Detection catalogue

Measures angular velocity in the frames before a shot. Raise the threshold if your community plays with very high mouse sensitivity.

In plain words: The player's aim snapped onto another player unnaturally fast several times.

Legitimate causes: Very high DPI flicks, the camera re-centring after leaving a vehicle while facing someone.

Integrity penalty 40 · id 1001

Samples the impact after each shot and compares it against where the camera pointed when the trigger was pulled. Reported by the client, so treat it as a lead and confirm with Watchtower.

In plain words: Bullets landed well away from where the player was looking.

Legitimate causes: Drive-by shooting, firing while the camera is in a scripted cinematic mode.

Integrity penalty 40 · id 1002

Catches smooth aimbots that evade snap detection. Controller aim assist produces the same signature, so this is a lead for review rather than an action.

In plain words: The player tracked a moving target more smoothly than a human hand does.

Legitimate causes: Controller aim assist, a target walking straight at a stationary aimer.

Integrity penalty 18 · id 1003

Measured entirely on the server, from the shooter's own ped and the victim's: no client value is involved, so a menu that lies about its camera changes nothing. Silent aim and magic bullet put the round where the crosshair is not, which is exactly this. Three hits past the shoulder line inside a minute are needed, melee, drive-bys, explosives and point-blank range are all excluded, and the threshold leaves room for a networked heading being a moment stale.

In plain words: Their shots landed on people they were not facing.

Legitimate causes: Heavy packet loss making the server's view of a player's facing badly out of date.

Integrity penalty 100 · id 1006

Server-side, from positions and timestamps the server owns. Aimbots snap between targets; the humanisation sliders these menus sell smooth the path taken, not the time it takes to arrive. Hits from a single trigger pull are one event and never count, so a shotgun catching two people is ignored.

In plain words: Their aim jumped between two people faster than a hand can move.

Legitimate causes: A stray shot landing on a second player at the same instant as an aimed one.

Integrity penalty 40 · id 1007

Measures the delay between hitbox entry and fire input. Humans cannot consistently react under about 120ms.

In plain words: The player fired within a split second of an enemy crossing their crosshair, repeatedly.

Legitimate causes: Pre-firing a doorway as a target strafes into it.

Integrity penalty 18 · id 1005

The server replicates which weapon every ped holds independently of the damage events the client sends. Menus that rewrite the weapon hash for a one-shot kill do not bother to make the ped hold that weapon. A hit from the previous weapon that lands just after a swap is forgiven for a grace period you can tune. Melee, drive-bys and explosives are never judged.

In plain words: They dealt damage with a gun they were not holding.

Legitimate causes: A very slow weapon swap under heavy lag, or a weapon the server sees replicated late.

Integrity penalty 100 · id 1115

The shape of "kill all": a menu loops damage over every player, and the server sees one shooter hit four people in the time it takes to hit one. Hits from one trigger pull share an event and never count, so a shotgun into a crowd is not this. Explosives, melee and vehicle weapons are excluded. How many is too many is tunable.

In plain words: They hit several players at once, faster than anyone can aim.

Legitimate causes: None known for handheld firearms.

Integrity penalty 100 · id 1116

The server reads the shooter's health off the ped at the moment each damage event arrives. A trade kill can put one last event a moment after death, which is why several inside a window are needed; a player dealing damage repeatedly from the floor is a menu firing on their behalf.

In plain words: They were dealing damage after they had died.

Legitimate causes: Trade kills, and death replicating a moment before the last bullet lands.

Integrity penalty 18 · id 1117

Compares observed shot intervals against the Weapon Table. Register custom weapons there rather than disabling this.

In plain words: The player fired a weapon faster than it can physically cycle.

Legitimate causes: A weapon pack with an edited fire rate that is not in your Weapon Table, a burst of delayed packets after a lag spike.

Integrity penalty 40 · id 1101

Uses the Weapon Table with a 50% tolerance. If you sell modified weapons, register them there. Bans by default because the signal is server-observed and three hits rule out a one-off desync.

In plain words: The player dealt more damage than their weapon allows, several times.

Legitimate causes: Weapon packs or damage scripts that change base damage without an entry in your Weapon Table.

Integrity penalty 100 · id 1102

Reported by the client from its own ammo counter, so it is a lead rather than proof. If a script grants unlimited ammo at events, give that script the bypass permission instead of turning this off.

In plain words: The player kept firing without their ammo going down.

