CheatDetector v3.6

CheatDetector v3.6 — Release Notes

Folia Support
CheatDetector now runs natively on Folia servers. All scheduler calls were migrated to Paper's regional scheduler API (GlobalRegionScheduler, EntityScheduler, AsyncScheduler). The plugin works unmodified on both Paper and Folia — no separate build needed.

• folia-supported: true declared in plugin.yml
• Entity-bound tasks (sign probes, chat checks, position scans) properly thread-tied to their player's region
• Async tasks (update checker, Discord webhooks) routed through AsyncScheduler

New In-Game Toggle Command
Quickly enable or disable individual detection systems without editing config files or restarting:

/cd toggle opsec - Toggle unsigned-chat / OpSec detection
/cd toggle nochatreports - Toggle NoChatReports detection
/cd toggle wurst - Toggle Wurst's main catch path



Changes take effect instantly and persist to config.yml. Tab completion included.



Bug Fixes & Tuning

• Lunar Client false positive fixed. Added lunarclient: and lunar: to the NoChatReports exempt-channel list after confirming Lunar legitimately skips the chat-session-update packet. Premium clients (Badlion, Feather, Cosmetica, LabyMod) remain unexempt — they sign chat normally, so any Wurst user layering them no longer gets a free bypass.
• NoChatReports timeout bumped 5s → 10s. Lunar and heavily-modded clients register their plugin channels late in the load sequence, causing brief false-positive windows on slow connections. The extended timeout eliminates this.
• OpSec kick delay bumped 10s → 20s default. Larger stealth window between chat-trigger and actual kick makes it harder for OpSec users to trace the kick back to their chat message.
• Bedrock false positive fix. Floodgate players are now exempt from chat-signature checks (Bedrock chat is unsigned by protocol).

Other Changes

• /cd update command removed — automatic update notification on join is sufficient, the manual command added confusion when Spigot's CDN was caching the previous version.
• In-game toggles for freecam and fast-rotation behavior alerts via /cd mute <category> — both MUTED by default to reduce noise (they generate many false positives in normal play).
• Version comparison now strips BOM and hidden characters from the Spigot API response (fixes spurious "update available 3.0 → 3.0" notifications).
• kick-delay-seconds config option is now hot-reloadable via /cd reload — no restart needed.
• Sign-probe reduced from 4 groups to 3 (one less sign-editor flash on join).

𝗖𝗵𝗲𝗮𝘁𝗗𝗲𝘁𝗲𝗰𝘁𝗼𝗿 𝘃𝟯.𝟰

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

𝗡𝗲𝘄: 𝗢𝗽𝗦𝗲𝗰 𝗗𝗲𝘁𝗲𝗰𝘁𝗶𝗼𝗻

OpSec (modrinth.com/mod/opsec) is a dedicated anti-detection mod
that defeats every server-side identity check — brand, channels,
sign-probe, NoChatReports session-update, all of them.

We found their one weakness: they strip per-message chat signatures.
Vanilla 1.19.3+ clients sign every chat message. CheatDetector now
watches incoming chat packets and flags any unsigned message.

The moment an OpSec user types in chat, they're caught.
Even Wurst + OpSec + Essential gets kicked.

Kicks fire 𝟮𝟬 𝘀𝗲𝗰𝗼𝗻𝗱𝘀 after detection so the cheater can't tie
the kick back to a specific chat message - makes it much harder
to figure out how to bypass.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

𝗡𝗲𝘄 𝗦𝗶𝗴𝗻-𝗣𝗿𝗼𝗯𝗲: 𝗡𝗼𝗖𝗵𝗮𝘁𝗥𝗲𝗽𝗼𝗿𝘁𝘀 𝗺𝗼𝗱

Standalone NoChatReports (modrinth.com/mod/no-chat-reports) is now
caught instantly on join via sign-probe, with the explicit
"NoChatReports mod" label in admin alerts.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

𝗙𝗶𝘅: 𝗕𝗲𝗱𝗿𝗼𝗰𝗸 𝗽𝗹𝗮𝘆𝗲𝗿𝘀

Bedrock players (via Geyser/Floodgate) cannot sign chat - they have
no Mojang profile key. Without this fix, every Bedrock player who
chatted would have been falsely kicked.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Drop in v3.4 jar, restart. No config changes needed.

