hoaxeyehoaxeyedocs
Detection

Detection & protection families

hoaxeye groups detections into families. Each family decides when to run, which verdicts it can emit, and how the operator can configure its mode. The card grid below links to the per-family page; HoaxShield is the one card that's a protection layer rather than a detection family.

Live

Anti-VPNlive
Network-side identification of VPN, proxy, datacenter and Tor traffic at connect time. Residential-VPN endpoints are scored separately so legitimate consumer-privacy users aren't bucketed with commercial VPNs.
Backdoor scannerlive
Scheduled deep audits of every started resource. Whitelist-first plus in-house AI severity grading after three iterations of false-positive refinement. Current iteration: zero false positives on a 59-resource test server.
Server analyticslive
Always-on companion to the backdoor scanner. Per-resource exploit-risk bucket, 7-day trigger heatmap with click drilldown, edge-triggered alerts on risk crossings, operator-managed pattern blacklist.
Discord verifylive
Hardcoded Discord-membership gate at connect time. Includes an audited, time-boxed emergency bypass for the case where Discord itself is down or the bot got removed.

Roadmap

Behavior Analyticsroadmap
Planned ML-driven behavioral detection family. Per-server inference agent that reads from the existing multi-stream upstream and flags four named classes: mod-menu indicators, camera-state anomalies, movement-state anomalies, and pattern correlation. Roadmap; details follow.
HoaxShieldroadmap
FiveM-aware DDoS protection at a UDP-validating EU edge. Planned public beta in June / July 2026; ships at launch starting with the Advanced plan. See the dedicated roadmap page.
NUI / trigger / native abuseroadmap
Client-UI injection, server-event hijacking and entity-rate abuse families. Threat-modelled in detail, not yet shipped. The first family lights up here when it ships.

Architecture concepts

Two pages explain the architecture every family below sits on. They're worth reading once before the family pages.

  • Rule engine — modes, verdict strings, risk buckets, fail-closed / fail-open, per-server operator control.
  • False positives — three filtering layers, anonymized snippet-hash corpus, an honest iteration history, and operator-final say on every action.

How to read each family page

Every live family page is structured the same way:

  • What it protects against. One paragraph, generic — no signal internals.
  • Modes. What observe / score / enforce mean for this family.
  • Verdicts. The verdict strings you'll see in dashboard logs.
  • Latency / cadence. Measured numbers with the methodology footnote.
  • False-positive history. What used to misfire, how we fixed it, why it's better now.
  • Operator recommendation. Which mode to start in for typical server types.