Legitimate causes: Police or event scripts that refill ammo, infinite-clip perks.

Integrity penalty 18 · id 1105

Distance is measured between the two peds at the moment of the damage event, with a generous allowance for ping. Vehicles are ignored because their centre point is metres from their surface.

In plain words: The player punched or hit someone from further away than an arm or a bat reaches.

Legitimate causes: Very high ping while both players are running.

Integrity penalty 40 · id 1106

The burst limit lives under Entity Guard. Each hit here means the limit was crossed, so the threshold is deliberately low. Raise the burst limit for military or war-themed servers.

In plain words: The player caused far more explosions than a player with grenades can.

Legitimate causes: Scripted ordnance on war servers, a player detonating a full set of sticky bombs while also firing a launcher.

Integrity penalty 100 · id 1107

Only active once you fill in the allowed explosion types under Entity Guard. Bans on one hit because the list is yours: a weapon explosion type you did not allow cannot come from a script you run.

In plain words: The player produced an explosion type you have said no script on your server produces.

Legitimate causes: A forgotten script that uses an exotic explosion type. Check the list before enabling.

Integrity penalty 100 · id 1108

Servers that lower everyone's damage globally are fine: the check compares against the value most players report, not against the game default.

In plain words: The player's game is set to deal more damage, or take less, than everyone else's.

Legitimate causes: A perk or job script that changes one player's modifiers on purpose.

Integrity penalty 40 · id 1110

Measured server-side between the two peds. Pistols hitting at 200 metres is a menu; a sniper at 400 metres is not, and the Weapon Table knows the difference.

In plain words: The player hit someone from a distance their weapon cannot reach.

Legitimate causes: A moving target and very high ping, custom long-range weapons missing from the Weapon Table.

Integrity penalty 40 · id 1111

Routing buckets are how instancing and interiors are separated. Nothing legitimate reaches across one with a bullet.

In plain words: The player hurt someone who was in a different instance and should have been invisible to them.

Legitimate causes: A player switching instance in the same second a bullet arrives.

Integrity penalty 100 · id 1112

Menus hide explosions so the victim cannot see where they came from. Some effect scripts also use invisible explosions for knock-back, which is why this kicks rather than bans.

In plain words: The player set off an explosion with no visible blast.

Legitimate causes: Effect or physics scripts that use hidden explosions for knock-back.

Integrity penalty 100 · id 1113

Launched and placed explosives (rockets, sticky bombs, mines) are excluded because they legitimately travel or wait. Thrown ones cannot cover that distance.

In plain words: The player's grenade went off far away from where they were standing.

Legitimate causes: Throwing from a fast vehicle at the edge of the range allowance.

Integrity penalty 100 · id 1114

Skips falling, ragdoll flings, players attached to something and players riding on top of a vehicle. Register sprint-boost scripts through the Resource API exemption.

In plain words: The player moved on foot faster than a sprinting ped can.

Legitimate causes: Standing in a truck bed, being flung by a car, a scripted dash or roll ability.

Integrity penalty 40 · id 1201

Admin teleports through the ARGUS menu are exempt. Framework teleports (housing, elevators, hospital respawn) should call the Resource API exemption; the respawn case is detected automatically.

In plain words: The player jumped across the map without a vehicle.

Legitimate causes: Housing and elevator scripts, hospital respawn, staff teleport commands from other admin menus.

Integrity penalty 40 · id 1202

Kicks by default even though it is client-reported: the condition is one nothing legitimate produces for that long, and the server's own teleport check corroborates it. txAdmin noclip is exempt automatically.

In plain words: The player was flying through walls.

Legitimate causes: An admin menu other than txAdmin whose staff do not hold the ARGUS bypass permission.

Integrity penalty 100 · id 1203

Standing on the roof of a moving vehicle looks like this from the ped alone, so it is a lead rather than an action.

In plain words: The player floated in the air without anything under them.

Legitimate causes: Riding on top of a truck or boat, a ladder or climbing script.

Integrity penalty 40 · id 1204

Jumping off a moving vehicle is excluded, jumping onto a steep slope is not, which is why this flags.

In plain words: The player jumped much higher than a person can.

Legitimate causes: Jumping onto an upslope, dismounting a moving vehicle mid-air.

Integrity penalty 18 · id 1205

Every CCTV, drone, housing preview and dealership script does exactly this. Have those scripts call the Resource API camera exemption, and treat unexplained hits as a lead.

In plain words: The player's camera was somewhere their character was not.

