Everything Sculk watches, written down.
This is the whole surface, not a highlight reel. Each entry says what the server or client actually observes, so you can check our coverage against the cheats your community is running rather than against a marketing adjective.
154
Individual detections
18
Detection groups
32
Supporting subsystems
17
Hardened convars
Counted from the shipped catalogue for Sculk FiveM 3.3.0-elite.
No detection here carries a verdict
Every detection's response is yours to set. Each one can observe silently, warn, kick, ban, or open a staff review case, and each carries its own strike window and threshold. Nothing in this catalogue enforces a fixed verdict.
That is why this catalogue has no punishment column. What a detection does on your server is a setting, and most servers start every one of them in observation mode and tighten from there once they have seen a week of their own traffic.
The detection catalogue
Grouped by the surface each one watches. A Serverdetection is decided from the server's own game events, so a cheater cannot argue with it. A Client detection is reported by the game client — valuable, and defeatable by a determined attacker, which is why client reports are weighted lower by default. A Both detection corroborates one against the other.
154 shown
Aim and targeting
14 detectionsCamera, hit component and view-cone geometry compared against what the shot would have required from a human hand.
Modified hitbox
ServerHit component index falls outside the range the game can produce.
antiModifiedHitbox
No-headshot bias
ServerHits concentrate on a single body component far beyond a normal spread.
antiNoHeadshot
Aimbot
ServerDamage lands on a victim more than 135° behind the reported camera heading.
antiAimbot
Aimbot (composite)
ServerA composite score built from engagement statistics across a session rather than from any single shot.
antiAimbotAI
Soft aim
ServerMean view error sits below the threshold a human aim curve produces.
antiSoftaim
Silent aim
ServerDamage registers outside the ping-scaled view cone the shooter actually held.
antiSilentAim
Spoofed bullet
ServerReported bullet origin does not align with the camera it claims to have come from.
antiSpoofedBullet
Blocked damage
ServerDamage absorption across five or more hits with under 20% health loss.
antiBlockedDamage
No recoil
ClientPer-shot camera pitch shows recoil suppressed rather than ridden.
antiNoRecoil
Aim assist
ClientLock-on held while the player is nominally free-aiming.
antiAimAssist
Spin bot
ServerCamera rotation rates the input device cannot physically produce.
antiSpinBot
Trigger bot
ClientWeapon discharge that follows target acquisition rather than player input.
antiTriggerBot
Auto clicker
ClientSustained click rate averaging under 40ms between inputs.
antiAutoClicker
Input macro
ClientInput pattern variance under 5ms across sustained play — mechanically even rather than human.
antiMacro
Weapons and ammunition
15 detectionsWeapon packets, damage ceilings, fire rates and magazine arithmetic checked against the values the base game can produce.
Weapon spoofer
ServerImpossible packet field combinations, such as silenced fall damage or saturated damage values.
antiWeaponSpoofer
Weapon denylist
ServerWeapons on an owner-configured denylist appearing in a player's hands.
antiWeapon
Ammo ceiling
ServerAmmunition counts above the vanilla maximum of 4,500.
antiAmmo
Weapon injection
ServerGiving weapons to another player's ped.
antiAddWeapon
Weapon stripping
ServerRemoving weapons from another player's ped.
antiRemoveWeapon
Damage modifier
BothOverridden weapon damage above the configured ceiling, and reported weapon damage above the vanilla maximum of 500.
antiDamageChanger
Melee modifier
ServerMelee damage modifiers or overridden unarmed damage.
antiInfinitePunch
Explosive ammunition
ServerExplosive rounds identified by the explosion tag carried on the damage event.
antiExplosiveWeapon
Fast shoot
ServerWeapon cycling faster than the vanilla interval for that weapon.
antiFastShoot
Magic bullet
ServerA hit registered at an impossible range, correlated across both clients.
antiMagicBullet
Rapid fire
ServerSustained median shot gap below the weapon's own cycle time.
