From d3c86d807eae40de6abb84786c582542878ff60f Mon Sep 17 00:00:00 2001 From: Ammon Smith Date: Sat, 22 Jun 2019 19:40:50 -0400 Subject: [PATCH] Add list of suspicious joins. --- id_to_snowflake.sql | 2 +- suspicious_joined_users.sql | 26 ++++++++++++++++++++++++++ 2 files changed, 27 insertions(+), 1 deletion(-) create mode 100644 suspicious_joined_users.sql diff --git a/id_to_snowflake.sql b/id_to_snowflake.sql index 574309c..f7643bd 100644 --- a/id_to_snowflake.sql +++ b/id_to_snowflake.sql @@ -3,7 +3,7 @@ -- datetime.utcfromtimestamp(((id >> 22) + DISCORD_EPOCH) / 1000) -- where DISCORD_EPOCH is 1420070400000 -CREATE FUNCTION snowflake_time(id bigint) +CREATE FUNCTION snowflake_time(id BIGINT) RETURNS TIMESTAMP WITH TIME ZONE LANGUAGE SQL AS 'SELECT to_timestamp(((id >> 22) + 1420070400000) / 1000) AS timestamp' diff --git a/suspicious_joined_users.sql b/suspicious_joined_users.sql new file mode 100644 index 0000000..68afd8c --- /dev/null +++ b/suspicious_joined_users.sql @@ -0,0 +1,26 @@ +-- Looks for suspicious new joins. +-- Specifically looks at people who made their account soon before joining, +-- and do not have the 'Member' role. + +-- Uses snowflake_time from id_to_snowflake.sql + +SELECT + users.name || '#' || users.discriminator AS username, + joined_at - snowflake_time(users.real_user_id) AS time_before_join, + snowflake_time(users.real_user_id) AS created_at, + guild_membership.joined_at, + users.real_user_id, + users.int_user_id +FROM guild_membership +JOIN users + ON guild_membership.int_user_id = users.int_user_id +LEFT JOIN ( + SELECT * + FROM role_membership + WHERE role_membership.role_id = 205477488707502081 -- Member role +) AS members + ON guild_membership.int_user_id = members.int_user_id + AND guild_membership.guild_id = members.guild_id +WHERE joined_at - snowflake_time(users.real_user_id) < '30 days'::interval + AND guild_membership.joined_at > '2019-06-22 07:22:29'::timestamp -- CHANGE ME +ORDER BY joined_at, created_at;