Legitimate causes: Police CCTV, drones, property and vehicle preview cameras, photo modes.

Integrity penalty 18 · id 1206

The fastest stock car tops out near 60 m/s and the fastest jet near 110. The server sample is the proof; the client reading catches modified handling below the absolute cap. Tuned handling packs can exceed both; raise the threshold rather than disabling.

In plain words: The player's vehicle was moving impossibly fast.

Legitimate causes: Heavily modified handling files, nitro or boost scripts.

Integrity penalty 40 · id 1207

Off by default: handcuff, escort, carry, emote and many vehicle scripts disable ragdoll on purpose. Turn it on only if you know your scripts do not.

In plain words: The player could not be knocked over for a long time.

Legitimate causes: Handcuffs, escorting, carrying, emotes, sitting scripts.

Integrity penalty 8 · id 1209

Off by default: most roleplay servers restore stamina every frame, which produces this constantly.

In plain words: The player sprinted for minutes without tiring.

Legitimate causes: Any script that restores stamina, which is most frameworks.

Integrity penalty 3 · id 1210

A cliff dive into water briefly looks like this, which is why it takes three samples.

In plain words: The player swam faster than possible.

Legitimate causes: Diving into water at speed, a boat wake pushing the ped.

Integrity penalty 8 · id 1211

Server-observed. Safe-zone scripts that make players invincible trip this: give them the Resource API exemption while inside the zone. Kicks rather than bans for that reason.

In plain words: The player could not be hurt.

Legitimate causes: Green zones and safe zones, admin god mode from menus other than txAdmin.

Integrity penalty 100 · id 1301

Read from the server, not the client. The ceiling is Player Limits > Maximum health; 0 means the game default of 200. A script that raises the maximum above it flags until the ceiling is raised to match.

In plain words: The player had more health than your server allows.

Legitimate causes: A script that sets health above the ped maximum, or raises the maximum above 200 without raising the Player Limits health ceiling to match.

Integrity penalty 40 · id 1302

Default ceiling is 100. If your server sells heavy armour above that, raise the ceiling instead of disabling the check.

In plain words: The player had more armour than your server allows.

Legitimate causes: Armour items above 100 without the ceiling being raised to match.

Integrity penalty 40 · id 1303

Medkits, bandages and hospital respawns all do this, so it only ever flags.

In plain words: The player healed very quickly.

Legitimate causes: Medical items, hospital respawn, healing scripts.

Integrity penalty 8 · id 1304

Client-reported. Clothing rooms and some admin spectate modes hide the ped, so this is a lead for review.

In plain words: The player was invisible while playing.

Legitimate causes: Clothing shops, character creators, spectate modes.

Integrity penalty 18 · id 1305

Uses the same ped blacklist as Entity Guard. Animal models are the usual case: menus love them, and so do Halloween events, so it flags by default.

In plain words: The player turned into a model you have blocked.

Legitimate causes: Event scripts that turn players into animals or blocked peds on purpose.

Integrity penalty 18 · id 1306

What happens to the player is decided per weapon in the Weapon rules, not here — this entry records the hit. Possession is caught the moment the weapon is given, not only when it is fired.

In plain words: The player had a weapon you have blocked.

Legitimate causes: A job script that hands out a blacklisted weapon for a mission.

Integrity penalty 40 · id 1401

Firing a rocket while holding a pistol is a menu. Vehicle weapons are excluded because they are not held.

In plain words: The player fired a rocket or grenade from a weapon they were not holding.

Legitimate causes: Weapon switch in the same frame as the launch, custom throwable scripts.

Integrity penalty 40 · id 1405

What happens to the player is decided per vehicle in the Vehicle rules. This entry records the attempt.

In plain words: The player tried to spawn a vehicle you have blocked.

Legitimate causes: Staff spawning a blocked vehicle for an event without the bypass permission.

Integrity penalty 40 · id 1501

Each hit means the limit was crossed once, so two hits in a minute is sustained. Car dealerships that spawn a showroom client-side should raise the vehicle limit.

In plain words: The player's game spawned a burst of vehicles.

Legitimate causes: Dealership showrooms and garages that spawn many vehicles at once from the client.

Integrity penalty 40 · id 1502

Bulletproof-tyre police vehicles and showroom cars look like this, so it flags.

In plain words: The player's vehicle could not be damaged.

Legitimate causes: Police vehicles with bulletproof tyres, preview and showroom vehicles.

