[Information] Got my account suspended

user234683 commented 3 years ago

I began deleting all my account's messages 2 days ago. Probably somewhere around 10,000 in total. With an average delay of 2450 ms (I used the modification #168 which adjusts the delay randomly, however, I applied the changes from that gist to the original script and also set it to increase the min and max delays if rate limiting is reached). However, I didn't ever notice rate limits being reached. I used a min of 900 ms and a max of 4000 ms.

After getting most of it deleted, what seems to have resulted in my account suspended was one of or a combination of the following factors:

(1) Had the third party client Ripcord open (2) Sent a message through it to a non-friend (I thought he was on my friends list but turns out no). Message failed to send. (3) Then I sent a friend request. Around this point I was logged out and my account was disabled.

So if you're going to do mass-deleting, do not do any of those three things!

FunnyInternet commented 3 years ago

Deleted tens of thousands of my messages and also have used ripcord for a long time and my account is fine, so it's either completely random or you did something else? Did discord explain the reason at all in an email or something

cedws commented 3 years ago

I am a maintainer of another deletion tool and have had one of my own testing accounts banned today - the first in two or three years I've been working on it.

I suspect Discord are cracking down on self-botting. I will be adding more warnings to my tool and I strongly suggest some warnings are added to this tool also.

If you're a user, you should back up anything you don't want to lose. I doubt Discord will accept appeals.

victornpb commented 3 years ago

@cedws I will probably add a banner on the project readme and inside the UI.

This project really started as a personal scripts, but since more and more (non tech) people are using it, it makes sense to make then aware or the risks.

I strongly discourage deleting messages other than your own, unless its a handful of messages. If you need to delete a large amount of messages, don't push it very aggressively, you don't want to be seen hammering the discord API.

victornpb commented 3 years ago

I added a warning to the README, and added a link to this thread. This issue is also pinned. I will also add a warning inside the UI later (I just don't have time to change the HTML+CSS right now).

cedws commented 3 years ago

Nice one.

One way to get around the self-botting rules may be to automate actions such as clicks and keypresses via the Discord client so that it looks legitimate.

What I will probably aim to find out is the heuristics Discord are using on the backend to detect self-botting. I hope they are using a simple set of rules rather than some black box machine learning. Some ideas:

Detection of high volume of requests or 429s
Detection of hitting specific endpoint too often
Detection of requests without corresponding /science requests (telemetry endpoint)
Detection of requests without specific headers

I'll let you know if I find anything.

githubuser843 commented 3 years ago

Seems to work fine in small message amounts even on fresh account so not sure what specifically is causing it. Are there any specific guidelines on using it and not having your account removed? Is it just to use it normally and not DM/use other discord clients

user234683 commented 3 years ago

I believe what causes your account to get removed is not the deleting itself, but doing mass deleting and then doing any of the following actions:

(1) New friend requests (2) Sending messages (3) Joining servers

The reason is that Discord's automated system is trying to crack down on automated accounts that add people as friends or join servers and then send spam, scams, and other automated junk to them. So I think mass deleting lowers your "account reputation," and results in your account being noted as engaged in self-botting, but it really only triggers the anti-spam system/suspension in those 3 cases. So I would advise if you're mass deleting, do not send anyone DMs, and do not add anyone as friends or join any servers. Only delete, and then wait maybe a couple days before doing anything else so your account reputation can reset. This is just speculation though.

Vortex545 commented 3 years ago

I am a maintainer of another deletion tool and have had one of my own testing accounts banned today - the first in two or three years I've been working on it.

I suspect Discord are cracking down on self-botting. I will be adding more warnings to my tool and I strongly suggest some warnings are added to this tool also.

If you're a user, you should back up anything you don't want to lose. I doubt Discord will accept appeals.

I got suspended and i wasn't even using the bot, just deleting manually. Very strange

MkUltraCIA commented 3 years ago

I got suspended and i wasn't even using the bot, just deleting manually. Very strange

That's even worse.

Animan8000 commented 3 years ago

Were the affected accounts by any chance unverified Discord accounts? Because I am aware of some Anti-Spam system that kicks in easily on unverified ones in certain situations, forcing you to provide email or phone number to continue.

user234683 commented 3 years ago

My account was verified. I had run into the anti-spam system unintentionally before, because I asked a similar question in two servers, and then joined a new one, after which it made me give a phone number.

