Skip to content

Everything Sculk watches, written down.

This is the whole surface, not a highlight reel. Each entry says what the server or client actually observes, so you can check our coverage against the cheats your community is running rather than against a marketing adjective.

154

Individual detections

18

Detection groups

32

Supporting subsystems

17

Hardened convars

Counted from the shipped catalogue for Sculk FiveM 3.3.0-elite.

No detection here carries a verdict

Every detection's response is yours to set. Each one can observe silently, warn, kick, ban, or open a staff review case, and each carries its own strike window and threshold. Nothing in this catalogue enforces a fixed verdict.

That is why this catalogue has no punishment column. What a detection does on your server is a setting, and most servers start every one of them in observation mode and tighten from there once they have seen a week of their own traffic.

The detection catalogue

Grouped by the surface each one watches. A Serverdetection is decided from the server's own game events, so a cheater cannot argue with it. A Client detection is reported by the game client — valuable, and defeatable by a determined attacker, which is why client reports are weighted lower by default. A Both detection corroborates one against the other.

154 shown

Aim and targeting

14 detections

Camera, hit component and view-cone geometry compared against what the shot would have required from a human hand.

Modified hitbox

Server

Hit component index falls outside the range the game can produce.

antiModifiedHitbox

No-headshot bias

Server

Hits concentrate on a single body component far beyond a normal spread.

antiNoHeadshot

Aimbot

Server

Damage lands on a victim more than 135° behind the reported camera heading.

antiAimbot

Aimbot (composite)

Server

A composite score built from engagement statistics across a session rather than from any single shot.

antiAimbotAI

Soft aim

Server

Mean view error sits below the threshold a human aim curve produces.

antiSoftaim

Silent aim

Server

Damage registers outside the ping-scaled view cone the shooter actually held.

antiSilentAim

Spoofed bullet

Server

Reported bullet origin does not align with the camera it claims to have come from.

antiSpoofedBullet

Blocked damage

Server

Damage absorption across five or more hits with under 20% health loss.

antiBlockedDamage

No recoil

Client

Per-shot camera pitch shows recoil suppressed rather than ridden.

antiNoRecoil

Aim assist

Client

Lock-on held while the player is nominally free-aiming.

antiAimAssist

Spin bot

Server

Camera rotation rates the input device cannot physically produce.

antiSpinBot

Trigger bot

Client

Weapon discharge that follows target acquisition rather than player input.

antiTriggerBot

Auto clicker

Client

Sustained click rate averaging under 40ms between inputs.

antiAutoClicker

Input macro

Client

Input pattern variance under 5ms across sustained play — mechanically even rather than human.

antiMacro

Weapons and ammunition

15 detections

Weapon packets, damage ceilings, fire rates and magazine arithmetic checked against the values the base game can produce.

Weapon spoofer

Server

Impossible packet field combinations, such as silenced fall damage or saturated damage values.

antiWeaponSpoofer

Weapon denylist

Server

Weapons on an owner-configured denylist appearing in a player's hands.

antiWeapon

Ammo ceiling

Server

Ammunition counts above the vanilla maximum of 4,500.

antiAmmo

Weapon injection

Server

Giving weapons to another player's ped.

antiAddWeapon

Weapon stripping

Server

Removing weapons from another player's ped.

antiRemoveWeapon

Damage modifier

Both

Overridden weapon damage above the configured ceiling, and reported weapon damage above the vanilla maximum of 500.

antiDamageChanger

Melee modifier

Server

Melee damage modifiers or overridden unarmed damage.

antiInfinitePunch

Explosive ammunition

Server

Explosive rounds identified by the explosion tag carried on the damage event.

antiExplosiveWeapon

Fast shoot

Server

Weapon cycling faster than the vanilla interval for that weapon.

antiFastShoot

Magic bullet

Server

A hit registered at an impossible range, correlated across both clients.