antiRapidFire
No reload
ClientMore rounds fired than the magazine holds, with no reload between them.
antiNoReload
Infinite ammo
ClientTotal ammunition never decreases across sustained fire.
antiInfiniteAmmo
Tranquilizer abuse
ServerThe tranquilizer weapon's instant-incapacitate used as a silent kill.
antiTranquilizer
Projectile abuse
ServerProjectile spam, and projectiles that arrive from outside their weapon's range.
antiProjectileAI
Movement and position
9 detectionsPosition deltas, velocity and ground state measured against the physics the engine will actually grant a player on foot.
Teleport
ServerA position jump beyond the speed-scaled allowance for that player.
antiTeleport
Waypoint teleport
ServerThe standstill–jump–standstill signature a waypoint warp leaves behind.
antiTeleportToWaypoint
Speed modifier
ServerOn-foot horizontal speed above 12 m/s.
antiSpeedChanger
Super jump
ServerThe super-jump flag set, or vertical velocity above 12 m/s.
antiSuperJump
Desync
ServerPosition desync patterns consistent with deliberate state divergence.
antiDesync
Fake lag
ServerArtificial latency and packet timing manipulation.
antiFakeLag
Ragdoll suppression
ClientRagdoll state suppressed where the engine would have applied it.
antiRagdoll
Air brake
ServerAirborne with near-constant velocity instead of falling.
antiAirBrake
Water walk
ServerStanding in water without entering the swim state.
antiWaterWalk
Player state
13 detectionsHealth, armour, visibility and ped ownership — the attributes a player should only ever change on themselves, and only within limits.
Health
BothHealth above the configured ceiling, or above the player's own maximum.
antiHealth
Armour
ServerArmour above the configured ceiling, or above the player's own maximum.
antiArmor
Godmode
BothThe invincibility flag observed across six or more samples.
antiGodmode
Invisibility
BothVisibility flag cleared, or ped alpha held below 120.
antiInvisible
Glitched player
ServerNaN coordinates, positions outside the world, or frozen-and-moving states.
antiGlitchPlayer
Mass kill
ServerMass-hit packets, absurd damage values, or hits at impossible range.
antiKill
Semi godmode
ServerDamage absorption confirmed across both clients in an engagement.
antiSemiGodmode
Client replays
ServerChecks that the sv_disableClientReplays convar is actually set.
antiReplays
Outfit change
ServerChanging the outfit on another player's ped.
antiChangeOutfit
Task clearing
ServerClearing tasks on another player's ped.
antiClearPedTasks
Infinite stamina
ServerSprinting for 60 seconds or more without a break.
antiInfiniteStamina
Voice spoof
ClientVoice range or transmission state spoofed beyond the configured bounds.
antiVoiceSpoof
Player launching
ClientForces applied to another player's ped to fling them across the map.
antiLaunchPlayer
Vehicles
22 detectionsThe widest surface in the catalogue: speed, handling, health, cosmetics and ownership, each measured against the vehicle's own class limits.
Vehicle godmode
ServerAn auto-repair loop, or vehicle health above the 1,000 cap.
antiVehicleGodmode
Plate change
ServerThe number plate changed on a vehicle that already existed.
antiPlate
Horn boost
ClientSpeed above the vehicle maximum while the horn is held.
antiHornBoost
Vehicle jump
ServerVertical velocity above 25 m/s.
antiVehicleJump
Vehicle modifier
ServerSustained speed above 306 km/h.
antiVehicleModifier
Moving spawn
ServerA vehicle that arrives already in motion.
antiShootVehicle
Vehicle flooding
ServerSix or more vehicles spawned within eight seconds.
antiVehicle
Vehicle weapons on foot
ServerVehicle weapon damage dealt by a player who is not in a vehicle.
antiVehicleWeapons
Vehicle hijack
ServerAppearing directly in the driver seat of a moving vehicle.