𝗖𝗵𝗲𝗮𝘁𝗗𝗲𝘁𝗲𝗰𝘁𝗼𝗿 𝘃𝟯.𝟯 — 𝗩𝗲𝗿𝗶𝗳𝗶𝗲𝗱 𝗘𝘅𝗲𝗺𝗽𝘁 𝗟𝗶𝘀𝘁

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

𝗧𝗶𝗴𝗵𝘁𝗲𝗻𝗲𝗱 𝘁𝗵𝗲 𝗡𝗼𝗖𝗵𝗮𝘁𝗥𝗲𝗽𝗼𝗿𝘁𝘀 𝗘𝘅𝗲𝗺𝗽𝘁 𝗟𝗶𝘀𝘁

After verifying each mod against its source code / official docs,
v3.3 trims the default exempt-channels list to ONLY mods that
verifiably disable Mojang chat signing.

𝗥𝗲𝗺𝗼𝘃𝗲𝗱 (were dead weight + Wurst bypass vectors):
• cosmetica - cosmetics-only mod, doesn't touch chat
• labymod / labymod3 - has its own chat but doesn't disable
Mojang signing per their support docs
• lunarclient / lunar - sign chat normally
• badlion / bac - sign chat normally
• feather - sign chat normally
• chatreports - never existed as a real namespace

𝗞𝗲𝗽𝘁 (verified):
• nochatreports / noreports - NoChatReports mod (verified)
• essential / e.gg - Essential mod (probable, kept as safety
net for its huge user base)
• viafabricplus / viaversion / viabackwards - older protocol
emulation (pre-1.19.3 has no ChatSessionUpdate packet)

Why this matters: every unnecessary entry in the exempt list is
a free Wurst bypass. Now a Wurst user has to install one of the
four actually-relevant mods to slip past NoChatReports detection.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

𝗛𝗼𝘄 𝘁𝗼 𝘂𝗽𝗱𝗮𝘁𝗲

Drop in v3.3 jar, restart.

𝗘𝘅𝗶𝘀𝘁𝗶𝗻𝗴 𝘂𝘀𝗲𝗿𝘀: your config keeps whatever you currently have
for exempt-channels. If you want the slimmer verified list,
either delete the exempt-channels block from your config
(defaults kick in) or manually trim the entries.

𝗙𝗿𝗲𝘀𝗵 𝗶𝗻𝘀𝘁𝗮𝗹𝗹𝘀: ship with the slim verified list automatically.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

𝗜𝗳 𝘆𝗼𝘂 𝗲𝗻𝗰𝗼𝘂𝗻𝘁𝗲𝗿 𝗳𝗮𝗹𝘀𝗲 𝗽𝗼𝘀𝗶𝘁𝗶𝘃𝗲𝘀

Run /cd info <player> while they're online, find a mod-prefix
in their channel list, and add it to exempt-channels in
config.yml. Then /cd reload.

𝗖𝗵𝗲𝗮𝘁𝗗𝗲𝘁𝗲𝗰𝘁𝗼𝗿 𝘃𝟯.𝟮 — 𝗙𝗮𝗹𝘀𝗲-𝗣𝗼𝘀𝗶𝘁𝗶𝘃𝗲 𝗙𝗶𝘅

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

𝗡𝗲𝘄: 𝗡𝗼𝗖𝗵𝗮𝘁𝗥𝗲𝗽𝗼𝗿𝘁𝘀 𝗘𝘅𝗲𝗺𝗽𝘁𝗶𝗼𝗻 𝗟𝗶𝘀𝘁

NoChatReports detection now skips players running legitimate mods
that also disable Mojang chat signing. Stops false positives on:

• Essential, Cosmetica, LabyMod
• Lunar Client, Badlion, Feather
• ViaFabricPlus / ViaVersion / ViaBackwards
• Standalone NoChatReports mod

Configurable via checks.nochatreports.exempt-channels - add more
prefixes there if you discover other false-positive mods.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

𝗧𝗿𝗮𝗱𝗲-𝗼𝗳𝗳 𝘁𝗼 𝗯𝗲 𝗮𝘄𝗮𝗿𝗲 𝗼𝗳

Because Wurst+Essential (and other exempt mods) produce the same
signature as legitimate Essential users, players who install one
of the exempt mods alongside Wurst will 𝗯𝘆𝗽𝗮𝘀𝘀 the NoChatReports
check.