Falcc commented 3 years ago

Just found this, seems to be pretty clear: https://support.discord.com/hc/en-us/articles/115002192352-Automated-user-accounts-self-bots-

Automating normal user accounts (generally called "self-bots") outside of the OAuth2/bot API is forbidden, and can result in an account termination if found.

githubuser843 commented 3 years ago

Any update on any of this? Not sure I want to have my account banned for deleting messages. If it happens in the middle of it then you can't really remove the rest. I'm not really sure what makes it incredibly noticeable, is it just a large volume is suspicious? Stretching the limits of the discord API or whatever.

Animan8000 commented 3 years ago

I think the very minimum you can do (while keep using it) is not to stress the API additionally. Which means don't look into other channels, don't send messages, don't send friend requests, etc. while the script is doing it's job. Optionally changing the delay can be done but that is up to you.

Falcc commented 3 years ago

I was able to run this a few days ago, and haven't been banned yet. But I modified it to be much less brutal on the API.

I changed the "baseDeleteDelay" variable to 700 on line 151. And I added a random number between 1 and 100 to the delete delay on line 335.

I did this because I found that a baseDeleteDelay (and no random number) of 750 was the sweet spot for never getting rate limited. Dropping it to 700 and adding the rand of 1 to 100 should give me an average of 750, but make it look (slightly) less automated.

I deleted approx 35000 messages in a single DM over about 10 hours.

adnit commented 3 years ago

I was able to run this a few days ago, and haven't been banned yet. But I modified it to be much less brutal on the API.

I changed the "baseDeleteDelay" variable to 700 on line 151. And I added a random number between 1 and 100 to the delete delay on line 335.

I did this because I found that a baseDeleteDelay (and no random number) of 750 was the sweet spot for never getting rate limited. Dropping it to 700 and adding the rand of 1 to 100 should give me an average of 750, but make it look (slightly) less automated.

I deleted approx 35000 messages in a single DM over about 10 hours.

this seems to work for me too, thanks for the idea @m0illi

Arcitec commented 3 years ago

@m0illi I see that you are using an old version of the script. The latest version from March 30th 2021 has already changed the default deletion delay to 1 second, and also doesn't have the variables you talk about. It also now dynamically extends the delay if you get rate limited.

If you wanna have a random deletion delay in the new version, I narrowed it down to the line that says:

await wait(deleteDelay);

But that's not the best place to add the delay. There's many different API calls that use the wait-function. So instead, search for this line (for me it was near the absolute top of the file):

const wait = async ms => new Promise(done => setTimeout(done, ms));

And change it to this (randomly adds 0-200ms):

const wait = async ms => new Promise(done => setTimeout(done, ms + Math.floor(Math.random() * 200) ));

This will make every API delay slightly random. It will also mean that the "estimated time remaining" is no longer true in the GUI but that should be obvious.

Anyway I dunno if this will help. It might. It's possible that they look for a pattern of API requests coming with the exact same timings since the previous request. But honestly, it's even more likely that they simply look for fast requests in general, and lack of things like intermittent "normal user" API requests inbetween.

But having a random delay can't hurt, so I did it... I also manually (in the GUI part of this script after clicking the trash can icon) set my core deletion delay to 1500 (instead of 1000) and my search delay to 500 (instead of 100) because I am not in a rush and I don't want to get banned.

SwampyApple commented 3 years ago

@Bananaman thank you for the addition. Have you had any further results? I haven't been seeing any recent comments on suspensions in this issue but that's no guarantee that anything has changed meanwhile. I also think it would be valuable to know the exact given reason and duration of the suspension/ban.

Falcc commented 3 years ago

I haven't been banned using the 700ms + rand(0,100). I've used it multiple times over the last few weeks. First time running it was ran for over 9 hours, same with second time. Then a few more times less than 15 Min each.

On Sun, 16 May 2021, 7:38 pm SwampyApple, @.***> wrote:

@Bananaman https://github.com/Bananaman thank you for the addition. Have you had any further results? I haven't been seeing any recent comments on suspensions in this issue but that's no guarantee that anything has changed meanwhile. I also think it would be valuable to know the exact given reason and duration of the suspension/ban.

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/victornpb/deleteDiscordMessages/issues/193#issuecomment-841792705, or unsubscribe https://github.com/notifications/unsubscribe-auth/AS5NKURMFEHABC5WJ5NZ5V3TN6HCHANCNFSM4Z2T4KKQ .

