Every release of HawkAC (BuiltByBit) and HawkAC Lite (SpigotMC), newest first. Current version: 1.2.0 for both editions.
HawkAC 1.2.0: a new packet engine, with performance profiles
· HawkAC (Full) · BuiltByBit
A packet engine that judges movement, network timing, aim and clicks over the whole session, six performance profiles, a behaviour model as a second opinion, and seven new checks (70 in total).
Engine and profiles
The packet engine reads movement, network timing, aim and clicks on the player's own Netty thread. Flags are carried out in the player's own tick, so it is safe on Folia.
Six performance profiles: Potato, Low, Medium, Hard, Extreme and Ultimate, or auto. HawkAC moves down a profile by itself when TPS drops. Change it live with /hawk performance or the slider in the web panel. A lower profile sees less; it never judges more loosely.
A behaviour model gives a second opinion after the rules, never instead of them.
New checks
MacePhase: the fall that pays for a mace smash, built and undone in the tick of the attack (Wurst MaceDMG, LiquidBounce MaceKill). Wind charges, elytra, riptide and levitation are not judged.
PacketFly, BoatFly and GroundSpoof: flight by packets, boat flight and a faked on-ground state.
Timer: more client ticks than the server's own clock allows since a dated reply.
AntiDisabler: keep-alive and ping replies the server never sent, replies that overtake older ones and replies held back (ThunderHack and LiquidBounce disablers, PingSpoof by reordering).
CrashShield: packet floods, oversized data, book and item data beyond what the protocol uses, slots outside the open window, NaN and out-of-world coordinates. cancel_event drops the packet before the server handles it.
Aim and clicks over the whole session
Every turn in a fight is compared with where the target was at the delay the client sees it with, and at both neighbouring delays, because the server knows that delay only to within a tick.
AimAssist judges the session: aim error closed almost to zero, a crosshair that never leaves the hitbox while the target strafes, turns by a fixed share of the error (also under a random aim-point offset), one fixed curve. The share and curve rules use a lower confidence bound, so a short streak does not flag by chance.
AutoClicker and TriggerBot judge the click structure of the session: a fixed schedule within each second, attacks synced with the crosshair entering the target, no misses, recorded sequences replayed at every press, a tempo without human pauses. These rules run on exact client ticks (1.21.2+ and 1.8 clients).
1.8 clients through ViaVersion: their movement packets count their ticks, so the click and aim rules work for them too.
New flags of these checks only log by default (kick: false, ban: false).
Fixes
The click rules did not run for 1.21.2+ clients: the tick source was fixed when the player joined, before a tick-end packet could arrive. A session now switches to client ticks at its first tick-end packet.
A 1.8 client through ViaVersion on a 1.21.2+ server no longer has every tick counted twice.
suspicion_score always stays between 0 and 1.
Tested before release
Benchmark in a simulator, not a live server: 0 false positives in 100,000 simulated clean sessions; the rules detect 93.2% of 31,000 cheat sessions (31 cheat archetypes, sessions of 5 minutes). The figures per profile are in Detection. On a live server the result will differ in both directions.
Updating
Stop the server, replace the jar, start it again (a restart is better than /reload). config.yml updates itself once (config-version: 7): the engine section (engine.profile, engine.auto-downscale, engine.behaviour-model, engine.incidents) and the new checks are added; nothing you set is changed. Requirements: Paper, Spigot or Folia 1.16.5 to 26.x, Java 16 or newer, ProtocolLib for your server version (5.4.0 or newer on 1.21.2+).
HawkAC Lite 1.2.0
· HawkAC Lite · SpigotMC
Fixed: the layered suspicion score could go past its full value (a live test recorded more than 1). It now always stays between 0 and 1, in alerts, in /hawk commands, in the API (getSuspicionScore) and in the recorded data.
Everything else is as in 1.1.1: the same seven enforcing checks, Paper, Spigot and Folia, Bedrock players judged by what holds for their controls. The 1.2.0 packet engine is in HawkAC (Full).
Updating: stop the server, replace the jar, start it again. Nothing in config.yml changes.
HawkAC Lite 1.1.1: Spigot and Folia, Bedrock players protected, false-positive fixes
· HawkAC Lite · SpigotMC
Runs on Spigot and Folia now, judges Bedrock players by what holds for their controls, and two false positives found in testing are gone. Before release: 0 flags and 0 kicks on 52,000 simulated legit players.
