Security

Security

Multi-layer protection for your Discord server. VPN detection, browser fingerprint-based alt detection, 7-type firewall, country restrictions, anti-nuke, anti-raid, account age requirements, and intelligence profiling.

Overview

Restore Hub provides a defense-in-depth security system with multiple independent layers. Each layer can be enabled or disabled independently, and they work together to provide comprehensive protection against bots, alts, raids, nukes, and other threats.

Security features are gated by plan: Free gets country restrictions, captcha, account age, and blacklist. Premium adds VPN detection, alt detection, and the firewall. Business adds anti-nuke, anti-raid, and team management. Enterprise adds cross-server analytics and dedicated support.

VPN & Proxy Detection

Restore Hub's VPN/proxy detection is entirely in-house. There are no external API calls during verification — all IP intelligence is pre-loaded into a local PostgreSQL database and Redis cache. This means zero latency impact on the verification flow.

The IP intelligence database is updated daily from multiple open-source and community-maintained sources:

• Tor exit nodes — Full list of ~7,000 Tor exit node IPs, updated daily from the Tor Project's official exit list (https://check.torproject.org/exit-addresses).

• VPN IPs — Community-maintained lists (X4BNet/lists, firehol/blocklist-ipsets) covering major VPN providers: NordVPN, ExpressVPN, Surfshark, ProtonVPN, PIA, Mullvad, and hundreds more.

• Datacenter/Hosting IPs — Over 354 million IPs from 50+ hosting provider ASNs (AWS, Google Cloud, Azure, DigitalOcean, OVH, Hetzner, Linode, Vultr, etc.). Covers entire ASN IP ranges.

• Bogon ranges — RFC 1918 private IPs (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), CGNAT (100.64.0.0/10), and other reserved ranges.

• Proxy IPs — Known open proxy servers from community lists, updated daily.

Tip: Because all detection is local, verifications complete in milliseconds with zero external dependencies. There is no per-lookup cost and no third-party API that could go down.

VPN Detection Configuration

VPN detection has four independent toggles in server settings:

| Setting | What It Blocks |
|---|---|
| VPN Blocking (vpnBlockEnabled) | Known VPN provider IPs from community lists |
| Tor Blocking (blockTor) | All Tor exit node IPs from the Tor Project |
| Datacenter Blocking (blockDatacenters) | 354M+ IPs belonging to cloud hosting providers |
| Proxy Blocking | Known open proxy servers |

Warning: Datacenter blocking is aggressive — it blocks any IP belonging to a hosting provider ASN. This will block users on some mobile carriers that route through cloud providers, users behind corporate proxies hosted on AWS, and users of some lesser-known VPNs that lease datacenter IPs. Use with caution and monitor your block rate.

IP Intelligence Caching

IP lookup results are cached in Redis with a 24-hour TTL (IP_CACHE_TTL_SECONDS = 86,400). Each lookup result includes: country code, ASN, ISP name, VPN flag, proxy flag, Tor flag, datacenter flag, cellular flag, and fraud score.

The IpIntelligence model in the database stores aggregated data per IP hash: total verification attempts, success/block counts, unique Discord users, unique fingerprints, and a calculated risk score. This builds long-term intelligence about suspicious IPs.

Alt Account Detection

Alt detection identifies when the same person verifies with multiple Discord accounts using browser fingerprinting. This is one of Restore Hub's most powerful security features — it catches alts even when they use different IPs, VPNs, or browsers.

The fingerprint is a composite hash derived from multiple independent signals:

• Canvas fingerprint — Renders an invisible canvas element and hashes the pixel data. Different GPUs, font renderers, and antialiasing produce unique outputs.

• WebGL fingerprint — Uses WebGL to query the GPU vendor (UNMASKED_VENDOR_WEBGL) and renderer (UNMASKED_RENDERER_WEBGL), then renders a 3D scene and hashes the result.

• Audio fingerprint — Creates an AudioContext, generates an oscillator signal, and hashes the output. Different audio hardware and drivers produce unique waveforms.

• Hardware signals — CPU core count, device memory, color depth, screen resolution, touch support, font count, plugin count.

• Browser signals — User agent, language, timezone, connection type, Do Not Track flag, cookies enabled.