antiVehicleHijack
Bulletproof tyres
ServerTyres that never burst despite taking collision damage.
antiBulletProofTires
Collision disabled
ServerDriving with vehicle collision switched off.
antiNoVehicleCollision
Handling modifier
ServerAcceleration above 30 m/s².
antiVehicleHandling
Gravity modifier
ServerAltitude held with near-zero vertical velocity.
antiVehicleGravity
Vehicle boost
ServerSpeed above the maximum for that vehicle's class.
antiVehicleBoost
Colour change
ServerColour changed on a vehicle the player does not own.
antiVehicleColorChanger
Engine repair
ServerEngine health restored instantly between sweeps.
antiVehicleEngineChanger
Body repair
ServerBody health restored instantly between sweeps.
antiVehicleArmorChanger
Livery change
ServerLivery changed on a vehicle the player does not own.
antiVehicleLivery
Window repair
ServerBroken windows restored between sweeps.
antiVehicleWindows
Dirt reset
ServerDirt level reset outside a legitimate wash.
antiCleanVehicle
Vehicle flip
ServerRotation changed by more than 90° within three seconds.
antiFlipVehicle
Vehicle teleport
ServerAn occupied vehicle moved more than 200m within two seconds.
antiVehicleTeleport
Explosions
6 detectionsExplosion type, ownership and audibility checked against the projectile or vehicle that should have caused them.
Malformed explosion
ServerAn explosion type outside the valid range of −1 to 83.
antiMalformedExplosions
Explosion spoofer
ServerA vehicle tag with no vehicle, or ordnance with no projectile behind it.
antiExplosionSpoofer
Explosion denylist
ServerExplosion types on an owner-configured denylist.
antiExplosion
Invisible explosion
ServerAn explosion flagged invisible that still deals damage.
antiInvisibleExplosion
Silent explosion
ServerAn explosion flagged silent that still deals damage.
antiSilentExplosion
Phone explosion
ServerRemote detonation far from the player who sent it.
antiPhoneExplosions
Entities and world objects
13 detectionsWho created an entity, who owns it now, and whether the place it appeared makes sense for the player who made it.
Forced animation
ServerAn animation forced onto another player's ped.
antiAnims
Pickup flooding
ServerSix or more pickups created within twenty seconds.
antiPickup
Caging
ServerA cage prop placed within 12m of another player.
antiCage
Particle abuse
ServerScale above 6.0, particles on other players' peds, or a rate above 20 per ten seconds.
antiParticles
Fire abuse
ServerFires started beyond 150m, or a rate above 10 per ten seconds.
antiFire
Isolated spawn
ServerEntities created 300m or more from the player who created them.
antiIsolatedSpawn
Entity takeover
ServerMass ownership takeover — four or more entities within sixty seconds.
antiEntityTakeover
Server entity deletion
ServerA client deleting an entity the server created.
protectServerEntities
Entity state jump
ServerAn unoccupied entity moving 300m or more in a single step.
antiEntityStateChange
Malformed entity
ServerA model hash of zero, or an SLOD dummy model used as a real entity.
antiMalformedEntities
Invisible entity
ServerEntities spawned with rendering disabled so other players cannot see them.
antiInvisibleEntity
Electric fence
ClientThe damage-on-proximity field mod menus attach to a player to hurt anyone who comes near.
antiElectricFence
Entity firewall violation
ServerAn entity creation that your own firewall rules disallow, by type, population type or model. The rules are yours; this is the signal that one was broken.
antiEntityFirewall
Peds and objects
8 detectionsSpawn volume, model choice and attachment — the three ways ped and object creation is used against a server.
