> For the complete documentation index, see [llms.txt](https://daxeon.gitbook.io/daxeon-knowledge-hub/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://daxeon.gitbook.io/daxeon-knowledge-hub/pocket-dax/findings.md). # Findings Every finding Pocket Dax can put on a card, what triggers it, and why it matters. {% hint style="warning" %} **Public beta.** We change the findings as we learn which ones catch scams, so the wording on your card may be ahead of this page. {% endhint %} A finding is one bold line saying what Pocket Dax saw, and a smaller line underneath saying why that matters. The first set comes from **Check User** and is about the account. The second set comes from **Check Message** and is about the message itself. Check Message shows both, because it checks the author too. None of these prove anything on their own. Plenty of real people have new accounts and default avatars. A finding is there to make you look twice before you click or reply. *** ## About the user ### Flagged as a scammer > **Flagged as a scammer in 3 communities**\ > Two or more Daxeon communities flagged this account. Daxeon servers can mark an account as a scammer. When two or more unrelated communities have done that, Pocket Dax calls it. This is the strongest finding on the list. ### Flagged > **Flagged in one community**\ > A moderator marked this account. One Daxeon community flagged the account. One flag can be a mistake or a grudge, so this is weaker than the finding above, and worth knowing about all the same. ### New account > **Account created 4 days ago**\ > Scam accounts are often days old. The account is under 30 days old. Scammers lose accounts to bans and make fresh ones, so the account DMing you often did not exist last month. ### Staff or support name > **Name looks like a staff or support role**\ > Real staff rarely DM first. The name contains a role word: admin, administrator, moderator, mod, support, help desk, staff, owner, manager or official. Real staff of a server almost never open a DM with you. People calling themselves support in your DMs want your password or a code from your authenticator. ### Lookalike name > **Name mixes alphabets to look like another name**\ > Lookalike letters disguise a copied name. The name mixes scripts, for example a Cyrillic "о" in an otherwise Latin name. That is how "Discord Suppоrt" gets past a glance. A name that mixes scripts is rare outside impersonation. ### Server impersonation > **Name resembles the `Daxeon` server you are in**\ > Impersonating a community you trust. The account's name is close to the name of a server you are a member of. Needs [/connect](/daxeon-knowledge-hub/pocket-dax/commands.md#connect), because that is how Pocket Dax learns your server list. ### Avatar impersonation > **Avatar matches the `Daxeon` server icon**\ > Borrowing a trusted community's identity. The account's avatar is the icon of a server you are in, or a near copy of it. Also needs [/connect](/daxeon-knowledge-hub/pocket-dax/commands.md#connect). ### Default avatar > **Default avatar on an account older than 30 days**\ > Throwaway accounts rarely get set up. The account has been around for over a month and still has Discord's default avatar. On its own this is weak. Next to a support-sounding name or a shortened link it fits a pattern. *** ## About the message ### Known dangerous site > **evil-nitro.com is a known dangerous site**\ > This site has been reported for phishing or scams. The link's domain is on a blocklist of sites reported for phishing or scams. Do not open it. ### Masked link > **Link text shows `discord.gift/nitro` but opens `dlscord-nitro.com`**\ > The familiar name hides the real destination. The visible text of the link is itself a URL, and it is a different URL from where the link opens. Discord lets you write a link as `[text](url)`, and scammers write a trusted address as the text. ### Redirect to another site > **`short.example` redirects to `dlscord-nitro.com`**\ > You land somewhere other than the site named. Pocket Dax follows each link. If the final page is on a different domain from the one in the message, the card shows both. ### Link shortener > **A link goes through bit.ly**\ > Shorteners hide where a link goes. The link goes through a URL shortener. Honest links go through shorteners too, so on its own this proves little. A shortened link from a stranger deserves a hover before a click, since the short address tells you nothing about where it goes. ### New domain > **`dlscord-nitro.com` was registered 2 days ago**\ > Scam sites are usually days old. The domain was registered within the last 30 days. Phishing sites get reported and taken down fast, so the scammers register new ones constantly. A legitimate company's site is rarely a few days old. ### Plain-text domain > **dlscord-nitro.com is written as plain text**\ > A common way around link filters. The message contains a domain written without `https://`, so Discord does not turn it into a link. Scammers do this to slip past server link filters, and tell you to copy and paste it instead. ### Hidden link > **Link text `Claim here` opens `dlscord-nitro.com`**\ > The text does not show where the link goes. The link text is ordinary words, so you cannot see the destination without hovering. Pocket Dax shows it. ### Support server invite > **Invite to a support-named server: Discord Support Center**\ > Fake support servers are used to steal wallets and accounts. The message invites you to a server whose name sounds like a support desk. Fake support servers walk you through "verification" steps that hand over your account. ### Server invite > **Invite to `Free Nitro Giveaways`**\ > Scammers move their targets into servers they control. The message contains a Discord invite. The card shows the server name and member count when Discord provides them. An invite in an unsolicited DM is a common first step, because the scammer controls everything inside their own server. ### Payment address > **Contains a BTC address**\ > Unsolicited addresses are usually a request to send funds. The message contains a Bitcoin, Ethereum or Cardano address. Someone you did not ask sending you an address is asking you to send them money. ### Scam wording > **Phrases: free nitro, verify your account**\ > Wording seen in giveaway, airdrop, and verification scams. The message uses phrases that show up in giveaway and verification scams. The card lists the phrases it matched. Ordinary chat can trip it, so read it together with the others. *** ## When nothing is found A clean card says "Nothing stood out." under the Findings heading. Every user card ends with "Absence of reports does not guarantee safety." and every message card with "Patterns detected do not guarantee malicious intent." Both are true. Use the card as one input, and trust your own read of the conversation.