Reference
Detections
Everything Baobab AC catches, grouped by cheat domain. Detection runs server-side wherever possible, so it can't be spoofed by a tampered client. Each detection carries a severity from low to critical, and repeat offences escalate automatically.
How severity works
Severity scales with how blatant the signal is, and many detections escalate on repeat - e.g. a first rapid-fire hit may be high, a second becomes critical. Severity drives alert priority and, in
enforce mode, the action taken.Combat
Aimbot, triggerbot and damage exploits - the highest-value category for most servers.
| Detection | Severity | What it catches |
|---|---|---|
rapid_fire | high | Shots faster than a weapon physically allows (per-weapon thresholds). |
headshot_rate_anomaly | critical | >80% headshot ratio over a meaningful sample of shots. |
silent_aim | high | Hits registered without line of sight to the target. |
magic_bullet | critical | Impossible trajectory or a damage multiplier. |
v2_overdamage | high | One-shot kills / damage above a weapon’s maximum. |
ammo_increase_detected | critical | Magazine refills that never happened legitimately. |
deny_weapon | critical | Use of a blacklisted weapon or ammo type. |
v2_client_detection_missing | high | Server sees fire events but the AC client is absent - tampering. |
Health & Armor
| Detection | Severity | What it catches |
|---|---|---|
damage_immunity | critical | Player took 0 damage from a verified server-side hit (godmode). |
heal_detected | high | Instant healing - large HP gain in an impossible timeframe. |
armor_increase_detected | critical | Unauthorized armor added to a player. |
Movement
| Detection | Severity | What it catches |
|---|---|---|
teleport_event | high | Leaps over ~50m that aren’t spawn, admin, or fast-travel. |
speed_anomaly | high | On-foot speed beyond the allowed maximum (speedhack). |
superjump | high | Vertical gain far above what the game permits. |
Menu & client exploits
Mod-menu features detected on the client and confirmed server-side via the CEV validation engine.
| Detection | Severity | What it catches |
|---|---|---|
menu_detection | not active | Not shipped as an active detection. The only signal available today is a key press (DEL, INS) that legitimate RedM menus use too, so it is deliberately weighted zero and never raises an alert. Mod-menu behaviour is caught by the rows below. |
noclip_detected | critical | Moving through collision geometry. |
invisibility_detected | critical | Entity alpha below threshold / hidden flag set. |
freecam | critical | Camera detached from the player ped. |
godmode | critical | Invincibility flag active without authorization. |
spectate_mode_detected | high | Player view detached from their ped. |
nui_input_anomaly | critical | Forbidden NUI input injected. |
Entity spawn
Crash/troll attempts and loadout abuse via mod menus.
| Detection | Severity | What it catches |
|---|---|---|
mass_ped / mass_vehicle | high | Bursts of peds/vehicles spawned to crash or troll. |
explosive_spawn | critical | Explosives spawned via a mod menu. |
explosion_burst | critical | Rapid explosion bursts - crash/lag attempt. |
deny_model / deny_weapon | critical | Attempt to spawn a blacklisted model or equip a banned weapon. |
unauthorized_give | critical | Forced weapon loadout pushed from the client. |
watchlist_weapon | critical | A weapon your server never sells (Carcano, Rolling Block…) received, equipped or fired - alert only, your staff role gets pinged. |
Economy
| Detection | Severity | What it catches |
|---|---|---|
item_added | high | Large inventory gains from an unauthorized source (dupe). |
money_added | high | Cash appearing from a non-shop / non-mission source. |
money_desynced | critical | Client money cache diverges from the server (forged state). |
vorp_exp_gain | critical | Excessive XP gained in a single session. |
vorp_remote_trigger | critical | Attempt to call a forbidden remote event. |
Abuse
| Detection | Severity | What it catches |
|---|---|---|
chat_spam | medium | Too many chat messages in a short window. |
chat_word_violation | high | A blacklisted word used in chat. |
sound_spam | medium | Sound triggers flooded in a short window. |
ragdoll_abuse | medium | Continuous or repeated ragdoll abuse. |
command_bruteforce | high | Many denied commands in a short window. |
event_rate_limit | high | A network event fired far beyond its allowed rate. |
System integrity
Tamper detection that protects the anticheat itself.
| Detection | Severity | What it catches |
|---|---|---|
heartbeat_timeout | critical | The AC client script was stopped or suspended. |
forbidden_resource_detected | critical | A known cheat/mod resource is running. |
anti_dump | critical | A runtime dump attempt - an injected tool reading your resource files or honeypot events to steal server code; the dumper is crashed and banned mid-copy. (An external/native cache copy is stopped only by asset encryption.) |
hwid_spoof | critical | Mismatched machine signature - ban-evasion indicator. |
Black Box - incident replay
You no longer read an alert, you watch the scene. Every server keeps the last ~90 seconds of movement telemetry in memory; when a detection fires, that window is frozen and uploaded, and you replay it on a 2D map with a scrubbable timeline.
- Two tracks, side by side. What the game client declared, and what the server actually observed. The gap between them is measured in metres - that divergence is the mechanical proof that the client lied.
- Rewind before the detection. The buffer holds the ~45 s that PRECEDE the alert, so you see the cause, not just the consequence.
- The whole fight, not one dot. The suspect plus every player within 120 m at that moment, with their shots, hits and deaths on the timeline.
- Verdicts with numbers. Each anomaly is recomputed on the backend from the track and annotated with its figures ("41.3 m/s sustained for 3.2 s - horse maximum 15.2"). No opaque score, and no automatic sanction: the black box documents, it does not punish.
- Sealed evidence, shareable. The bundle is SHA-256 hashed, and a share link opens the replay without an account - post it in your Discord and the appeal ends there.
What it is not
This records TELEMETRY, not video: no screenshot, no image of the player's screen is ever captured. Positions are sampled a few times a second, so it is a reconstruction, not footage. The high-resolution track (camera, aim, per-shot detail) is DECLARED by the game client and can be forged by a cheat - which is exactly why the authoritative server track is drawn next to it, and why a missing client track is itself a signal.
What you do with detections
Detections become alerts in your panel. From there your toolkit is:
- Triage alerts by severity and status, in bulk if needed.
- Investigate by opening a case and building a timeline of evidence.
- Watch a suspect live via surveillance sessions.
- Sanction (warn / kick / ban) when justified.
- Escalate by requesting an expert review on any case.
Not sure about a detection?
Open a case, attach the alerts, and request an expert review. Our team gives a verdict (confirmed cheater / legitimate player) - target handling within ~48h depending on evidence. See the Panel guide.
Still stuck?
If this page did not answer your question, ask on Discord or write to us. Both reach the people who build Baobab AC.
New to the product? Start with the overview: RedM anticheat, detections and panel on a single page.