Spigot and Folia
One jar for Paper, Spigot and Folia, 1.16.5 to 26.x. On Spigot HawkAC measures TPS and tick time itself; on Folia every task runs on the region that owns the player, as Folia requires. The console names the platform at startup.
Tested like Paper: the same 2,520 cheat configurations were run on Folia and on Spigot with the same results as on Paper, and 0 of 10,000 simulated legit players were flagged there.
Bedrock players (Geyser / Floodgate)
Until now Bedrock players were never judged, which also let a Bedrock client use the one-shot mace and arrow exploits.
ArrowDamage and MaceDamage now judge every Bedrock player: the server measures the arrow's launch speed and the fall itself, whatever the controls.
SilentAim and AimValidation judge those who play with a mouse or a controller (there is a crosshair). Touch players attack wherever the finger taps, so they are not judged by aim.
Geyser answers the server's keep-alives itself, so the measured ping is Geyser's, not the phone's: a Bedrock player's look is replayed with a wide latency allowance.
360 simulated Bedrock fights (touch, controller, mouse) and 12,000 Bedrock profiles: 0 flags. New setting settings.bedrock-mode: profile (default), exempt (the old behaviour) or java.
False positives fixed
Hitting a player while holding the mouse completely still could be read as a no-rotation aura (KillAura) or a machine turn (SmoothRotation): one old turn was judged again at every hit. Both research modules are passive in Lite, so this only touched the recorded data; fixed anyway. 240 simulated frozen-mouse fights: 0 flags.
Tested before release
13,000 simulated legit players on each of four server versions (1.16.5, 1.19.4, 1.21.4, 26.1): 0 flags, 0 kicks in 52,000 runs, plus Folia, Spigot and Bedrock runs.
2,520 cheat configurations from 8 clients: the seven enforcing checks kicked 231 of the 280 built to trigger them, 801 cheat runs in all, and no legit player.
880 automated tests pass, also on the obfuscated jar.
Updating: stop the server, replace the jar, start it again. config.yml updates itself once (config-version: 5): settings.bedrock-mode is added. If you had exempt-bedrock-players: false, it becomes bedrock-mode: java, so your choice is kept. Requirements: Paper, Spigot or Folia 1.16.5 or newer (or a Paper fork), Java 16 or newer, ProtocolLib for your server version (5.4.0 or newer on 1.21.2+).
HawkAC Lite 1.1.0: Paper 1.16.5 to 26.x, Blink enforced, ten new checks, shadow decision engine
· HawkAC Lite · SpigotMC
Server versions: Paper 1.16.5 to the yearly releases (26.1, 26.2) on Java 16 or newer, and Paper forks such as Purpur, Pufferfish and Leaf. (Spigot and Folia followed in 1.1.1.)
Blink becomes the seventh enforcing check in Lite: movement held back and flushed in a burst ends with the packets dropped and a kick.
Ten new modules, each built from the code of the cheat it targets (Meteor, Wurst, LiquidBounce, ThunderHack, BleachHack, Lambda, Raven, Hydrogen):
Blink (enforced): movement packets held back and sent at once; on 1.21.2+ clients per client tick, on older clients dated against the server's keep-alives.
PingSpoof: keep-alives delayed on purpose while chunks and teleports are answered at once.
FakeLag: a held packet queue released the instant an attack is sent.
AutoLog: disconnects timed to low health, remembered across restarts.
InvManager: inventory sorting and cleaning bots, by Fitts's law timing and clicks locked to the client tick.
AimAssist: synthetic mouse pulling that leaves the grid of the player's own mouse sensitivity.
TargetPlace: blocks placed around an opponent faster than a crosshair can.
Eagle: automated bridge sneaking at the block edge.
AutoMLG: automated water-bucket clutches.
AutoSign: sign-editor automation.
Shadow decision engine: behaviour features over several time windows and against the player's own session baseline, grouped in six families (aim, click, network, inventory, world, movement). It observes only and never punishes. /hawk ai <player> shows its state, /hawk label <player> <cheat|clean|unsure> saves a verified verdict, and an offline training kit trains gradient-boosted trees.
