A raid has a shape. We read it.
Fifty accounts do not walk in one at a time. They arrive as a spike. Anti-Raid counts joins inside a sliding window, and the moment that count crosses your line it flips into raid mode, actions every joiner behind the spike, and tells you once - not fifty times.
Anti-Raid is the raid-detection half of the Member Defense engine. Same master switch, same per-member action - so turning Member Defense off turns raid detection off too.
Join rate inside the window
Trigger: 10 joins within 10 seconds, the default
Each bar is how many join timestamps were still inside the sliding window at that second, not raw joins per second. That rolling count is what the engine compares against your threshold.
The window slides. Old joins fall out of it.
Every join is timestamped and pushed onto a list. Anything older than your window is dropped before the count is taken. That is the whole detection, and it is deliberately this simple - so it is fast, and so you can predict exactly when it will fire.
snapshot at T+12.4s - window start T+02.4s
10 in window / threshold 10Struck through
T+01.2 is older than ten seconds. It was shifted out before counting, so it can never contribute to a raid it had nothing to do with.
Held
Nine timestamps still sit inside the window. Under the line, so nothing has happened yet and these members are treated as ordinary joins.
The trigger
T+12.4 is the tenth. The count reaches the threshold on this exact join, and raid mode starts on it.
You set both numbers. Joins accepts 2 to 1000, the window accepts 1 to 600 seconds. Defaults are a conservative 10 joins in 10 seconds.
One raid, second by second
What actually happened on that trace, in the order it happened.
A normal evening
Three people join across ten seconds. The window holds three timestamps. Nothing fires, nothing is logged, nobody is messaged.
The rate climbs
Joins start stacking up. Seven land inside the window. Still under the line, so those seven are treated as ordinary members. AntiLink does not act on a hunch.
Threshold crossed, raid mode on
The tenth timestamp inside a ten second window arrives. Raid mode starts on that exact join, and your configured action begins applying to every human who arrives from here on.
One alert. Exactly one.
A single raid-detected embed goes to your notification channel with the count, the window and the action being applied. Per-joiner alerts are suppressed on purpose: the one alert already covers them, and 28 pings would bury it.
Emergency Lockdown, if you asked for it
With raid auto-lockdown enabled, AntiLink activates a server-wide Emergency Lockdown for 60 minutes, forcing invite and external-link blocking across the whole server while the burst runs.
28 joiners actioned, every one recorded
Each gets the shared Member Defense action: alert only, quarantine, kick or ban. Every action is written to the Member Defense audit trail and the moderation log at risk level high, so the dashboard activity view has the full list.
The window drains, raid mode exits
The next join to arrive finds only three timestamps left inside the window. That is at or under half the threshold, so hysteresis clears raid mode and the raid-ended summary posts with the action count and duration.
And if nobody joins again?
The window is re-checked on join events, not on a clock. So a raid is also force-closed after a hard ceiling of five minutes and the summary posts anyway. It can never get stuck open.
Two messages for the whole incident
Bots that ping once per raider make the log channel useless at the exact moment you need to read it. Anti-Raid posts a raid-detected alert, then a raid-ended summary. That is the whole conversation.
AntiLinkBotToday at 21:14
Raid detected
10 joins in 10 seconds. Applying Quarantine to new members until the join rate settles.
AntiLink Member Defense
AntiLinkBotToday at 21:15
Raid ended
28 members actioned over 26s. Join rate is back to normal.
AntiLink Member Defense
Outside raid mode, a slow drip of flagged joins still gets a throttled per-join alert, so a quiet account-age screen never floods the channel either.
Tune it to your server, not to ours.
A 40 member server and a 40,000 member server have completely different normal. Two numbers decide when a burst becomes a raid, and one choice decides what happens next. Change either from the dashboard Anti-Raid tab or from Discord with /guard raid.
- Too many false raids? Raise the join count or shorten the window so an ordinary rush stays under the line.
- Start on alert only. Watch what it would have caught for a week, then move up to quarantine, kick or ban with real evidence.
- Quarantine is the reversible one. A role is added, not a member removed - so a false positive is one click to undo.
Anti-Raid
AntiLink PremiumRaid detection runs on the Member Defense engine. If Member Defense is off, nothing here fires.
Raid trigger
Joins
10
Seconds
10
Action for flagged members
Alert only
Log it, touch nobody
Quarantine
Add the quarantine role
Kick
Needs Kick Members
Ban
Needs Ban Members
This is the shared Member Defense action, the same one used for account-age screening.
Emergency auto-lockdown
A detected raid activates Emergency Lockdown for 60 minutes, forcing invite and external-link blocking server-wide.
Automation this blunt needs rails
A raid response that misfires is worse than no raid response. Every one of these limits exists so Anti-Raid cannot run away from you.
200 action cap per raid
After 200 members are actioned in one raid, AntiLink stops mutating members and only records the rest, posting a single cap-reached notice asking you to intervene. A 10,000 account raid cannot turn your bot into a rate-limit machine.
Fail-open, always
Every member mutation is guarded. If the quarantine role sits above the bot, or the bot lacks Ban Members, that joiner downgrades to alert-only with a diagnostic note. Nothing throws into the gateway, so link scanning is never affected.
Hysteresis, not a hair trigger
Raid mode only lifts once joins in the window fall to half your threshold or lower, minimum 2. It cannot flap on and off across a noisy boundary and spam your channel with alerts.
Bots are skipped
Bot accounts are OAuth-added by admins, not raiders. Raid detection only counts and acts on human joins, so adding three integrations at once never reads as an attack.
Bounded memory
At most 2000 join timestamps are retained per server, and per-guild raid state is dropped after 30 minutes with no joins. The window lives in memory and refills within seconds after a restart.
A record you can read later
The raid itself, every actioned join, the raid-ended summary and the cap notice all land in the Member Defense audit trail for the dashboard activity view.
Three things have to be true
We would rather say this plainly here than let you discover it during a raid.
The plan
Anti-Raid is AntiLink Premium, the top tier. AntiLink Basic and AntiLink Plus servers see the upgrade wall on the tab, and raid configuration is blocked.
Member Defense enabled
Raid detection shares the Member Defense master switch. Turn the engine on with /guard enable or the Member Defense tab, or no raid is ever detected.
The Server Members intent
Anti-Raid reacts to join events, which need Discord's privileged Server Members intent. Without it, join events never arrive and raid detection stays inert.
Permissions, only for the action you pick
Alert only
Nothing extra
Quarantine
Manage Roles, role below the bot
Kick
Kick Members
Ban
Ban Members
Missing one? That joiner is downgraded to alert-only with a diagnostic note instead of erroring. You still get the record, and you can fix the permission afterwards.
Be asleep when it happens.
Set two numbers and an action. The next spike gets read, answered and summarised before anyone has time to open the mod channel.