How to Detect Selfbots in Your Discord Server

A selfbot is automation running on an ordinary user account instead of through Discord’s official bot API. It logs in with a user token and mimics a person — sending messages, reacting, joining giveaways, scraping channels, auto-replying. Because it runs on a normal account, it has no BOT tag. Everything you’d normally use to spot a bot is exactly what a selfbot is built to hide.

That is the whole problem. The advice you’ll find for “spotting a Discord bot” — look for the badge, check for a blank profile — is written for labeled bots and is useless against a selfbot, whose entire purpose is to pass as a member. Detecting one means looking at behavior over time, not at the profile.

Selfbots also violate Discord’s Terms of Service: automating a user account outside the official OAuth2/bot API is prohibited and is grounds for account termination. So the accounts running them are, by definition, already operating against the rules — which is useful context when you decide what to do with one.

What a selfbot looks like from the moderator’s chair

You will rarely catch a selfbot from a single message. You catch it from a pattern. The signals below are the ones that survive an account trying to look human:

Timing and rhythm

Inhuman consistency. Messages or reactions spaced with machine-like regularity, or activity that continues at a steady cadence across all 24 hours with no realistic sleep gap. Humans are bursty and irregular; automation is smooth.
Sub-human reaction latency. Reacting to a giveaway, a role-react, or a keyword within a few hundred milliseconds, repeatedly. A person doesn’t win every fastest-finger event.
Activity that never tapers. Real members slow down when they’re tired, busy, or asleep. An account that holds the same posting rate at 4am local time as at 8pm is suspicious.

Lifecycle

New account, immediate sophistication. An account days or weeks old that behaves like a power user — knows commands, hits giveaways, navigates many channels — without the ramp-up a real new member shows.
Joins many servers fast. Selfbots are often pointed at dozens of communities. The same account turning up across unrelated servers in a short window is a strong tell (and the one signal a single server literally cannot see on its own).

Content behavior (the shape, not the words)

Repetition. The same link, phrase, or image posted across channels or servers with small variations.
Command/trigger fixation. Activity that’s overwhelmingly bot-command invocations, giveaway entries, or keyword reactions, with little ordinary conversation in between.
Uniform message structure. Real chat varies wildly in length and shape; automated output tends to cluster.

No single signal is proof. A fast reactor might just be quick; a night-owl might genuinely be up at 4am. Selfbot detection is about several weak signals stacking up on the same account — which is also why eyeballing it doesn’t scale past a handful of suspects.

What to do right now if you think a selfbot is in your server

You do not need any third-party tool to take the first steps. In order:

Don’t act on one message. Pull the account’s recent history and look for the pattern — rhythm, hours, repetition. A single fast reaction isn’t enough to ban on.
Raise the verification floor. Server Settings → Safety Setup → set verification to High (account must be a Discord member for 10+ minutes before chatting) and enable AutoMod spam/mention rules. This won’t catch a patient selfbot, but it stops the noisy ones and buys you time.
Check cross-server presence if you can. If the same account is known to your moderators in other communities behaving the same way, that’s your strongest single signal. Networks of partnered servers should compare notes.
Time the account out before you ban. A timeout stops the automation immediately and is reversible if you’re wrong — important, because false accusations damage trust with real members.
Report it. Selfbotting breaks Discord’s ToS. You can report the account to Discord; for a confirmed automated account, a server ban is justified on its own.
Preserve evidence. Screenshot the rhythm/repetition before you ban, in case the account appeals or the user disputes it.

The hard part isn’t the action — it’s being confident enough to take it, on an account that’s designed to look like a member.

Where Gait fits

Gait is built for exactly the confidence problem above. It scores accounts by their behavior — timing, lifecycle, and content rhythm — and aggregates those signals across every server that runs Gait, so a selfbot betrays itself through cross-server patterns that no single community can see. It never reads message content (see our privacy approach); it scores the shape of behavior, not what’s said.

Each account gets a graded score from confirmed_human to confirmed_automated, with the account’s Discord identity and the reasons it was flagged — so a moderator decides the threshold and the action, rather than trusting a black-box verdict. Gait requires at least 25 data points before it scores an account, specifically so it doesn’t flag a real new member on thin evidence.

Gait does not replace your existing setup. Keep AutoMod and your verification gate; Gait adds the behavioral layer that catches the accounts those don’t — the patient automation that clears verification and then quietly does its job. For the harder case of an account that passes the gate and then behaves like a bot, see quiet automation that survives verification. For perimeter defense against join-rate raids, Wick and Gait are complementary.

Selfbotting violates Discord’s Terms of Service. This page describes how to detect and respond to selfbots in servers you moderate — not how to run one.