Ped flooding
ServerEight or more peds spawned within thirty seconds.
antiPed
Armed NPC
ServerNPCs spawned already carrying weapons.
antiNPC
Ped model change
ServerSLOD models, or four or more model changes within five minutes.
antiPedChanger
Forced ped task
ServerTasks forced onto another player's ped.
antiPedTasks
Ped attachment
ServerAn entity attached to another player's ped.
antiPedAttachments
Object flooding
ServerEight or more objects created within ten seconds.
antiObject
Object attachment
ServerAn object attached to another player.
antiAttached
Networked task injection
ServerNetworked ped tasks pushed onto players who never requested them. Where forced ped task catches the task on a ped, this catches it on the wire.
antiNetworkedTasks
Network and session
13 detectionsIdentity, connection provenance, and the integrity of the client's own reporting channel.
Ragdoll disabled
ClientRagdoll disabled while the player is on foot.
antiNoRagdoll
VPN and proxy
ServerVPN, proxy or datacentre origin identified by IP lookup.
antiVPN
Crasher
ServerMalformed event payloads used as a client crash vector.
antiCrasher
Identifier spoofing
ServerSpoofed or stripped player identifiers.
antiSpoofer
Trust escalation
ServerSeveral weak signals stacking against one player until their trust score falls through the threshold.
antiTrustEscalation
Dashboard warning
ServerA warning issued by staff from the dashboard or Discord bot.
dashboardWarn
Offline account
ServerNo Cfx.re account session behind the connection.
antiOffline
Networked sound abuse
ServerSound broadcast abused through interact-sound and similar resources.
antiNetworkedSounds
Global voice
ClientMumble proximity raised above the configured ceiling.
antiGlobalVoice
NUI blocker
BothThe anticheat's NUI frame blocked or stripped from the client.
antiNuiBlocker
Heartbeat failure
BothThe client heartbeat stops arriving while the player remains connected.
antiHeartbeat
Game event validation
ServerInbound game events checked against what the sending client is actually entitled to trigger.
antiGameEvents
State bag abuse
ServerState-bag writes rate-limited and validated, closing the desync and client-crash vector they open.
antiStateBagAbuse
Cheat menus and clients
12 detectionsThe cheat itself rather than its effect: menu textures, injected globals, tampered Lua state and known probe events.
Free camera
ServerCamera held more than 55m from the ped for fifteen seconds or longer.
antiFreecam
Noclip
BothFrozen, invisible and collisionless while still changing position, or floating more than 10m above the nearest ground with no vehicle, parachute, fall or ragdoll to account for it.
antiNoclip
Spectate
BothSpectator mode entered outside the staff tooling.
antiSpectate
Cheat menu
BothRuntime menu textures, injected globals, or commands the server never registered.
antiMenu
Known exploit events
ServerExploit events fired for resources that are not on this server.
antiExploit
Bypass attempt
ServerAnticheat kill-switch events and probing for its internals.
antiBypass
Forced overlay
ClientNight-vision or thermal post-process forced on.
antiOverlay
ESP
ClientESP and aimbot globals present in the Lua state.
antiEsp
Wall hack
BothAim tracked through walls, confirmed by a line-of-sight probe.
antiWallHack
Cheat brand strings
ClientKnown cheat brand strings found in the Lua state.
antiMenuOCR
Hooked natives
BothGame natives returning values they cannot legitimately return.
antiHookNatives
Tampered environment
ClientThe client Lua environment has been modified, or the resource's own Lua files no longer checksum against the baseline taken when they loaded.
antiTamperedEnv
Injectors
3 detectionsControl events and payloads that belong to injector tooling rather than to any resource your server runs.
Injector control events
ServerInjector control events fired at the server.
antiTrigger
Troll sound payloads
ServerKnown troll sound payloads broadcast to other players.
antiPlaySound
Unsent client resources
BothClient resources running that the server never sent.
antiInjector
Resource integrity
5 detectionsYour own resource list as an attack surface: backdoors in stock resources, events for resources you do not run, and protected resources being stopped.