antiMagicBullet

Rapid fire

Server

Sustained median shot gap below the weapon's own cycle time.

antiRapidFire

No reload

Client

More rounds fired than the magazine holds, with no reload between them.

antiNoReload

Infinite ammo

Client

Total ammunition never decreases across sustained fire.

antiInfiniteAmmo

Tranquilizer abuse

Server

The tranquilizer weapon's instant-incapacitate used as a silent kill.

antiTranquilizer

Projectile abuse

Server

Projectile spam, and projectiles that arrive from outside their weapon's range.

antiProjectileAI

Movement and position

9 detections

Position deltas, velocity and ground state measured against the physics the engine will actually grant a player on foot.

Teleport

Server

A position jump beyond the speed-scaled allowance for that player.

antiTeleport

Waypoint teleport

Server

The standstill–jump–standstill signature a waypoint warp leaves behind.

antiTeleportToWaypoint

Speed modifier

Server

On-foot horizontal speed above 12 m/s.

antiSpeedChanger

Super jump

Server

The super-jump flag set, or vertical velocity above 12 m/s.

antiSuperJump

Desync

Server

Position desync patterns consistent with deliberate state divergence.

antiDesync

Fake lag

Server

Artificial latency and packet timing manipulation.

antiFakeLag

Ragdoll suppression

Client

Ragdoll state suppressed where the engine would have applied it.

antiRagdoll

Air brake

Server

Airborne with near-constant velocity instead of falling.

antiAirBrake

Water walk

Server

Standing in water without entering the swim state.

antiWaterWalk

Player state

13 detections

Health, armour, visibility and ped ownership — the attributes a player should only ever change on themselves, and only within limits.

Health

Both

Health above the configured ceiling, or above the player's own maximum.

antiHealth

Armour

Server

Armour above the configured ceiling, or above the player's own maximum.

antiArmor

Godmode

Both

The invincibility flag observed across six or more samples.

antiGodmode

Invisibility

Both

Visibility flag cleared, or ped alpha held below 120.

antiInvisible

Glitched player

Server

NaN coordinates, positions outside the world, or frozen-and-moving states.

antiGlitchPlayer

Mass kill

Server

Mass-hit packets, absurd damage values, or hits at impossible range.

antiKill

Semi godmode

Server

Damage absorption confirmed across both clients in an engagement.

antiSemiGodmode

Client replays

Server

Checks that the sv_disableClientReplays convar is actually set.

antiReplays

Outfit change

Server

Changing the outfit on another player's ped.

antiChangeOutfit

Task clearing

Server

Clearing tasks on another player's ped.

antiClearPedTasks

Infinite stamina

Server

Sprinting for 60 seconds or more without a break.

antiInfiniteStamina

Voice spoof

Client

Voice range or transmission state spoofed beyond the configured bounds.

antiVoiceSpoof

Player launching

Client

Forces applied to another player's ped to fling them across the map.

antiLaunchPlayer

Vehicles

22 detections

The widest surface in the catalogue: speed, handling, health, cosmetics and ownership, each measured against the vehicle's own class limits.

Vehicle godmode

Server

An auto-repair loop, or vehicle health above the 1,000 cap.

antiVehicleGodmode

Plate change

Server

The number plate changed on a vehicle that already existed.

antiPlate

Horn boost

Client

Speed above the vehicle maximum while the horn is held.

antiHornBoost

Vehicle jump

Server

Vertical velocity above 25 m/s.

antiVehicleJump

Vehicle modifier

Server

Sustained speed above 306 km/h.

antiVehicleModifier

Moving spawn

Server

A vehicle that arrives already in motion.

antiShootVehicle

Vehicle flooding

Server

Six or more vehicles spawned within eight seconds.

antiVehicle

Vehicle weapons on foot

Server

Vehicle weapon damage dealt by a player who is not in a vehicle.

antiVehicleWeapons

Vehicle hijack

Server

Appearing directly in the driver seat of a moving vehicle.

