diff --git a/id_to_snowflake.sql b/id_to_snowflake.sql
index 574309c..f7643bd 100644
--- a/id_to_snowflake.sql
+++ b/id_to_snowflake.sql
@@ -3,7 +3,7 @@
 --  datetime.utcfromtimestamp(((id >> 22) + DISCORD_EPOCH) / 1000)
 -- where DISCORD_EPOCH is 1420070400000
 
-CREATE FUNCTION snowflake_time(id bigint)
+CREATE FUNCTION snowflake_time(id BIGINT)
     RETURNS TIMESTAMP WITH TIME ZONE
     LANGUAGE SQL
     AS 'SELECT to_timestamp(((id >> 22) + 1420070400000) / 1000) AS timestamp'
diff --git a/suspicious_joined_users.sql b/suspicious_joined_users.sql
new file mode 100644
index 0000000..68afd8c
--- /dev/null
+++ b/suspicious_joined_users.sql
@@ -0,0 +1,26 @@
+-- Looks for suspicious new joins.
+-- Specifically looks at people who made their account soon before joining,
+-- and do not have the 'Member' role.
+
+-- Uses snowflake_time from id_to_snowflake.sql
+
+SELECT
+    users.name || '#' || users.discriminator AS username,
+    joined_at - snowflake_time(users.real_user_id) AS time_before_join,
+    snowflake_time(users.real_user_id) AS created_at,
+    guild_membership.joined_at,
+    users.real_user_id,
+    users.int_user_id
+FROM guild_membership
+JOIN users
+    ON guild_membership.int_user_id = users.int_user_id
+LEFT JOIN (
+    SELECT *
+    FROM role_membership
+    WHERE role_membership.role_id = 205477488707502081 -- Member role
+) AS members
+    ON guild_membership.int_user_id = members.int_user_id
+    AND guild_membership.guild_id = members.guild_id
+WHERE joined_at - snowflake_time(users.real_user_id) < '30 days'::interval
+    AND guild_membership.joined_at > '2019-06-22 07:22:29'::timestamp -- CHANGE ME
+ORDER BY joined_at, created_at;