Integrity penalty 18 · id 1503

Client-reported lead. A vehicle mid-stream can briefly have no collision, so it takes three samples.

In plain words: The player's vehicle was driving through the world.

Legitimate causes: Vehicles still streaming in, garage and preview scripts.

Integrity penalty 18 · id 1504

Read from the server's own vehicle list. Some garage scripts legitimately hold a spare copy for a moment, so this flags rather than acts.

In plain words: Two vehicles with the same plate are on your server at once.

Legitimate causes: Garage scripts that respawn a vehicle before deleting the old one, and servers that do not enforce unique plates.

Integrity penalty 0 · id 1514

Housing scripts that place forty props on entry should raise the object limit. Each hit means a limit was crossed once.

In plain words: The player's game spawned a burst of peds or objects.

Legitimate causes: Housing and furniture scripts, crafting benches, client-side prop scripts.

Integrity penalty 40 · id 1601

What happens to the player is decided per model in the Object rules. This entry records the attempt.

In plain words: The player tried to spawn an object you have blocked.

Legitimate causes: A script that legitimately uses a model you blocked.

Integrity penalty 40 · id 1602

What happens to the player is decided per model in the Ped rules. This entry records the attempt.

In plain words: The player tried to spawn a ped you have blocked.

Legitimate causes: A script that legitimately uses a model you blocked.

Integrity penalty 40 · id 1603

Only active when you mark a zone exclusive. Ambient population is never affected.

In plain words: The player spawned something outside the areas you allow spawning in.

Legitimate causes: A script that spawns props anywhere on the map when zones are exclusive.

Integrity penalty 18 · id 1606

The client reports every resource it sees start and the server checks its own list. A resource the server never started cannot have come from the server. Kicks by default; the Serious RP preset bans.

In plain words: Something was loaded into the player's game that your server did not send.

Legitimate causes: None known. Restarting resources on the server is handled correctly.

Integrity penalty 100 · id 1701

Recorded against the server rather than a player. Legitimate restarts from the console appear here too, so the panel shows who was on the console at the time.

In plain words: ARGUS was turned off while people were playing.

Legitimate causes: A staff member restarting ARGUS from the console.

Integrity penalty 100 · id 1702

ARGUS captures the identity of the functions an executor would have to hook — TriggerServerEvent, load, PerformHttpRequest and the rest — when it starts, and compares them later. Only a replaced function counts: FiveM binds natives into a resource's globals lazily on first use, so a global merely appearing is normal and is never reported unless its name matches a known cheat menu. A lead rather than an action.

In plain words: Something replaced part of ARGUS's own code inside the player's game.

Legitimate causes: None known.

Integrity penalty 18 · id 1704

Each challenge is signed with a per-session key. A client that goes quiet either had ARGUS killed or is frozen; either way it cannot stay. Timeout is under Settings.

In plain words: The anti-cheat inside the player's game stopped talking to the server.

Legitimate causes: A game frozen for over a minute, extreme packet loss.

Integrity penalty 0 · id 1709

Recorded against the server. Usually a resource update overwrote its manifest; ARGUS re-integrates on next start when reconcile is on.

In plain words: A protected script lost its ARGUS integration.

Legitimate causes: Updating a script whose author ships a fresh manifest.

Integrity penalty 18 · id 1710

Executors run inside a resource's own Lua state rather than ARGUS's, which is the one place ARGUS watching itself cannot see. The shim captures function identities before the host resource loads and compares them later. Nothing a gameplay script does replaces TriggerServerEvent in its own environment.

In plain words: Something rewrote part of one of your scripts inside the player's game.

Legitimate causes: None known. A resource that hot-patches its own globals at runtime would do this, which is vanishingly rare.

Integrity penalty 100 · id 1712

Each resource has a stable repertoire of events it triggers. ARGUS learns it for the first fifteen minutes of uptime and while Learning Mode is on, then reports a resource firing another resource's event for the first time — the shape of an executor injected into a script to call the bank. Flags only: legitimate cross-resource calls exist, and the learning period is what tells them apart.

In plain words: One of your scripts triggered another script's event for the first time.

Legitimate causes: A rarely used feature reached for the first time after the learning period, or a resource updated to call into another.

Integrity penalty 40 · id 1713

A menu that kills individual ARGUS checks while leaving the heartbeat alive produces exactly this. Two consecutive stalled reports rule out a momentary hitch.