antiVehicleHijack

Bulletproof tyres

Server

Tyres that never burst despite taking collision damage.

antiBulletProofTires

Collision disabled

Server

Driving with vehicle collision switched off.

antiNoVehicleCollision

Handling modifier

Server

Acceleration above 30 m/s².

antiVehicleHandling

Gravity modifier

Server

Altitude held with near-zero vertical velocity.

antiVehicleGravity

Vehicle boost

Server

Speed above the maximum for that vehicle's class.

antiVehicleBoost

Colour change

Server

Colour changed on a vehicle the player does not own.

antiVehicleColorChanger

Engine repair

Server

Engine health restored instantly between sweeps.

antiVehicleEngineChanger

Body repair

Server

Body health restored instantly between sweeps.

antiVehicleArmorChanger

Livery change

Server

Livery changed on a vehicle the player does not own.

antiVehicleLivery

Window repair

Server

Broken windows restored between sweeps.

antiVehicleWindows

Dirt reset

Server

Dirt level reset outside a legitimate wash.

antiCleanVehicle

Vehicle flip

Server

Rotation changed by more than 90° within three seconds.

antiFlipVehicle

Vehicle teleport

Server

An occupied vehicle moved more than 200m within two seconds.

antiVehicleTeleport

Explosions

6 detections

Explosion type, ownership and audibility checked against the projectile or vehicle that should have caused them.

Malformed explosion

Server

An explosion type outside the valid range of −1 to 83.

antiMalformedExplosions

Explosion spoofer

Server

A vehicle tag with no vehicle, or ordnance with no projectile behind it.

antiExplosionSpoofer

Explosion denylist

Server

Explosion types on an owner-configured denylist.

antiExplosion

Invisible explosion

Server

An explosion flagged invisible that still deals damage.

antiInvisibleExplosion

Silent explosion

Server

An explosion flagged silent that still deals damage.

antiSilentExplosion

Phone explosion

Server

Remote detonation far from the player who sent it.

antiPhoneExplosions

Entities and world objects

13 detections

Who created an entity, who owns it now, and whether the place it appeared makes sense for the player who made it.

Forced animation

Server

An animation forced onto another player's ped.

antiAnims

Pickup flooding

Server

Six or more pickups created within twenty seconds.

antiPickup

Caging

Server

A cage prop placed within 12m of another player.

antiCage

Particle abuse

Server

Scale above 6.0, particles on other players' peds, or a rate above 20 per ten seconds.

antiParticles

Fire abuse

Server

Fires started beyond 150m, or a rate above 10 per ten seconds.

antiFire

Isolated spawn

Server

Entities created 300m or more from the player who created them.

antiIsolatedSpawn

Entity takeover

Server

Mass ownership takeover — four or more entities within sixty seconds.

antiEntityTakeover

Server entity deletion

Server

A client deleting an entity the server created.

protectServerEntities

Entity state jump

Server

An unoccupied entity moving 300m or more in a single step.

antiEntityStateChange

Malformed entity

Server

A model hash of zero, or an SLOD dummy model used as a real entity.

antiMalformedEntities

Invisible entity

Server

Entities spawned with rendering disabled so other players cannot see them.

antiInvisibleEntity

Electric fence

Client

The damage-on-proximity field mod menus attach to a player to hurt anyone who comes near.

antiElectricFence

Entity firewall violation

Server

An entity creation that your own firewall rules disallow, by type, population type or model. The rules are yours; this is the signal that one was broken.

antiEntityFirewall

Peds and objects

8 detections

Spawn volume, model choice and attachment — the three ways ped and object creation is used against a server.