Alt Detection — How Cross-Server Matching Works

When a member verifies, their composite fingerprint is stored in the MemberMeta table and indexed in the FingerprintIntelligence table. Restore Hub queries the FingerprintIntelligence table to find all Discord user IDs associated with that fingerprint across ALL servers.

If the same fingerprint appears under a different Discord user ID, it is flagged as a potential alt account. The FingerprintIntelligence record tracks: unique Discord users, unique servers, unique IPs, countries, timezones, OS variations, device variations, and whether the device/OS are consistent.

You can configure what happens when an alt is detected:

| Action | Behavior |
|---|---|
| Block | Reject the verification immediately. The member sees the blocked message and cannot get the verified role. |
| Allow & Flag | Let the member verify and get the role, but mark them as a flagged alt in the dashboard for manual review. |
| Notify Only | Let the member verify normally. Send a notification to the log channel and/or email, but take no action. |

Tip: Alt detection works across ALL of your servers, not just the one being verified into. If a member verified in Server A with fingerprint X, and a different Discord account verifies in Server B with the same fingerprint X, it is flagged.

Firewall Rules

The firewall (Premium+) lets you create granular block rules based on 7 different attributes. Firewall rules are checked before OAuth2 — blocked visitors never see the Discord authorization page.

| Rule Type | Value Format | Example | What It Blocks |
|---|---|---|---|
| IP | IPv4/IPv6 address or CIDR range | 1.2.3.4 or 10.0.0.0/8 | A specific IP address or entire subnet |
| COUNTRY | ISO 3166-1 alpha-2 country code | CN, RU, IR | All traffic from the specified country |
| ASN | AS number with AS prefix | AS14061 | All IPs belonging to that ASN (e.g., AS14061 = DigitalOcean) |
| FINGERPRINT | Browser fingerprint hash | abc123def456... | A specific browser fingerprint (useful for blocking a known bad actor's device) |
| USER_ID | Discord user ID (snowflake) | 123456789012345678 | A specific Discord user by their ID |
| SERVER_ID | Discord guild ID (snowflake) | 987654321098765432 | Any user who is a member of the specified Discord server |
| REGION | Geographic region string | EU-WEST, ASIA-EAST | All traffic from the specified geographic region |

Firewall vs. Blacklist vs. Country Restrictions

These three features overlap but serve different purposes:

• Firewall rules — Broad, pre-OAuth blocking based on 7 attributes. Blocks before the member even sees the Discord authorization. Per-server, managed by server owner.

• Blacklist — Post-OAuth blocking of specific Discord user IDs. Checked after OAuth2 (because user ID is not known until after OAuth). Per-user (applies across all your servers).

• Country restrictions — Pre-OAuth, simpler than firewall. Two modes: allow (only listed countries can verify) or block (listed countries are denied). Good for servers that only serve specific regions.

Whitelist Rules

Whitelist rules (Premium+) let specific visitors bypass ALL security checks. A whitelisted visitor skips the firewall, VPN detection, country restrictions, alt detection, and captcha. They still go through OAuth2 (since that is core to verification), but all restrictive checks are bypassed.

| Rule Type | Example Use Case |
|---|---|
| IP | Whitelist your office IP so staff always pass verification |
| USER_ID | Whitelist a specific Discord user ID for a VIP |
| FINGERPRINT | Whitelist a known-good device fingerprint |
| COUNTRY | Whitelist a country that might otherwise be blocked |
| ASN | Whitelist a specific ISP or network provider |

Tip: Whitelist rules are checked FIRST in the verification flow — before any other security check. If a visitor matches any whitelist rule, they go straight to OAuth2.

Anti-Nuke

Anti-nuke (Business+) detects mass-destructive actions in your Discord server in real time. It uses Redis sliding window counters to track the rate of destructive events. When a threshold is exceeded, Restore Hub triggers alert actions.

Anti-nuke monitors four event types with the following thresholds (from constants.ts):

| Event Type | Threshold | Time Window | What It Detects |
|---|---|---|---|
| Channel Deletions | 3 deletions | 60 seconds | Someone mass-deleting channels |
| Role Deletions | 3 deletions | 60 seconds | Someone mass-deleting roles |
| Bans | 5 bans | 60 seconds | Someone mass-banning members |
| Kicks | 5 kicks | 60 seconds | Someone mass-kicking members |

Anti-Nuke — How Sliding Window Counters Work

For each event type, Restore Hub maintains a Redis sorted set keyed by server ID. Each event is added with a timestamp score. When a new event arrives, Restore Hub counts how many events occurred in the past N seconds (the window). If the count exceeds the threshold, the alert triggers.