They're still caught by your other layers:
• VanillaSpoof (if Wurst's brand spoof is on - default)
• Brand / channel detection
• Behavioral anticheat (when they actually cheat)

If you want to remove the exemption for any specific mod and
accept its false positives, edit checks.nochatreports.exempt-channels
in config.yml and /cd reload.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

𝗙𝗶𝘅𝗲𝗱

• Update notifier now compares versions numerically — no more
spurious "update available" alerts during the brief window
after a release when Spigot's CDN is still serving the
previous version.

• Added Cache-Control / no-cache headers to update checks for
extra robustness against intermediate proxies.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

𝗛𝗼𝘄 𝘁𝗼 𝘂𝗽𝗱𝗮𝘁𝗲

1. Drop in v3.2 jar, restart server
2. Existing config keeps working — new exempt-channels list is
added on first start if missing

If you have a false positive that isn't covered by the default
exempt list, run /cd info <player> to see their channels and
add the relevant prefix to exempt-channels in config.yml.

𝗖𝗵𝗲𝗮𝘁𝗗𝗲𝘁𝗲𝗰𝘁𝗼𝗿 𝘃𝟯.𝟭 — 𝗪𝘂𝗿𝘀𝘁 𝗨𝗽𝗱𝗮𝘁𝗲

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

𝗡𝗲𝘄: 𝗡𝗼𝗖𝗵𝗮𝘁𝗥𝗲𝗽𝗼𝗿𝘁𝘀 𝗗𝗲𝘁𝗲𝗰𝘁𝗶𝗼𝗻

Catches modern Wurst clients even when VanillaSpoof is OFF. Wurst's
NoChatReports feature is ON by default, which prevents the client
from sending the standard chat-session-update packet. CheatDetector
now listens for its absence — same technique large servers use.

✓ Catches the ~95% of Wurst users who never disable defaults
✓ Works even when brand is "fabric" (not spoofed to vanilla)
✓ Configurable timeout, alert-only or auto-kick
✓ Off by default — enable in config when ready

Enable with:
checks.nochatreports.enabled: true

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

𝗜𝗺𝗽𝗿𝗼𝘃𝗲𝗱: 𝗩𝗮𝗻𝗶𝗹𝗹𝗮𝗦𝗽𝗼𝗼𝗳 𝗔𝗹𝗲𝗿𝘁 𝗟𝗮𝗯𝗲𝗹𝘀

VanillaSpoof alerts now identify the likely client at a glance.

Old: "VanillaSpoof (Fabric)"
New: "VanillaSpoof (likely Wurst / LiquidBounce / Fabric-cheat)"

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

𝗙𝗶𝘅𝗲𝗱

• /cd info now shows the correct brand when the packet listener
missed the initial brand packet (no more "(unknown)")

𝗖𝗵𝗲𝗮𝘁𝗗𝗲𝘁𝗲𝗰𝘁𝗼𝗿 𝘃𝟯.𝟬 — 𝗥𝗲𝗹𝗲𝗮𝘀𝗲 𝗡𝗼𝘁𝗲𝘀

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

𝗡𝗘𝗪 𝗗𝗘𝗧𝗘𝗖𝗧𝗜𝗢𝗡𝗦

• 𝗙𝗮𝘀𝘁-𝗿𝗼𝘁𝗮𝘁𝗶𝗼𝗻 𝗱𝗲𝘁𝗲𝗰𝘁𝗶𝗼𝗻 — flags aimbot/spinbot via per-tick
yaw+pitch deltas across consecutive packets. Configurable threshold.

• 𝗙𝗿𝗲𝗲𝗰𝗮𝗺-𝗽𝗼𝘀𝗶𝘁𝗶𝗼𝗻 𝗱𝗲𝘁𝗲𝗰𝘁𝗶𝗼𝗻 — flags clients that report a
position inside a solid block for N consecutive movement
packets (noclip).

• 𝗥𝗮𝗱𝗮𝗿 / 𝗺𝗶𝗻𝗶𝗺𝗮𝗽 𝗰𝗵𝗮𝗻𝗻𝗲𝗹 𝗱𝗲𝘁𝗲𝗰𝘁𝗶𝗼𝗻 — alerts on xaero,
journeymap, voxelmap, and similar mods. Disabled by default.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

𝗡𝗘𝗪 𝗖𝗢𝗠𝗠𝗔𝗡𝗗𝗦

• /𝗰𝗱 alias for /cheatdetector with full tab-completion of
sub-commands and online player names.

• /𝗰𝗱 𝗵𝗶𝘀𝘁𝗼𝗿𝘆 — recent detections with timestamps.