Ped flooding

Server

Eight or more peds spawned within thirty seconds.

antiPed

Armed NPC

Server

NPCs spawned already carrying weapons.

antiNPC

Ped model change

Server

SLOD models, or four or more model changes within five minutes.

antiPedChanger

Forced ped task

Server

Tasks forced onto another player's ped.

antiPedTasks

Ped attachment

Server

An entity attached to another player's ped.

antiPedAttachments

Object flooding

Server

Eight or more objects created within ten seconds.

antiObject

Object attachment

Server

An object attached to another player.

antiAttached

Networked task injection

Server

Networked ped tasks pushed onto players who never requested them. Where forced ped task catches the task on a ped, this catches it on the wire.

antiNetworkedTasks

Network and session

13 detections

Identity, connection provenance, and the integrity of the client's own reporting channel.

Ragdoll disabled

Client

Ragdoll disabled while the player is on foot.

antiNoRagdoll

VPN and proxy

Server

VPN, proxy or datacentre origin identified by IP lookup.

antiVPN

Crasher

Server

Malformed event payloads used as a client crash vector.

antiCrasher

Identifier spoofing

Server

Spoofed or stripped player identifiers.

antiSpoofer

Trust escalation

Server

Several weak signals stacking against one player until their trust score falls through the threshold.

antiTrustEscalation

Dashboard warning

Server

A warning issued by staff from the dashboard or Discord bot.

dashboardWarn

Offline account

Server

No Cfx.re account session behind the connection.

antiOffline

Networked sound abuse

Server

Sound broadcast abused through interact-sound and similar resources.

antiNetworkedSounds

Global voice

Client

Mumble proximity raised above the configured ceiling.

antiGlobalVoice

NUI blocker

Both

The anticheat's NUI frame blocked or stripped from the client.

antiNuiBlocker

Heartbeat failure

Both

The client heartbeat stops arriving while the player remains connected.

antiHeartbeat

Game event validation

Server

Inbound game events checked against what the sending client is actually entitled to trigger.

antiGameEvents

State bag abuse

Server

State-bag writes rate-limited and validated, closing the desync and client-crash vector they open.

antiStateBagAbuse

Cheat menus and clients

12 detections

The cheat itself rather than its effect: menu textures, injected globals, tampered Lua state and known probe events.

Free camera

Server

Camera held more than 55m from the ped for fifteen seconds or longer.

antiFreecam

Noclip

Both

Frozen, invisible and collisionless while still changing position, or floating more than 10m above the nearest ground with no vehicle, parachute, fall or ragdoll to account for it.

antiNoclip

Spectate

Both

Spectator mode entered outside the staff tooling.

antiSpectate

Cheat menu

Both

Runtime menu textures, injected globals, or commands the server never registered.

antiMenu

Known exploit events

Server

Exploit events fired for resources that are not on this server.

antiExploit

Bypass attempt

Server

Anticheat kill-switch events and probing for its internals.

antiBypass

Forced overlay

Client

Night-vision or thermal post-process forced on.

antiOverlay

ESP

Client

ESP and aimbot globals present in the Lua state.

antiEsp

Wall hack

Both

Aim tracked through walls, confirmed by a line-of-sight probe.

antiWallHack

Cheat brand strings

Client

Known cheat brand strings found in the Lua state.

antiMenuOCR

Hooked natives

Both

Game natives returning values they cannot legitimately return.

antiHookNatives

Tampered environment

Client

The client Lua environment has been modified, or the resource's own Lua files no longer checksum against the baseline taken when they loaded.

antiTamperedEnv

Injectors

3 detections

Control events and payloads that belong to injector tooling rather than to any resource your server runs.

Injector control events

Server

Injector control events fired at the server.

antiTrigger

Troll sound payloads

Server

Known troll sound payloads broadcast to other players.

antiPlaySound

Unsent client resources

Both

Client resources running that the server never sent.

antiInjector

Resource integrity

5 detections

Your own resource list as an attack surface: backdoors in stock resources, events for resources you do not run, and protected resources being stopped.