This approach is more accurate than fixed-window counters because it does not have boundary effects. A burst of 4 channel deletions in 2 seconds will trigger the alert regardless of whether it spans a minute boundary.

Anti-Nuke — Response Actions

When an anti-nuke threshold is triggered, Restore Hub can take several configurable actions:

• Email alert — Send an email to the configured alert address with details of the destructive action, including who performed it and what was affected.

• Discord webhook alert — Send a detailed embed to a Discord webhook URL with real-time information.

• Auto-pull — Automatically start pulling your verified members to a pre-configured backup server (Business+ with hasAutoPull).

• Logging — All anti-nuke events are logged to the AuditLog and can be viewed in the dashboard.

Anti-Raid

Anti-raid (Business+) detects mass join events that indicate a raid — a coordinated flood of bots or users joining your server simultaneously. It monitors two patterns:

| Pattern | Threshold | Time Window | Details |
|---|---|---|---|
| Mass join | 10 joins | 30 seconds | 10+ users joining within a 30-second window, regardless of account age |
| New account flood | 5 joins | 60 seconds | 5+ accounts less than 7 days old joining within a 60-second window |

Tip: Anti-raid and anti-nuke use the same alert configuration. You can set up alerts for both simultaneously with a single email address and webhook URL.

Account Age Requirements

You can require that Discord accounts be a minimum age (in days) before they can verify. This is a simple but effective defense against freshly created bot/alt accounts.

The account creation date is derived from the Discord user ID snowflake — the first 42 bits of a Discord snowflake encode the timestamp. Restore Hub parses this to get the exact account creation date without an extra API call.

Set minAccountAgeDays in server settings. A value of 0 disables the check. Common values:

• 0 days — No restriction (default)

• 7 days — Blocks accounts less than a week old

• 30 days — Blocks accounts less than a month old (recommended for most servers)

• 90 days — Aggressive; blocks newer legitimate accounts but very effective against alts

Intelligence & Risk Profiling

Restore Hub builds intelligence profiles over time for users, IPs, and fingerprints. This data powers risk scoring and anomaly detection.

• UserBehaviorProfile — Tracks a Discord user across all servers: total verifications, success/block rate, unique IPs, unique fingerprints, unique devices, country count, VPN usage, proxy usage, alt account likelihood (0-100), and overall risk score (0-100) with levels: LOW, MEDIUM, HIGH, CRITICAL.

• IpIntelligence — Tracks an IP (hashed) across all verifications: country, ASN, ISP, VPN/proxy/Tor/datacenter flags, total attempts, success/block counts, unique Discord users, unique fingerprints, fraud score, and risk score.

• FingerprintIntelligence — Tracks a browser fingerprint across all verifications: unique Discord users, unique servers, unique IPs, alt account detection, country/timezone/OS/device variations, consistency flags, risk score, and risk level.

• ServerRiskReport — Per-server risk assessment: total/verified members, verification rate, alt accounts detected, VPN blocked count, firewall blocked count, datacenter IP count, unique ASN count, country diversity score, and overall risk score/level (CLEAN, LOW, MEDIUM, HIGH, CRITICAL).

• AnomalyEvent — Individual anomaly detections: GEO_IMPOSSIBLE_TRAVEL (user verified from two distant countries in a short time), MASS_VERIFY (same fingerprint verifying rapidly), FINGERPRINT_REUSE (fingerprint used by many Discord users), IP_SPAM (many verifications from one IP), DEVICE_SWITCH (user changing devices frequently).

Data Retention

Security-related data has defined retention periods:

| Data | Retention Period |
|---|---|
| Verification events | 90 days |
| Page views | 90 days |
| Audit logs | 1 year |
| Login sessions | 90 days |
| Member data (verified members) | Retained until manually deleted or server removed |
| Intelligence profiles | Retained indefinitely (aggregated, not raw) |