diff --git a/suspicious-users/join-command.sql b/suspicious-users/join-command.sql
new file mode 100644
index 0000000..f25824b
--- /dev/null
+++ b/suspicious-users/join-command.sql
@@ -0,0 +1,19 @@
+-- Looks for people who send '!join' right after joining,
+-- and then deleted it soon after.
+
+-- Uses snowflake_time from id_to_snowflake.sql
+
+SELECT
+    users.name || '#' || users.discriminator AS username,
+    snowflake_time(users.real_user_id) AS created_at,
+    messages.created_at AS message_sent,
+    messages.deleted_at AS message_deleted,
+    users.real_user_id,
+    users.int_user_id
+FROM messages
+JOIN users
+    ON messages.int_user_id = users.int_user_id
+WHERE messages.content = '!join'
+    AND messages.channel_id = 209074609893408768 -- #join
+    AND messages.deleted_at IS NOT NULL
+    AND messages.deleted_at - messages.created_at < '4 minutes'::interval;
diff --git a/suspicious-users/join-date.sql b/suspicious-users/join-date.sql
index e47db0f..3ab36f8 100644
--- a/suspicious-users/join-date.sql
+++ b/suspicious-users/join-date.sql
@@ -1,5 +1,4 @@
--- Looks for suspicious new joins.
--- Specifically looks at people who made their account soon before joining,
+-- Looks for people who made their account soon before joining,
 -- and do not have the 'Member' role.
 
 -- Uses snowflake_time from id_to_snowflake.sql
@@ -22,6 +21,7 @@ LEFT JOIN (
     ON guild_membership.int_user_id = members.int_user_id
     AND guild_membership.guild_id = members.guild_id
 WHERE joined_at - snowflake_time(users.real_user_id) < '30 days'::interval
+    AND guild_membership.guild_id = 181866934353133570 -- Programming
     AND guild_membership.joined_at > '2019-06-22 07:22:29'::timestamp -- CHANGE ME
     AND guild_membership.is_member = true
 ORDER BY joined_at, created_at;