Backdoor signatures

Server

Known backdoor signatures found inside stock resources.

resourceProtection

Illegal entity

Server

Train spawns, zero-model entities, and entity floods.

antiIllegalEntity

Illegal trigger

Server

Events fired for resources that are not present on this server.

antiIllegalTrigger

Illegal weapon use

Server

Damage attributed to a weapon the player is not holding.

antiIllegalWeaponUse

Protected resource stopped

Server

The anticheat or another protected resource being stopped.

antiResourceStop

Moderation

7 detections

Names and chat, including the cheat advertising that usually arrives before the cheating does.

Blocked words

Server

Configured words plus cheat-advertising signatures in chat.

antiBlacklistWords

Blocked names

Server

Configured strings appearing in player names.

antiBlacklistName

Markup injection

Server

Markup injection attempted through chat or player names.

antiXSS

Non-alphanumeric name

Server

Control characters, colour codes and non-ASCII in player names.

antiNonAlphanumericName

Chat spam

Server

Chat flooding and repeated identical messages.

antiChatBot

Correlated crashes

Server

Mass client crashes correlated to one player's activity.

antiSuspiciousCrash

Boosting

Server

Kill/death ratios consistent with a paid boosting service rather than with play. A fair-play signal, not a cheat signature.

antiBoost

Connection filters

7 detections

The connection gate. These run before a player is in the world, so a rejected connection never becomes an incident.

Proxy and VPN gate

Server

Enhanced proxy and VPN identification at the connection gate.

antiProxyDetect

Account sharing

Server

Multiple concurrent players from a single IP address.

antiAccountShare

IP blocklist

Server

Blocked addresses and CIDR ranges.

antiIPBlacklist

Connection flood

Server

Connection bombing prevention at the gate.

antiConnectionFlood

Discord requirement

Server

Requires a Discord-linked Cfx.re account.

antiDiscordFilter

Token requirement

Server

Requires a minimum number of CFX hardware tokens.

antiForceTokens

Country filter

Server

Geo-IP allow and block lists by country code.

antiCountryFilter

DMA and external cheats

1 detection

Hardware and out-of-process cheats, which leave no trace inside the game client and can only be read from the behaviour they produce in play.

DMA

Both

Mechanical precision, snap analysis and variance clustering across a session.

antiDMA

Client integrity and anti-tamper

1 detection

Whether the game files and the client-side half of the anticheat are still the ones that shipped. The tamper and native-hook checks themselves are listed under cheat menus and clients.

Pure mode

Client

Requires clients to run unmodified game files, rejecting patched installs. Pairs with the sv_pureLevel setting below.

pureMode

Anti-evasion

3 detections

What happens after a ban: the reconnection, the new account and the new hardware token are themselves the signal.

Identity cycling

Server

Reconnection patterns tracked across rolling 24-hour windows.

identityCycling

Account hopping

Server

One IP address presenting three or more different identities.

accountHopping

Token rotation

Server

Fresh hardware tokens presented on every reconnect.

tokenRotation

Vision overlays

2 detections

Post-process vision modes forced on outside the situations your server grants them.

Night vision

Both

The night-vision overlay forced on.

antiNightVision

Thermal vision

Both

The thermal-vision overlay forced on.

antiThermalVision

The machinery underneath

A detection is only as useful as the identity it is attached to and the record it lands in. These are the subsystems that decide who a player is, keep the catalogue honest, and make an incident reviewable a week later.

Core infrastructure

19 systems

Licensing, identity and the ban record — the layer that decides who a player is before any detection has an opinion about them.