• /𝗰𝗱 𝗿𝗲𝘀𝗲𝘁 <𝗽𝗹𝗮𝘆𝗲𝗿> — wipe strike count and flag status, restoring
their "first warning" state. Aliases: clearflags, resetwarn.

• /𝗰𝗱 𝗯𝘆𝗽𝗮𝘀𝘀 <𝗽𝗹𝗮𝘆𝗲𝗿> — toggle a session-only bypass without
editing permissions.

• /𝗰𝗱 𝗮𝗹𝗲𝗿𝘁𝘀 — per-staff toggle to silence detection alerts.

• /𝗰𝗱 𝘀𝗶𝗴𝗻𝗰𝗵𝗲𝗰𝗸𝘀 <𝗼𝗻|𝗼𝗳𝗳> — toggle whether sign checks run on join.
Persists to config.

• /𝗰𝗱 𝗺𝘂𝘁𝗲 <𝗳𝗿𝗲𝗲𝗰𝗮𝗺|𝗿𝗼𝘁𝗮𝘁𝗶𝗼𝗻> — silence chat spam from behavioral
alerts. Detection itself still runs.

• /𝗰𝗱 𝘂𝗽𝗱𝗮𝘁𝗲 — manually check Spigot for the latest version.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

𝗖𝗢𝗡𝗙𝗜𝗚𝗨𝗥𝗔𝗕𝗜𝗟𝗜𝗧𝗬 𝗢𝗩𝗘𝗥𝗛𝗔𝗨𝗟

• All cheat brand and channel blacklists moved to config —
𝗻𝗼 𝗿𝗲𝗰𝗼𝗺𝗽𝗶𝗹𝗲 𝗻𝗲𝗲𝗱𝗲𝗱 to add new clients.

• Vanilla-brand list configurable (what counts as "vanilla"
for spoof detection).

• Radar / minimap channel list configurable.

• 𝗦𝗶𝗴𝗻-𝗽𝗿𝗼𝗯𝗲 𝗸𝗲𝘆𝘀 𝗳𝘂𝗹𝗹𝘆 𝗲𝘅𝘁𝗲𝗿𝗻𝗮𝗹𝗶𝘇𝗲𝗱 — each entry is a
translation key + mod display name + match keywords.

• Per-detection kick messages (default / vanilla-spoof /
freecam / fast-rotation) with separate templates.

• All config changes apply via /cd reload — 𝗻𝗼 𝗿𝗲𝘀𝘁𝗮𝗿𝘁
𝗿𝗲𝗾𝘂𝗶𝗿𝗲𝗱 for anything in config.yml.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

𝗣𝗥𝗘𝗦𝗘𝗡𝗧𝗔𝗧𝗜𝗢𝗡

• Cleaner [CD] prefix in chat alerts.

• Grammatically correct mod lists in alerts:

1 mod → "kicked for using Meteor Client"
2 mods → "kicked for using Meteor and Wurst"
3+ mods → "kicked for using Meteor, Wurst, and FreeCam"

• Kick and ban screens now use 𝗠𝗶𝗻𝗶𝗠𝗲𝘀𝘀𝗮𝗴𝗲 formatting
(colors, bold, newlines, hex codes).

• Ban screen on rejoin now matches the moment-of-ban kick
screen — same wording, colors, and "contact the owner
on our Discord" line.

• Optional 𝗱𝗲𝘁𝗲𝗰𝘁𝗶𝗼𝗻 𝘀𝗼𝘂𝗻𝗱 for staff (configurable Bukkit sound).

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

𝗕𝗘𝗛𝗔𝗩𝗜𝗢𝗥 𝗔𝗟𝗘𝗥𝗧 𝗠𝗨𝗧𝗘𝗦 (𝗡𝗘𝗪)

• Behavioral checks (freecam-behavior, freecam-position,
fast-rotation) are 𝗺𝘂𝘁𝗲𝗱 𝗯𝘆 𝗱𝗲𝗳𝗮𝘂𝗹𝘁 — they generate false
positives in normal play.

• Detection still runs silently: console log, /cd history,
and Discord webhook all record every event.

• Un-mute per category via /cd mute freecam or /cd mute rotation,
or edit behavior-alerts in config.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

𝗨𝗣𝗗𝗔𝗧𝗘 𝗡𝗢𝗧𝗜𝗙𝗜𝗘𝗥

• Async Spigot API version check on enable, then every 6 hours.

