Lyxia actively block, contain, and clean up after attacks on TSHE. It has stopped over 500 raids and attacks. Security-sensitive detection details are deliberately not published.

How attacks are stopped

TSHE defends in three phases: detect, contain, and recover.

Detect

Lyxia watch join velocity, message volume, mention bursts, and destructive-action rates.
Automated signals surface an attack early so staff can respond quickly.
Precise thresholds and detection rules are kept private so they cannot be mapped and bypassed.

Contain

Raid accounts are rate-limited, timed out, quarantined, or removed in bulk.
Channels and roles can be locked to stop further damage.
Compromised or destructive identities have their access revoked immediately.
Staff put the server into lockdown while the threat is active.

Recover

Roles and structure can be restored from snapshots.
Mass-created clutter is cleaned up.
Damage is logged, reviewed, and the incident is recorded.
Affected members are supported and any legitimate access is restored.

How members should respond

Do not amplify — do not reply to, quote, or spread malicious posts.
Report once — alert staff with evidence and then stop interacting.
Protect your account — revoke sessions and change credentials only if your access may be affected.
Follow staff — authorized staff handle containment. Never try to fight an attack yourself.

Why is the detection logic not published?

If the exact rules and thresholds were public, attackers could tune around them. Keeping detections private lets Lyxia keep protecting the server reliably.

Active protection

Lyxia actively block, contain, and clean up after attacks on TSHE. It has stopped over 500 raids and attacks. Security-sensitive detection details are deliberately not published.

Practical guide

Attacks are handled in three phases: detect, contain, and recover. Members help most by reporting early and following staff.

Key actions

Report suspicious activity once
Do not reply to or spread malicious content
Keep your account credentials private
Follow authorized staff instructions

What should I do during an active attack?

Stop interacting, report evidence once, and let authorized staff manage containment. Never try to fight an attack yourself.

Keep in mind:

Avoid amplifying the attack
Preserve message links and screenshots
Secure your account if access may be affected