Licence key activation
Activates against the Sculk API with a stable server identity binding.
Heartbeat
A 60-second interval that keeps the session alive and picks up revocations and upgrades.
Dashboard feed
Telemetry, player roster, resource list and console feed.
Dashboard commands
Delete vehicles, peds and objects, capture screenshots, and announce messages.
Multi-identifier extraction
license, license2, discord, fivem, steam, live, xbl and ip.
CFX hardware tokens
Server-issued tokens, which cannot be forged from Lua.
Stable key generation
A license → token → src fallback chain.
Persistent ban store
bans.json with hardware fingerprinting.
Alt-account cascade banning
Automatically bans known alternate accounts of a banned player.
Token-match threshold
Configurable token matching, defaulting to two.
Global ban database
Cross-server ban sharing through the API.
Ban sync
Bidirectional synchronisation between the dashboard and the server.
Trust scoring
A 100-point scale with weighted penalties per detection class.
Multi-signal escalation
Trust under 25 combined with five or more unique detections escalates on its own.
Confidence-based capping
Deterministic, claim, policy and statistical signals each cap at a different maximum response.
Client report capping
Client-originated reports are capped at the lowest response unless you opt in.
Excuse system
Resources declare legitimate activity so it does not read as a detection.
Strike system
Per-detection hit counting inside configurable time windows.
Webhook integration
Separate Discord webhooks per response class, plus connect and disconnect.

Infrastructure subsystems

13 systems

The machinery the detections run on: authentication, rate limiting, evidence, and the monitoring that tells you when a detection has gone quiet.

Challenge–response auth
A chained multi-round hash protocol; each response is folded into the next challenge.
Event firewall
Per-player rate limits across 18 game event types. Events over the limit are dropped or flagged.
Detection health monitor
Every loop and handler pings a health tracker, which alerts on stale or broken detections.
Anti-evasion system
Tracks identity changes, reconnection patterns and account hopping.
Spectate tracker
Records who spectated whom, and identifies spectate bombing — more than five targets in thirty seconds.
Server hardening advisor
Checks twelve critical convars at boot and reports the holes.
Entity firewall
Rule-based entity control by type, model and population.
Whitelist zones
Areas in which specific detections are switched off.
Evidence system
Per-player detection history with a replay trace.
Screenshot capture
Game-view capture attached to detection events.
REST API
An HTTP API for external integration.
Trigger system
Owner-authored triggers evaluated at connection and at log time.
Reputation system
Connection gate reputation modes: none, loose, standard, strict and whitelist.

Hardening the engine itself

Some attacks are closed by configuration rather than by detection. Sculk checks these at boot and reports the ones your server.cfg leaves open — closing them removes whole categories of abuse before any detection has to notice.

Recommended server.cfg settings and what each one closes
SettingValueWhat it closes
onesynconRequired for entity tracking.
sv_entityLockdownstrictPrevents unauthorised entity spawning.
sv_protectServerEntitiestruePrevents clients deleting server-created entities.
sv_filterRequestControl4Blocks all entity control requests.
sv_stateBagStrictModetrueRefuses all client state-bag writes.
sv_scriptHookAllowedfalseBlocks native trainers.
sv_enableNetworkedSoundsfalseRemoves the sound-broadcast vector.
sv_enableNetworkedScriptEntityStatesfalseBlocks client entity state pushes.
sv_enableNetworkedPhoneExplosionsfalseRemoves the phone explosion vector.
sv_authMinTrust4Requires an externally attested identifier.
sv_authMaxVariance2Rejects easily changed identities.
sv_pureLevel2Blocks modified client files.
sv_requestParanoia2Mitigates proxy and HTTP abuse.
game_sanitizeRagdollEventstruePrevents forced-ragdoll cheats.
game_sanitizePlayerAttachment2Blocks entity attachments to players.
game_enableVehicleHijackFixtruePrevents vehicle hijack cheats.
block_net_game_event10 eventsBlocks pickup, weapon and vehicle abuse events.

Coverage is the easy half. The record is the hard half.

A list this long is only worth anything if what it produces is readable by a moderator at 2am. The rollout guides cover how an incident reaches your staff and what they see when it does.

Catalogue for Sculk FiveM 3.3.0-elite. Detections are added and refined over time — the changelog records every change to this list.