Reference

Detections

Everything twisteAC catches, grouped by cheat domain. Detection runs server-side wherever possible, so it can't be spoofed by a tampered client. Each detection carries a severity from low to critical, and repeat offences escalate automatically.

How severity works

Severity scales with how blatant the signal is, and many detections escalate on repeat - e.g. a first rapid-fire hit may be high, a second becomes critical. Severity drives alert priority and, in enforce mode, the action taken.

#Combat

Aimbot, triggerbot and damage exploits - the highest-value category for most servers.

Detection	Severity	What it catches
`rapid_fire`	high	Shots faster than a weapon physically allows (per-weapon thresholds).
`headshot_rate_anomaly`	critical	>80% headshot ratio over a meaningful sample of shots.
`silent_aim`	high	Hits registered without line of sight to the target.
`magic_bullet`	critical	Impossible trajectory or a damage multiplier.
`v2_overdamage`	high	One-shot kills / damage above a weapon’s maximum.
`ammo_increase_detected`	critical	Magazine refills that never happened legitimately.
`forbidden_weapons`	critical	Use of a blacklisted weapon or ammo type.
`v2_client_detection_missing`	high	Server sees fire events but the AC client is absent - tampering.

#Health & Armor

Detection	Severity	What it catches
`damage_immunity`	critical	Player took 0 damage from a verified server-side hit (godmode).
`heal_detected`	high	Instant healing - large HP gain in an impossible timeframe.
`armor_increase_detected`	critical	Unauthorized armor added to a player.

#Movement

Detection	Severity	What it catches
`teleport_event`	high	Leaps over ~50m that aren’t spawn, admin, or fast-travel.
`speed_anomaly`	high	On-foot speed beyond the allowed maximum (speedhack).
`superjump`	high	Vertical gain far above what the game permits.

Mod-menu features detected on the client and confirmed server-side via the CEV validation engine.

Detection	Severity	What it catches
`menu_detection`	critical	Mod-menu signature: suspicious key patterns or native hooks.
`noclip_detected`	critical	Moving through collision geometry.
`invisibility_detected`	critical	Entity alpha below threshold / hidden flag set.
`freecam`	critical	Camera detached from the player ped.
`godmode`	critical	Invincibility flag active without authorization.
`spectate_mode_detected`	high	Player view detached from their ped.
`nui_input_anomaly`	critical	Forbidden NUI input injected.

#Entity spawn

Crash/troll attempts and loadout abuse via mod menus.

Detection	Severity	What it catches
`mass_ped / mass_vehicle`	high	Bursts of peds/vehicles spawned to crash or troll.
`explosive_spawn`	critical	Explosives spawned via a mod menu.
`explosion_burst`	critical	Rapid explosion bursts - crash/lag attempt.
`deny_model / deny_weapon`	critical	Attempt to spawn a blacklisted model or equip a banned weapon.
`unauthorized_give`	critical	Forced weapon loadout pushed from the client.

#Economy & VORP

Detection	Severity	What it catches
`item_added`	high	Large inventory gains from an unauthorized source (dupe).
`money_added`	high	Cash appearing from a non-shop / non-mission source.
`money_desynced`	critical	Client money cache diverges from the server (forged state).
`vorp_exp_gain`	critical	Excessive XP gained in a single session.
`vorp_remote_trigger`	critical	Attempt to call a forbidden remote event.

#Abuse

Detection	Severity	What it catches
`chat_spam`	medium	Too many chat messages in a short window.
`chat_word_violation`	high	A blacklisted word used in chat.
`sound_spam`	medium	Sound triggers flooded in a short window.
`ragdoll_abuse`	medium	Continuous or repeated ragdoll abuse.
`command_bruteforce`	high	Many denied commands in a short window.
`event_rate_limit`	high	A network event fired far beyond its allowed rate.

#System integrity

Tamper detection that protects the anticheat itself.

Detection	Severity	What it catches
`heartbeat_timeout`	critical	The AC client script was stopped or suspended.
`forbidden_resource_detected`	critical	A known cheat/mod resource is running.
`anti_dump`	critical	Attempt to dump or read protected Lua memory.
`hwid_spoof`	critical	Mismatched machine signature - ban-evasion indicator.

#What you do with detections

Detections become alerts in your panel. From there your toolkit is:

Triage alerts by severity and status, in bulk if needed.
Investigate by opening a case and building a timeline of evidence.
Watch a suspect live via surveillance sessions.
Sanction (warn / kick / ban) when justified.
Escalate by requesting an expert review on any case.

Not sure about a detection?

Open a case, attach the alerts, and request an expert review. Our team gives a verdict (confirmed cheater / legitimate player) - target handling within ~48h depending on evidence. See the Panel guide.

PreviousConfiguration Next Panel guide