Backdoor signatures
ServerKnown backdoor signatures found inside stock resources.
resourceProtection
Illegal entity
ServerTrain spawns, zero-model entities, and entity floods.
antiIllegalEntity
Illegal trigger
ServerEvents fired for resources that are not present on this server.
antiIllegalTrigger
Illegal weapon use
ServerDamage attributed to a weapon the player is not holding.
antiIllegalWeaponUse
Protected resource stopped
ServerThe anticheat or another protected resource being stopped.
antiResourceStop
Moderation
7 detectionsNames and chat, including the cheat advertising that usually arrives before the cheating does.
Blocked words
ServerConfigured words plus cheat-advertising signatures in chat.
antiBlacklistWords
Blocked names
ServerConfigured strings appearing in player names.
antiBlacklistName
Markup injection
ServerMarkup injection attempted through chat or player names.
antiXSS
Non-alphanumeric name
ServerControl characters, colour codes and non-ASCII in player names.
antiNonAlphanumericName
Chat spam
ServerChat flooding and repeated identical messages.
antiChatBot
Correlated crashes
ServerMass client crashes correlated to one player's activity.
antiSuspiciousCrash
Boosting
ServerKill/death ratios consistent with a paid boosting service rather than with play. A fair-play signal, not a cheat signature.
antiBoost
Connection filters
7 detectionsThe connection gate. These run before a player is in the world, so a rejected connection never becomes an incident.
Proxy and VPN gate
ServerEnhanced proxy and VPN identification at the connection gate.
antiProxyDetect
IP blocklist
ServerBlocked addresses and CIDR ranges.
antiIPBlacklist
Connection flood
ServerConnection bombing prevention at the gate.
antiConnectionFlood
Discord requirement
ServerRequires a Discord-linked Cfx.re account.
antiDiscordFilter
Token requirement
ServerRequires a minimum number of CFX hardware tokens.
antiForceTokens
Country filter
ServerGeo-IP allow and block lists by country code.
antiCountryFilter
DMA and external cheats
1 detectionHardware and out-of-process cheats, which leave no trace inside the game client and can only be read from the behaviour they produce in play.
DMA
BothMechanical precision, snap analysis and variance clustering across a session.
antiDMA
Client integrity and anti-tamper
1 detectionWhether the game files and the client-side half of the anticheat are still the ones that shipped. The tamper and native-hook checks themselves are listed under cheat menus and clients.
Pure mode
ClientRequires clients to run unmodified game files, rejecting patched installs. Pairs with the sv_pureLevel setting below.
pureMode
Anti-evasion
3 detectionsWhat happens after a ban: the reconnection, the new account and the new hardware token are themselves the signal.
Identity cycling
ServerReconnection patterns tracked across rolling 24-hour windows.
identityCycling
Account hopping
ServerOne IP address presenting three or more different identities.
accountHopping
Token rotation
ServerFresh hardware tokens presented on every reconnect.
tokenRotation
Vision overlays
2 detectionsPost-process vision modes forced on outside the situations your server grants them.
Night vision
BothThe night-vision overlay forced on.
antiNightVision
Thermal vision
BothThe thermal-vision overlay forced on.
antiThermalVision
The machinery underneath
A detection is only as useful as the identity it is attached to and the record it lands in. These are the subsystems that decide who a player is, keep the catalogue honest, and make an incident reviewable a week later.
Core infrastructure
19 systemsLicensing, identity and the ban record — the layer that decides who a player is before any detection has an opinion about them.
- Licence key activation
- Activates against the Sculk API with a stable server identity binding.
- Heartbeat
- A 60-second interval that keeps the session alive and picks up revocations and upgrades.
- Dashboard feed
- Telemetry, player roster, resource list and console feed.
- Dashboard commands
- Delete vehicles, peds and objects, capture screenshots, and announce messages.
- Multi-identifier extraction
- license, license2, discord, fivem, steam, live, xbl and ip.
- CFX hardware tokens
- Server-issued tokens, which cannot be forged from Lua.
- Stable key generation
- A license → token → src fallback chain.
- Persistent ban store
- bans.json with hardware fingerprinting.