SwampyApple commented 3 years ago

I haven't been banned using the 700ms + rand(0,100). I've used it multiple times over the last few weeks. First time running it was ran for over 9 hours, same with second time. Then a few more times less than 15 Min each.

Thanks for the additional information. One extra question: was your account already phone verified? I've been reading that some users had their accounts locked out until they verified through their phone.

Arcitec commented 3 years ago

@SwampyApple @m0illi I used the settings described earlier:

changed deletion delay to 1500 (instead of 1000) and my search delay to 500 (instead of 100)
my patch to add 0-200ms random extra delay to each API call.
I do not have phone verification. I do not have a phone number added. I've never had a phone number associated with it. I only have a random protonmail email.
I deleted 3000 messages all at once with these settings.
11 days have passed after that and I am not banned! Edit: A few months later. Not banned.

AllEternalsDeck commented 3 years ago

I mass deleted about 10000 messages in multiple channels with the default settings (1000s), then changed my mail on my account, then created a new account with the old mail, then set the old account for deletion. Do you reckon I'm at risk for any ban (especially with the new account?)

Sorry this might not be pertinent to the specifics of the topic, but I have anxiety issues, and getting my account banned is nagging at my head very heavily right now.

cedws commented 3 years ago

@AllEternalsDeck There is no certainty unless you work at Discord and know the botting heuristics they have in place. If being banned is a problem for you, you need to assume it will happen and plan accordingly.

adnit commented 3 years ago

@AllEternalsDeck probably not since most probably accounts are tied to a userId and email is not fully taken into consideration, for ex if u were indeed about to get banned on ur old account and changing the email address would have prevented the ban

AllEternalsDeck commented 3 years ago

If I may ask how long after the deleting of the messages have people been banned?

Also are the bans you've been receiving temporary suspensions, account disabling or straight up IP bans?

I am very worried about IP banning because discord's stance on the matter doesn't really specify the kind of banning associated with self botting...

DAKiersz commented 3 years ago

Last week, I had a chance to test the script with trivial modifications as suggested by @Bananaman. I've conducted a large-scale test on two accounts that resulted in the deletion of 80k and 20k messages respectively in groups, DMs etc. So far, no ban or bot detection mechanism has been triggered. Here, I want to list some of the paranoid precautions that were done:

Similarly to @Bananaman, I've changed to default values of deleteDelay to 1500ms and searchDelay to 1000ms).
A random, additional delay to the API call was set to 20% of the deleteDelay - a bit arbitrary but it should generalize better for different values of deleteDelay.
On both accounts, I've disconnected the mobile phone authentication and changed both emails to throwaways, again, to recreate any accounts that may perish.
Prior to logging in to Discord using Chromium (via two different devices for each account), I logged out of all devices - this can be done by simply changing your password and logging in again.
A bit of a long shot, but using a VPN during these deletion sessions (and in general!) should not hurt. I've done this to see if a ban would target the IP. This is probably the most speculative point on this list.
The scripts ran for about just over 2 days on the first account with no interruptions (say, to the API limiter).
Going along with @user234683 suggestion, accounts were 'let be' for about three days after mass deletion - particularly when it comes to DMing anyone. It does seem logical that any anti-spambot system may see sending DMs as problematic. There is of course no evidence for any of this.
Lastly, I suggest changing your password and 2FA to reset authToken afterwards just in case a third party somehow intercepted this string.

None of the above are a known silver bullet to this issue and are, at best, educational guesses. Without knowing the inner workings of the bot-detection system, we can only attempt to confuse such mechanisms, as rightly suggested by @cedws.

@AllEternalsDeck As mentioned above, there will never be any guarantee that you would not get banned. Plan accordingly, undertake preparations and assume that it may happen after pulling the trigger.

Thanks to @victornpb for this script. I hope the above helps someone.

ryz commented 3 years ago

Over the last week I've deleted about ~200k messages on a server in various subchannels.

I've used default values (100ms searchDelay, 1000ms deleteDelay) and pretty much just let the script run from morning until evening every day for 8-12 hours.

I have kept discord usage in that time to a minimum - I didn't join any servers, add friends or similar. I only read a few messages and wrote 1-2 lines on accident via the mobile client because I forgot the script was running.

