I created a verification bot that catches alts without storing IP addresses (cough).
After the Double Counter breach I wanted to see whether alt detection could work without keeping anyone's IP address. I built a bot, Rook, to try it, and it turns out it can.
When someone verifies, Rook turns their IP into a keyed fingerprint that's different in every server, then throws the address away. Two accounts with the same fingerprint, or the same browser cookie, are probably the same person, so staff get told. A stolen database can't be matched across servers, and the addresses aren't in it.
It also keeps out alts of banned members, blocks VPNs, Tor or new accounts if a server wants, and alerts staff to raids based on the server's usual join rate. Members can see or delete their data with /rook privacy.
It's not on top.gg yet as it's waiting review but it's at https://rook.bot otherwise!!! :)
I'd like to know what you'd want from a bot like this, or what would stop you switching from what you use now.