- Alt-account cascade banning
- Automatically bans known alternate accounts of a banned player.
- Token-match threshold
- Configurable token matching, defaulting to two.
- Global ban database
- Cross-server ban sharing through the API.
- Ban sync
- Bidirectional synchronisation between the dashboard and the server.
- Trust scoring
- A 100-point scale with weighted penalties per detection class.
- Multi-signal escalation
- Trust under 25 combined with five or more unique detections escalates on its own.
- Confidence-based capping
- Deterministic, claim, policy and statistical signals each cap at a different maximum response.
- Client report capping
- Client-originated reports are capped at the lowest response unless you opt in.
- Excuse system
- Resources declare legitimate activity so it does not read as a detection.
- Strike system
- Per-detection hit counting inside configurable time windows.
- Webhook integration
- Separate Discord webhooks per response class, plus connect and disconnect.
Infrastructure subsystems
13 systemsThe machinery the detections run on: authentication, rate limiting, evidence, and the monitoring that tells you when a detection has gone quiet.
- Challenge–response auth
- A chained multi-round hash protocol; each response is folded into the next challenge.
- Event firewall
- Per-player rate limits across 18 game event types. Events over the limit are dropped or flagged.
- Detection health monitor
- Every loop and handler pings a health tracker, which alerts on stale or broken detections.
- Anti-evasion system
- Tracks identity changes, reconnection patterns and account hopping.
- Spectate tracker
- Records who spectated whom, and identifies spectate bombing — more than five targets in thirty seconds.
- Server hardening advisor
- Checks twelve critical convars at boot and reports the holes.
- Entity firewall
- Rule-based entity control by type, model and population.
- Whitelist zones
- Areas in which specific detections are switched off.
- Evidence system
- Per-player detection history with a replay trace.
- Screenshot capture
- Game-view capture attached to detection events.
- REST API
- An HTTP API for external integration.
- Trigger system
- Owner-authored triggers evaluated at connection and at log time.
- Reputation system
- Connection gate reputation modes: none, loose, standard, strict and whitelist.
Hardening the engine itself
Some attacks are closed by configuration rather than by detection. Sculk checks these at boot and reports the ones your server.cfg leaves open — closing them removes whole categories of abuse before any detection has to notice.
| Setting | Value | What it closes |
|---|---|---|
| onesync | on | Required for entity tracking. |
| sv_entityLockdown | strict | Prevents unauthorised entity spawning. |
| sv_protectServerEntities | true | Prevents clients deleting server-created entities. |
| sv_filterRequestControl | 4 | Blocks all entity control requests. |
| sv_stateBagStrictMode | true | Refuses all client state-bag writes. |
| sv_scriptHookAllowed | false | Blocks native trainers. |
| sv_enableNetworkedSounds | false | Removes the sound-broadcast vector. |
| sv_enableNetworkedScriptEntityStates | false | Blocks client entity state pushes. |
| sv_enableNetworkedPhoneExplosions | false | Removes the phone explosion vector. |
| sv_authMinTrust | 4 | Requires an externally attested identifier. |
| sv_authMaxVariance | 2 | Rejects easily changed identities. |
| sv_pureLevel | 2 | Blocks modified client files. |
| sv_requestParanoia | 2 | Mitigates proxy and HTTP abuse. |
| game_sanitizeRagdollEvents | true | Prevents forced-ragdoll cheats. |
| game_sanitizePlayerAttachment | 2 | Blocks entity attachments to players. |
| game_enableVehicleHijackFix | true | Prevents vehicle hijack cheats. |
| block_net_game_event | 10 events | Blocks pickup, weapon and vehicle abuse events. |
Coverage is the easy half. The record is the hard half.
A list this long is only worth anything if what it produces is readable by a moderator at 2am. The rollout guides cover how an incident reaches your staff and what they see when it does.
Catalogue for Sculk FiveM 3.3.0-elite. Detections are added and refined over time — the changelog records every change to this list.