So far I haven't been banned.

Thanks again for the script!

0xpr03 commented 3 years ago

Also had no problem with 500,1500ms delay + randomized 0-200 for every request. No server join/friend add etc in that time. Takes a while but gets the job done to have more privacy regarding older messages.

hb0nes commented 3 years ago

It's pathetic that Discord doesn't allow you to just bulk delete your DMs with one API call and starts banning people for it when they do it one by one as a bypass.

Don't hold back on implementing such a function only to start whining when people find their own way.

Disgusting.

Toby222 commented 3 years ago

It's pathetic that Discord doesn't allow you to just bulk delete your DMs with one API call and starts banning people for it when they do it one by one as a bypass.

Don't hold back on implementing such a function only to start whining when people find their own way.

Disgusting.

You can request deletion of your messages, just have to specify which ones. I don't recall where exactly, but one of the developers said you could theoretically just send them a list of every single messageID for your account. (You might get questioned why though.) The reason they don't allow you to just delete everything on-demand/via API is that their business lies in messaging, so they want to keep message history.

dt-flo commented 3 years ago

It's pathetic that Discord doesn't allow you to just bulk delete your DMs with one API call and starts banning people for it when they do it one by one as a bypass.

Don't hold back on implementing such a function only to start whining when people find their own way.

Disgusting.

Your messages won't even get deleted if you delete your entire account. Never I will ever messages someone over a service that doesn't offer end-to-end encryption.

user234683 commented 3 years ago

You can request deletion of your messages, just have to specify which ones.

@Toby222 I did exactly that, for specific messages, and they completely ignored the email, even after sending follow-ups. So it is just PR as far as I can see. More likely explanation is that they don't want to allow bulk delete because it will limit future data-mining potential (there's no way Nitro is profitable). Money speaks louder than words.

0xpr03 commented 3 years ago

Increase randomization time max and search time, otherwise you'll get API rate limited for 6 seconds now. Not gonna post values, I suspect discord devs frequent this.

AnonymousMurid commented 3 years ago

Increase randomization time max and search time, otherwise you'll get API rate limited for 6 seconds now. Not gonna post values, I suspect discord devs frequent this.

I'm new to this platform and have little to no programming experience. Could you explain how to increase randomization time? I'm concerned about my account being disabled, however I have 175,000 DM messages I wish to delete. I would appreciate your help a lot. I understand if you don't wish to speak openly about this because I share your suspicions too.

Hope to hear from you soon.

0xpr03 commented 3 years ago

Exchange the wait function line with the following: const wait = async ms => new Promise(done => setTimeout(done, ms+getRandomIntInclusive(MIN_VALUE,MAX_VALUE))); and add the right value, pretty easy to figure out. Also add the random function to the bottom

function getRandomIntInclusive(min, max) {
  min = Math.ceil(min);
  max = Math.floor(max);
  return Math.floor(Math.random() * (max - min + 1) + min); //The maximum is inclusive and the minimum is inclusive
}

Eratas commented 3 years ago

200 ms search delay and 2000 ms delete delay is the sweet spot for me, otherwise I get rate limited.

Edit: This can cause some bots to crash and raise complaints, I suggest to increase both delays.

aaa234243 commented 3 years ago

Exchange the wait function line with the following: const wait = async ms => new Promise(done => setTimeout(done, ms+getRandomIntInclusive(MIN_VALUE,MAX_VALUE))); and add the right value, pretty easy to figure out. Also add the random function to the bottom
function getRandomIntInclusive(min, max) {
  min = Math.ceil(min);
  max = Math.floor(max);
  return Math.floor(Math.random() * (max - min + 1) + min); //The maximum is inclusive and the minimum is inclusive
}

Does this stop the recent issue of being rate limited quickly into deleting, using the standard 100ms 1000ms search & import delay? @0xpr03

0xpr03 commented 3 years ago

Does this stop the recent issue of being rate limited quickly into deleting, using the standard 100ms 1000ms search & import delay?

Not really, as you'll have to provide enough min/max delay for that to stop showing but, generally @Eratas values could work, just increase the min if you're having problems.

Eratas commented 3 years ago

And also make sure that channels aren't linked to other servers through bots, and that they're logging your delete requests, otherwise this will cause massive outage and probably result into a ban or something worst.

victornpb / undiscord

[Information] Got my account suspended #193