Detection · live

Anti-VPN

Anti-VPN classifies the network endpoint of an incoming connect. It runs at the connect path and emits a verdict that the operator's chosen mode (observe / score / enforce) turns into action. Five independent layers contribute; the verdict is the consensus.

What it protects against

Operators on FiveM commonly want to block evasion patterns — a player banned on identifier A coming back on identifier B from a fresh VPN endpoint, or alt-account farming through cheap datacenter IPs. Anti-VPN gives the connect path enough network context to make that decision.

How the detection stack works

Five independent layers feed the final verdict. None of them produces enforcement on its own.

Layer	Source	Strength
Offline IP → ASN / ISP lookup	MaxMind plus our internal blacklist	High — runs locally, no API roundtrip on the connect path.
Commercial VPN / proxy classification	Three independent partner intel sources, consensus-merged	High when at least two agree; surfaces as `vpn` / `proxy`.
Tor exit list	Daily pull from the public exit-node list	Definitive — surfaces as `tor`.
Client-signal cross-validation	WebRTC, latency-pattern and timezone consistency	Medium — used to detect residential-VPN endpoints that the IP layer can't.
Behavioral pattern detection	In-house AI systems running on a dedicated EU GPU server	Advisory — boosts existing scores, never an enforce trigger by itself.

The behavioral layer is deliberately advisory. It looks for things like the same player joining from three different ASNs in 24 hours (VPN rotation), or shared ASN plus hardware-token similarity across accounts (alt clusters). When it has something to say, it flips a soft token in the rule engine; it never overrides an operator's mode setting. See False positives for the boundary.

Datacenter ASNs take precedence over generic VPN-list overlap, because public ASN blacklists routinely mix data-center hosts in. We'd rather call a hosting IP a datacenter than mislabel it as a VPN.

Modes

Mode	Behavior
`observe`	Detection runs and produces a verdict, but no player-facing action is taken. Verdicts are written to the audit log so operators can review tuning before going live.
`score`	The verdict contributes to the player's aggregate risk score. Action is triggered when the score crosses the operator-configured threshold combined with other signals — never from this single check alone.
`enforce`	The verdict triggers the operator-configured action immediately (deny / queue / kick). Operators choose which actions a verdict maps to per server.

Verdicts

These are the verdict strings you'll see in dashboard logs and in the API response. They're stable strings — your tooling can match on them.

Verdict	What it means
`vpn`	Endpoint matches a known commercial VPN provider.
`proxy`	Anonymizing proxy (open or commercial).
`datacenter`	Server-hosted IP — cloud, hosting or scraping infrastructure. Datacenter takes precedence over generic VPN-list overlap.
`tor`	Active Tor exit node. Refreshed daily from the public exit list.
`residential_vpn`	Residential-IP-based VPN (consumer-privacy services that route through real residential connections). Scored separately from commercial VPNs.
`behavioral_alt_cluster`	Joins from this endpoint correlate with multi-account alt patterns. Advisory on its own; functions as a multiplier when combined with other verdicts. Never an enforce trigger by itself.
`cleared`	Endpoint did not match any of the above.

Latency & cadence

< 50 ms

Connect-path lookup (typical)

In-process cache hit after the first lookup of an endpoint. Cold lookups are a one-time cost per endpoint per cache window.

~ 192 ms

Boot-time pull (cold)

First scheduler tick after resource start. Measured on a representative European host, FiveM artifact 5500+, sample of 20 cold starts.

every 15 min

Behavioral correlation pass

Off-path job that re-evaluates behavioral signals across recent joins. Doesn't affect the connect path.

daily, 03:00 UTC

ASN whitelist refresh

Public ASN allowlists pull once a day. Datacenter signals take precedence over generic VPN-list overlap.

Methodology: measurements are p99 over a representative sample, not median. Where we cite a number, we keep the bench script in the resource repo so we (and you) can reproduce it.

False-positive history

Residential VPNs. Modern consumer-privacy services route traffic through real residential IP addresses. Early Anti-VPN versions shared scoring with commercial VPNs, which produced visible false positives — legitimate players using mainstream privacy services were being bucketed with cheaters cycling alt accounts. The current version emits a separate residential_vpn verdict; operators configure it independently and most leave it on score, not enforce.

Mobile networks. Mobile carriers reassign ASNs frequently. A naive "three ASNs in 24 hours" rule would flag legitimate mobile players. The behavioral layer requires a minimum join count plus other corroborating signals before it raises an alt-cluster suspicion, which keeps the cellular-roaming case out of the false positives.

Boundary on the AI layer. The behavioral layer can be wrong. That's why it's advisory and never an enforce trigger by itself — see the page on false positives for how that boundary is enforced.

Operator recommendation

Roleplay (RP) servers: enforce on datacenter and tor; score on vpn and residential_vpn.
Competitive servers: enforce on everything except residential_vpn; that one stays on score with a higher threshold.
Build / test servers: observe across the board — you want logs, not kicks.