Detection · live

Anti-VPN

Anti-VPN classifies the network endpoint of an incoming connect. It runs at the connect path and emits a verdict that the operator's chosen mode (observe / score / enforce) turns into action.

What it protects against

Operators on FiveM commonly want to block evasion patterns — a player banned on identifier A coming back on identifier B from a fresh VPN endpoint, or alt-account farming through cheap datacenter IPs. Anti-VPN gives the connect path enough network context to make that decision.

Modes

Mode	Behavior
`observe`	Detection runs and produces a verdict, but no player-facing action is taken. Verdicts are written to the audit log so operators can review tuning before going live.
`score`	The verdict contributes to the player's aggregate risk score. Action is triggered when the score crosses the operator-configured threshold combined with other signals — never from this single check alone.
`enforce`	The verdict triggers the operator-configured action immediately (deny / queue / kick). Operators choose which actions a verdict maps to per server.

Verdicts

These are the verdict strings you'll see in dashboard logs and in the API response. They're stable strings — your tooling can match on them.

Verdict	What it means
`vpn`	Endpoint matches a known commercial VPN provider.
`proxy`	Anonymizing proxy (open or commercial).
`datacenter`	Server-hosted IP — cloud, hosting or scraping infrastructure.
`tor`	Active Tor exit node.
`residential_vpn`	Residential-IP-based VPN (consumer-privacy services that route through real residential connections). Scored separately from commercial VPNs.
`behavioral_alt_cluster`	Joins from this endpoint correlate with multi-account alt patterns — often a soft-positive on its own, used as a multiplier when combined with other verdicts.
`cleared`	Endpoint did not match any of the above.

Latency & cadence

< 50 ms

Connect-path lookup (typical)

In-process cache hit after the first lookup of an endpoint. Cold lookups are a one-time cost per endpoint per cache window.

~ 192 ms

Boot-time pull (cold)

First scheduler tick after resource start. Measured on Hetzner CX31, FiveM artifact 5500+, sample of 20 cold starts.

every 15 min

AI correlation pass

Off-path job that re-evaluates behavioral signals across recent joins. Doesn't affect the connect path.

daily, 03:00 UTC

ASN whitelist refresh

Public ASN allowlists pull once a day. Datacenter signals take precedence over generic VPN-list overlap.

Methodology: measurements are p99 over a representative sample, not median. Where we cite a number, we keep the bench script in the resource repo so we (and you) can reproduce it.

Operator recommendation

Roleplay (RP) servers: enforce on datacenter and tor; score on vpn and residential_vpn.
Competitive servers: enforce on everything except residential_vpn; that one stays on score with a higher threshold.
Build / test servers: observe across the board — you want logs, not kicks.