In plain words: Part of the anti-cheat inside the player's game was switched off while the rest kept running.

Legitimate causes: None known.

Integrity penalty 0 · id 1711

Protection is enforced inside integrated resources, so make sure the owning script is integrated. Kicks by default; the Serious RP preset bans.

In plain words: The player triggered a server event you have locked down.

Legitimate causes: Marking an event protected that a legitimate client flow still uses.

Integrity penalty 40 · id 1801

Ceilings are learned per event during Learning Mode. Add chatty-but-honest events to the exceptions list.

In plain words: The player's game was hammering the server with events.

Legitimate causes: Poorly written scripts that fire an event every frame.

Integrity penalty 40 · id 1802

Honeypot names are generated fresh on every server start, so nothing can learn them ahead of time. Only an event dumper or spammer ever fires one.

In plain words: The player fired a fake event that only a cheat tool would find.

Legitimate causes: None known.

Integrity penalty 100 · id 1803

Shadow mode reports without acting until you promote the event policy.

In plain words: The player used one of your scripts' events far more often than normal.

Legitimate causes: A new feature that legitimately changes how often an event fires.

Integrity penalty 18 · id 1806

Catches crafted payloads aimed at money, item and permission handlers.

In plain words: The player sent a server event with malformed data.

Legitimate causes: A script update that changes an event's arguments before the profile relearns.

Integrity penalty 18 · id 1807

Driven by the event policies under Integration. Shadow mode reports only.

In plain words: The player called a sensitive server event they should not have been able to.

Legitimate causes: A policy promoted too early.

Integrity penalty 40 · id 1808

Recorded against the server, not a player. Look at the resource named in the evidence.

In plain words: One of your installed scripts contains a backdoor pattern.

Legitimate causes: Legitimate admin tools that run console commands from events.

Integrity penalty 100 · id 1809

Applies to chat and to any message channel you register through the Resource API.

In plain words: The player flooded the chat.

Legitimate causes: None at this rate.

Integrity penalty 8 · id 1905

Only the ARGUS page posts to these and only while open. Anything else reaching them was injected into the NUI layer, which is how menu bases drive other resources' interfaces.

In plain words: Something in the player's game pressed buttons on the ARGUS menu without it being open.

Legitimate causes: None known.

Integrity penalty 40 · id 1908

ESP menus draw one blip per entity. Housing scripts that load hundreds of blips at once also trip it, so it flags.

In plain words: The player's map filled with hundreds of markers at once.

Legitimate causes: Scripts that load a large blip set on join.

Integrity penalty 18 · id 1909

The client only opens the menu when the server has told it the player is staff, so a call from a non-staff client was forged. Two hits rule out a permission revoked mid-session.

In plain words: A non-staff player tried to use the staff menu's actions.

Legitimate causes: Staff whose permission was removed while they were online.

Integrity penalty 40 · id 1910

clearPedTasksEvent is sent by whichever client called ClearPedTasks, naming the ped. The game only sends it for the caller's own ped or peds it owns; a client naming somebody else's player ped is a menu's "freeze", "ragdoll" or "stop animation" acting on that player. Blocked while enforcing, so the target never feels it. Some older cuff and carry scripts do this from the aggressor's client, which is why three are needed.

In plain words: They interrupted another player's ped from their own game.

Legitimate causes: Older cuff, carry or escort scripts that clear the target's tasks from the wrong side.

Integrity penalty 40 · id 1913

removeWeaponEvent and removeAllWeaponsEvent name the ped they act on. A client naming another player's ped is the "strip weapons" or "disarm all" button of a troll menu. Blocked while enforcing. Frameworks remove weapons on the owning client through a server event, never from a bystander.

In plain words: They took another player's weapons away from their own game.

Legitimate causes: A police script that disarms the target from the officer's client rather than the target's.

Integrity penalty 40 · id 1914

giveWeaponEvent names the ped receiving the weapon. Inventory frameworks give weapons on the receiving player's own client, so a client arming somebody else's ped is a menu's "give weapon to player" or "arm everyone". Blocked while enforcing, and separate from the blacklist check, which still applies to what was given.

In plain words: They put a weapon in another player's hands from their own game.

Legitimate causes: None known.

Integrity penalty 100 · id 1915

Particle spam is the classic crash and lag attack. Emote and effect scripts start a handful at a time; menus start hundreds.

In plain words: The player's game flooded everyone with particle effects.

Legitimate causes: Effect-heavy scripts such as fireworks shows.