• Admins see a clickable "Update available" notification on join.

• 𝗧𝘄𝗼 𝗱𝗶𝘀𝘁𝗿𝗶𝗯𝘂𝘁𝗶𝗼𝗻-𝗮𝘄𝗮𝗿𝗲 𝗷𝗮𝗿𝘀: one with the Spigot link, one
with the BuiltByBit link. Same code, different download URL
baked in.

• Manual trigger via /cd update.

• Fully disable via update-checker.enabled: false in config.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

𝗖𝗥𝗢𝗦𝗦-𝗩𝗘𝗥𝗦𝗜𝗢𝗡 𝗕𝗨𝗜𝗟𝗗𝗦 (𝗡𝗘𝗪)

• 𝟭.𝟮𝟭.𝘅 𝗷𝗮𝗿 — works on every 1.21 release (1.21.0 through 1.21.11).

• 𝟮𝟲.𝟭.𝘅 𝗷𝗮𝗿 — separate build targeting Paper 26.1.2, Java 25,
and PacketEvents 2.12.2-SNAPSHOT.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

𝗣𝗘𝗥𝗙𝗢𝗥𝗠𝗔𝗡𝗖𝗘 / 𝗥𝗘𝗟𝗜𝗔𝗕𝗜𝗟𝗜𝗧𝗬

• Update-checker tasks correctly cancelled and rescheduled
on /cd reload — no leaked tasks.

• Per-player cooldowns on behavioral alerts to prevent spam.

• Async HTTP for both Discord webhook and update checks —
no main-thread blocking.

• Quit handler clears all per-player state to prevent
memory growth.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

𝗙𝗜𝗫𝗘𝗦

• OP admins no longer skipped by the update-notification-on-join.

• Sign-probe sign correctly cleaned up on plugin disable.

• Ban screen on rejoin now matches the configured kick message
instead of falling back to a plain string.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

𝗗𝗘𝗙𝗔𝗨𝗟𝗧𝗦

• Behavior alerts (freecam + fast-rotation): 𝗢𝗙𝗙 — opt in
• Sign-checks-on-join: 𝗢𝗡
• Update-checker: 𝗢𝗡
• First strike: 𝗞𝗜𝗖𝗞
• Second strike: 𝗕𝗔𝗡

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Drop in the new jar that matches your server version,
run /cd reload (or restart for a clean upgrade), and
you're done. Existing config files keep working —
new keys take their default values if missing.

CheatDetector v2.2 - Compatibility Fixes + Discord Webhook Support

New Features

• Full configuration file with comments and documentation
• Configurable punishment per strike: KICK, BAN, COMMAND, or NONE
• Custom punishment commands with %player%, %mod%, and %strike% placeholders (supports /tempban, /warn, /freeze, etc.)
• Toggle individual detection checks on/off: sign checks, channel detection, brand detection, VanillaSpoof, sign timeout alerts
• Configurable warn-only mod list for mods you want to monitor without punishing
• Customizable kick and ban messages with placeholders
• Brand join alerts can be toggled separately from admin alerts
• All settings hot-reloadable with /cheatdetector reload
• Discord webhook alerts: send detection notifications directly to a Discord channel. Includes player name, detected mod, and action taken. Runs async with no performance impact.

Changes

• Removed Tweakeroo FreeCam from sign checks (not reliably detected)
• Freed up a sign check slot for future use

Fixes

• Fixed ProtocolLib compatibility crash on some server versions (MinecraftKey/ResourceLocation fallback)

CheatDetector v2.1 — Full Config Overhaul

What's New:

• Configurable punishment system: Choose KICK, BAN, COMMAND, or NONE for each strike level independently
• Custom punishment commands: Run any command on detection using %player%, %mod%, and %strike% placeholders (supports /tempban, /warn, /freeze, or anything else)
• Toggleable detection checks: Enable or disable sign checks, channel detection, brand detection, VanillaSpoof, and sign timeout alerts individually from the config
• Warn-only mod list: Add any detected mod to a configurable list so it only alerts admins instead of punishing the player (Tweakeroo FreeCam included by default)
• Configurable kick/ban messages: Customize the disconnect message players see, with %mod% and %player% placeholders
• Brand alert toggle: Option to enable or disable the join brand notifications separately from other admin alerts
• All settings are hot-reloadable with /cheatdetector reload

You'll need to delete your old config.yml in the plugins/CheatDetector folder