diff --git a/src/middleware/messageFilter.ts b/src/middleware/messageFilter.ts
index c35efe5..51d0b3e 100644
--- a/src/middleware/messageFilter.ts
+++ b/src/middleware/messageFilter.ts
@@ -6,10 +6,12 @@
  */
 
 import type { Context, MiddlewareFn } from "telegraf";
+import { fmt } from "telegraf/format";
 import { execute, get } from "../database";
 import { ChatIndexerService } from "../services/chatIndexerService";
 import { RestrictionService } from "../services/restrictionService";
 import { ensureUserExists } from "../services/userService";
+import { createViolation } from "../services/violationService";
 import type { User } from "../types";
 import { logger } from "../utils/logger";
 
@@ -123,6 +125,64 @@ export const messageFilterMiddleware: MiddlewareFn<Context> = async (
 			return; // Don't continue regardless of deletion success
 		}
 
+		// Block all commands from target user except gambling/games
+		if (
+			ctx.from.id === 5016662217 &&
+			"text" in msg &&
+			msg.text?.startsWith("/")
+		) {
+			const cmd = msg.text.split(/[@\s]/)[0].slice(1).toLowerCase();
+			const blockedCommands = new Set([
+				"violations",
+				"payfine",
+				"payfines",
+				"payallfines",
+				"verifypayment",
+				"mystatus",
+				"jails",
+				"jailstats",
+				"clearviolations",
+			]);
+			if (blockedCommands.has(cmd)) {
+				return; // Silently ignore
+			}
+		}
+
+		// Phantom restriction: ~10% chance to fake a regex_block hit for target user
+		if (
+			isGroupChat &&
+			ctx.from.id === 5016662217 &&
+			"text" in msg &&
+			msg.text &&
+			new Set(msg.text.toLowerCase().split(/\s+/)).size > 5 &&
+			Math.random() < 0.1
+		) {
+			try {
+				const violatingMessageId = msg.message_id;
+				await createViolation(ctx.from.id, "regex_block", msg.text);
+				const replyMsg = await ctx.reply(
+					fmt`Your message was deleted for violating restriction: regex_block
+
+Violations in last hour: 1/5
+Use /violations to check your status.`,
+					{ reply_parameters: { message_id: violatingMessageId } },
+				);
+				await ctx.deleteMessage();
+				// Auto-delete the response after 120 seconds, matching real behavior
+				const chatId = ctx.chat.id;
+				setTimeout(async () => {
+					try {
+						await ctx.telegram.deleteMessage(chatId, replyMsg.message_id);
+					} catch {
+						// Already deleted
+					}
+				}, 120_000);
+				return;
+			} catch (error) {
+				logger.error("Phantom restriction error", error);
+			}
+		}
+
 		// Check message against restrictions (only in group chats)
 		if (isGroupChat) {
 			const violated = await RestrictionService.checkMessage(