The Endless Cycle: How Criminal Networks Exploit Discord and Evade Detection

Update on the raid bot case

On 26 March at 4:37 CET military time, we received a final email from the Discord team about the raid on Tropical Promotions earlier this month. The email went as follows:

Hello,

We have received your report and have found that it contains sufficient grounds to consider the reported app to be illegal or in violation of our terms and policies. We'll take action accordingly

We truely appreciate your efforts in helping us to keep Discord a safe and friendly environment

Sincerely,

Discord Developer Compliance

Not long after, both the bot and its base server were banned. However, this didn’t mean they were completely erased—rather, they were simply inaccessible to new users. According to a report from one of our newsagents within the server, a new invite link had already been created, leading to a fresh server. By the time the report reached us, this new server already had 3,847 members.

In addition to the revived server, a replacement bot had also emerged, offering the same commands as the previous one. This time, the operators seemed to take a more cautious approach. The new bot featured a profile picture of an AI-generated anime character named Mimi, possibly an attempt to appear more harmless and avoid scrutiny. Records indicate that this bot was created on January 23, 2025—just two months ago.

Evading the ban explained

When a Discord server is banned, criminals can quickly build a new one and resume their activities with little disturbance. This is because server construction is free and infinite, allowing banned users to start over without real barriers. Because Discord does not require strict identity verification, unscrupulous actors can swiftly create new identities using disposable emails, phoney phone numbers, or even stolen accounts purchased from illicit marketplaces. These alternate accounts allow them to return to the platform very instantly after being banned.

To escape discovery, these users frequently utilise VPNs and proxies to hide their IP addresses, making it impossible for Discord to identify and permanently ban them. Furthermore, many criminal groups prepare for prospective bans by setting up backup servers ahead of time. When their primary server is shut down, they can immediately migrate their users to a new server using external communication channels like Telegram, WhatsApp, Signal, or private forums. Some even automate the process by utilising bots to replicate server roles, permissions, and channels in minutes, making the move painless.

Discord's moderation and enforcement are mainly reliant on user reports and automatic detection methods, however, these safeguards are not perfect. Criminals can avoid discovery by making minor changes to their server names, descriptions, and actions, which prevent AI-based systems from identifying them as repeat offenders. Many people also utilise invite-only URLs that change regularly, which reduces the likelihood of new servers being discovered by Discord's moderation team.

Furthermore, these groups rarely operate purely through Discord. They use external sites to coordinate their operations and distribute new invite links, making it difficult for Discord to detect and permanently disable them. Because bans are frequently reactive rather than proactive, many criminal communities regard server shutdowns as minor setbacks rather than significant impediments.

Criminal Networks on Discord

Criminals exploit Discord’sanonymity, automation, and lack of strict oversight to run scams, hacking operations, illegal trade, and other illicit activities. Despite bans, they evade detection using various tactics.

1. Types of Criminal Activity

Hacking & Cybercrime: Account hijacking, malware distribution, and DDoS-for-hire.
Scams & Fraud: Fake Nitro giveaways, crypto scams, and identity theft.
Illegal Marketplaces: Stolen gaming accounts, counterfeit goods, and illicit drug sales.
Child Exploitation & Grooming: Predators target victims in gaming communities.
Extremist Groups: Recruitment, propaganda, and harassment campaigns.

2. How These Networks Stay Hidden

Private, Invite-Only Servers: Require verification and manual approval.
Backup Servers: Pre-set to migrate users after bans.
Stealthy Bots: Automate server recreation and invite distribution.
Encrypted Messaging: Use Telegram, Signal, and dark web forums.
IP Masking & Fake Accounts: VPNs, proxies, and disposable credentials.

3. Discord’s Efforts to Combat Crime

AI Moderation: Detects suspicious behaviour but is often bypassed.
User Reports: Help, but many illegal servers remain hidden.
Bans & Suspensions: Criminals quickly create new accounts.
Law Enforcement Collaboration: Investigations are slow but ongoing.

4. Why Criminals Use Discord

Free & Anonymous: No strict verification.
Massive User Base: Easy to recruit victims.
Bot Automation: Speeds up operations.
External Communication: Redirects users after bans.

5. Can These Networks Be Stopped?

Stronger Verification: ID checks for flagged users.
Improved AI Detection: Track duplicate servers and migration patterns.
Law Enforcement Support: Faster legal action.
Proactive Moderation: Beyond user reports.