Integrity penalty 40 · id 1911

A molotov starts several fires at once and is allowed for. Menus that set the map on fire start dozens.

In plain words: The player's game started a large number of fires at once.

Legitimate causes: Fire-heavy scripts, several molotovs landing together.

Integrity penalty 40 · id 1912

Checked before the player loads in. Spoofers cannot produce a valid token set.

In plain words: The connecting player's identity was forged.

Legitimate causes: None known.

Integrity penalty 100 · id 2001

Chainban linking. Strictness and identifier kinds are under Chainban.

In plain words: A banned player came back on another account.

Legitimate causes: Shared households on lenient strictness.

Integrity penalty 100 · id 2003

Requires corroboration from the number of servers set under ArgusNet. Action is configurable there.

In plain words: This player has been banned for cheating on other servers.

Legitimate causes: Bans that other servers issued for reasons other than cheating.

Integrity penalty 40 · id 2004

Needs your own proxycheck.io key under Connections. Information for staff, not a cheat signal.

In plain words: The player is connecting through a VPN.

Legitimate causes: Privacy-conscious players, players in regions that need a VPN to reach the server.

Integrity penalty 3 · id 2005

Off by default: every time-sync script does this on every client. Only useful on servers with no time sync at all.

In plain words: The player's in-game clock changed suddenly.

Legitimate causes: Time sync scripts, admin time commands.

Integrity penalty 0 · id 2101

Off by default for the same reason as time: weather sync scripts produce this constantly.

In plain words: The player's weather changed suddenly.

Legitimate causes: Weather sync scripts, admin weather commands.

Integrity penalty 0 · id 2102

Off by default. Turn on if your server never runs blackout events.

In plain words: The player's game turned off all the city lights.

Legitimate causes: Blackout events, power-plant heist scripts.

Integrity penalty 0 · id 2103

Only catches executors that run inside ARGUS's Lua state. Precise when it fires; blind to everything else, so it is a lead.

In plain words: A known cheat menu left its fingerprint inside the player's game.

Legitimate causes: None known.

Integrity penalty 40 · id 2201

Opt-in reconciliation compares readable balances with recorded transactions. QBCore, Qbox and ESX money notifications explain ordinary paychecks. Missing or customised hooks can leave legitimate changes unexplained; this never deducts integrity or bans.

In plain words: A balance increase was not explained by the available transaction journal. Check adapter coverage and legitimate scripts.

Legitimate causes: Custom balance mutations without the supported framework notification, missed hooks during resource lifecycle changes, or incomplete adapter coverage.

Integrity penalty 0 · id 2301

Requires a readable inventory and opt-in discrepancy reporting. Post-mutation journalling currently supports compatible qb-inventory AddListener builds; other readable inventories need their own transaction integration. This is not universal inventory coverage.

In plain words: An inventory increase needs reconciliation with the server's transaction records.

Legitimate causes: Legitimate inventory operations not covered by post-mutation hooks, including transfers and customised inventory implementations.

Integrity penalty 0 · id 2302

Applies to custom mutations explicitly registered through the server transaction export. Resources are approved manually; observing a payment never automatically approves its caller.

In plain words: A resource you have not approved gave this player money or items.

Legitimate causes: Any legitimate script that has not been added to the allowlist yet. This is normal on a new install.

Integrity penalty 0 · id 2303

A server-side integration labels a successful custom grant as client-requested. This is an integration claim, not independent proof of exploitation. Framework notifications alone cannot identify the original requesting resource.

In plain words: A server integration recorded a client-requested grant from an unapproved resource. Verify its permission checks.

Legitimate causes: Shops, ATMs, job payouts and any script where the client legitimately requests a server-side reward.

Integrity penalty 0 · id 2304

Set the caps to the largest single payout your server makes. Zero turns the check off.

In plain words: This player gained or lost more in one step than your cap allows.

Legitimate causes: Large legitimate payouts, house or vehicle sales, and admin corrections.

Integrity penalty 0 · id 2305

Severity, action and message are supplied by the calling script. See the Resource API documentation.

In plain words: One of your own scripts reported this player.

Legitimate causes: Whatever your script decided to report.

Integrity penalty 18 · id 9001

Rules with a flag action land here so they appear in the detection feed. Kick and ban rules act directly.

In plain words: One of your own Security Rules matched this player.

Legitimate causes: Whatever your rule decided to match.

Integrity penalty 18 · id 9002