A bot that watches for scammers has to read things. This page says exactly which things, how long they are kept, and what M.A.P. will not do under any circumstances.
M.A.P. used to require a server to be whitelisted before it would do anything. That is no longer true, and the site said otherwise for longer than it should have. Here is the current state, read out of the code rather than remembered.
The directory, flex cards, the market views, Radar floors, the Arena, sports lines, the shop, news, member cards and leaderboards — and Shield's link scanning, nuke prevention, invite tracking and ban syncing. Add M.A.P. and they work. No application, no role, no payment.
Pro Token Analysis and Wallet Check. A Puffsterz or Vibe Tribe role, re-read from Discord on every single use. There is no payment path to these and no amount held reaches M.A.P. administration.
Registering a project token, the live token panel, the project price line, and the signal rules members arm on that token. Plus the network threat broadcast, which is pushed into verified servers' alert channels. Verification is free and applied for, never bought.
A server or account on the blacklist is refused everything, verified or not. That is now the only door M.A.P. closes by default. There are currently no blacklisted servers.
Checked as they are posted, for links and for known scam phrasing (fake support, seed-phrase requests, "validate your wallet" lures). The text is examined in memory and is not stored. Only the outcome is kept — that a message was flagged, not what it said.
Checked against eight threat intelligence sources plus the age of the domain. New domains are treated with suspicion, because drainer sites usually are new.
Account age and other risk indicators are scored when someone joins. Join bursts are tracked per invite, which is how a raid is spotted.
Compared against staff and known-project identities. Renaming to impersonate support is the most common attack in a Web3 server.
Watched for mass destructive actions, so a server being taken apart raises an alarm while it is happening.
Never. M.A.P. does not receive them and could not read them.
When a wallet address is posted publicly in a channel M.A.P. can see, it is recorded along with the account that posted it, the server and the channel. This happens automatically and without a notification.
The reason is sybil abuse. M.A.P. runs a referral reward programme, and the obvious way to attack one is to run twenty accounts and claim twenty times. Those accounts look unrelated — different names, different join dates — right up until two of them post the same wallet. That shared address is the only reliable thread between them.
No custody, no routing, no cut, no fees. Tips and donations go wallet to wallet and M.A.P. is not in the middle of them.
It never executes a trade, signs a transaction, mints, stakes or claims. The wallet door signs a line of text to prove ownership — not a transaction, no fee, nothing moves.
Never, for any reason. Anyone asking for one in the name of M.A.P. is stealing from you.
M.A.P. does not request the permission that would let it join a server on your behalf.
Covered above, and worth repeating.
Two kinds of administrator exist and they are never blurred together.
Anyone with Manage Server in their own server. They can set M.A.P. up there: channels, features, switches. That is the whole of it.
Three hardcoded accounts. Nothing else reaches it — not a server role, not Manage Server, not a wallet, and not any quantity of anything held.
If you find a way to get M.A.P. to do something it should not, or you think your data has been handled wrongly, say so and it will be looked at properly.
M.A.P.