated response. Sloth Lee logs the pattern, warns first, mutes for a cool-down, escalates only if it keeps happening. Mod-replay simulator lets staff see how a rule change would have handled past monkey incidents BEFORE shipping it.
    Habitat
    Discord-wide. Multiplies during big events (launch nights, controversies, late-night raids on other servers).

    See it in action: Moderation →

  4. Raid-rat — cartoon illustration of the raid-rat bandit

    Raid-rat

    Critical threat

    Arrives in waves. Leaves in handcuffs.

    Not really a single creature — it's a tactic, a coordinated swarm of throwaway accounts hitting one grove all at once. Usually rented from a discord-of-disrepute by someone with a grudge. The Raid Forecaster sees the signature before the swarm finishes joining.

    Tactics
    100-500 brand-new accounts joining within minutes, often with sequential usernames. Floods #general, mass-pings, posts gore or shock content to drive members away. Wraps up in 4-8 minutes and disperses.
    The Slow Style answer
    Sloth Lee anticipates instead of reacting. The Raid Forecaster watches join velocity and account-age patterns; alerts your mod team BEFORE the first message in #general. Antinuke catches the mass-action signature (suddenly 200 new joins all from accounts <7 days old → automatic lockdown + ping to staff).
    Habitat
    Spawns in coordinated discords-of-disrepute. Targets large communities during emotionally-charged windows (after a controversy, a launch, a tournament loss).

    See it in action: Raid Protection →

  5. Self-bot Snake — cartoon illustration of the self-bot snake bandit

    Self-bot Snake

    High threat

    Looks like a friend. Drains the grove.

    A compromised member account — usually one whose owner reused a password somewhere. The snake doesn't act differently for a while, then suddenly DMs every member with a phishing link. Trust is the wound: the link comes from someone the recipients know.

    Tactics
    Slow-burn. Operates undetected for days. Then bursts: mass-DM to mutuals with a 'free Nitro' or 'I'm being investigated, please help' link. Sometimes also adds malicious roles or kicks staff if it caught an admin.
    The Slow Style answer
    Antinuke. Sloth Lee watches for the SIGNATURE of a compromised mod — mass actions in a short window that don't match the person's normal cadence. Rate-limit-based detection catches it without false-positives on normal staff work. Plus per-action audit log lets ops trace what happened and undo it.
    Habitat
    Anywhere passwords get reused. Drift-net for the unwary.

    See it in action: Antinuke →

  6. Echo-thrush — cartoon illustration of the echo-thrush bandit

    Echo-thrush

    Moderate threat

    Plays your community's words back at it.

    The trickiest one. An echo-thrush listens to a server for days, learning its vocabulary — the in-jokes, the names of regulars, the way the staff talks. Then it mimics. A phishing DM 'from staff' that uses three internal phrases is much harder to spot than one from a Scamcoyote.

    Tactics
    Hybrid: account is human-controlled but uses AI for the impersonation message. Tactics blur with Scamcoyote, but the language is convincingly local. Targets specifically the people who would normally spot a generic scam.
    The Slow Style answer
    The same AI that worries you here also defends you. AutoMod's toxicity classification + the AI server diagnostician notice when a message's vocabulary fingerprint matches the staff's, but the sender isn't on the staff role. Flagged for human review, not auto-acted (a thrush's impersonation needs eyes-on confirmation).
    Habitat
    Larger servers with established culture. Indifferent to scale; preys on familiarity.

    See it in action: AI AutoMod →

Want to see him handle one?

The bestiary is only useful if you know what to do when one shows up. Read the story of how he learned to spot them, or summon him to your grove and watch in real time.

Read his storySummon to your grove