False positives fixed: PacketMine on miners sweeping across block faces, SilentAim and PacketBuild timing, AnchorAura on fast rhythmic manual players, BowAimbot on steady archers.
Benchmark: 0 false positives and 0 kicks across 104,000 simulated legit sessions on four server versions; 2,520 cheat configurations detected at 85.0% on Paper 1.21.4 and 26.1, 79.4% on 1.20.4 and 78.1% on 1.16.5.
Updating: config.yml updates itself once (config-version: 4): the sections of the new checks are added from the jar; nothing you set is changed.
HawkAC Lite 1.0.9: Paper 1.20.1 and newer, three new checks, false-positive fixes
· HawkAC Lite · SpigotMC
Paper 1.20.1 to 1.21 and newer, on Java 17 and 21. Bukkit names that depend on the server release are resolved at startup; MaceDamage is switched off on 1.20.x with a notice.
Three new checks, passive in Lite: Criticals (fake hops that claim critical damage), PacketSequence (movement timing around swings on modern clients) and AimPoint (hits pinned to one exact point of the target).
False positives fixed: ChestStealer (Mouse Tweaks drags and shift double-clicks; the rhythm rule needs more samples), GhostHand (container interactions are validated through obstructions and distance), AutoFish (quick human reflexes), AimValidation (target positions replayed across the latency window), MaceDamage (the smash paired with its airborne hit), CrystalAura (judged only on steady connections), InteractAura (block edges count as visible when a neighbouring face is), AutoTotem (the click pair must match the pickup slot), Scaffold AirPlace (blocks changed by world events are ignored).
Layered detection needs at least two independent checks to agree before it acts. SupportReminder is off by default in Lite.
Tested: 0 false flags and 0 kicks across 3,500 clean player sessions in Full and Lite; 596 unit tests pass under the standard and the pl_PL locale; every class of the obfuscated build verified by the JVM. config-version: 3.
The official 1.21 test server is live
· HawkAC Lite
Test HawkAC Lite live against combat exploits (mace and arrow damage, SilentAim) on the official server: 149.50.116.48:30122.
HawkAC Lite 1.0.7: client ticks, zero false kicks, exploit patches
· HawkAC Lite · SpigotMC
Client ticks on 1.21.2+: HawkAC counts ticks from the client's end-of-tick packet instead of guessing from the server clock. ViaVersion is a soft dependency; rules that need true client ticks are skipped on synthetic ticks.
False kicks removed: AimValidation on stationary targets (mob stackers, dummies), MultiPlace and FastDrop on weak Wi-Fi (now per client tick), PacketBuild when pillaring on the block axis, FastUse removed (vanilla cooldowns already enforce it), CrystalAura kick off by default in Full, GhostHand on recently updated blocks.
Exploits patched: duplicate movement packets in one tick right before an arrow release or a mace strike (Wurst ArrowDMG, Meteor mace criticals, LiquidBounce MaceKill); TriggerBot criticals judged from the ground state at the end of the previous tick; taking damage no longer silences MultiAura, AimValidation or FastBow; wind-charge knockback is tracked.
Other: the Honeypot crash on 1.20.4+ fixed; AutoRespawn and AutoReconnect flag instant-respawn mods and reconnect bots; new panel permissions hawk.panel.unban and hawk.panel.teleport; config-version: 2.
Kick and ban counters, cleaner data, a support link
· HawkAC Lite · SpigotMC
/hawk info shows how many kicks and bans HawkAC handed out this week and since install, per check, and to how many players; kept in data/punishments.properties.
A weekly summary file (data/summary-2026-W39.csv and so on), sent with the weekly upload only with ai-telemetry: true: numbers only, no names, UUIDs or IPs.
Cleaner behaviour data: rotation figures from the turns of their own window, clicks count the attack button only, click_entropy ignores pauses, aim columns relative to the hitbox, no ping in the first minute online, an empty cell means not measured.
Operators see a support link once per hour online (support-reminder.enabled: false turns it off). No check, threshold or punishment changed.
HawkAC Lite 1.0.5: 50 checks, Discord webhooks, Bedrock support, staff suite
· HawkAC Lite · SpigotMC
Eight new passive checks: AutoClicker, TriggerBot, AnchorAura, BedAura, AutoEat, AntiAFK, InteractAura, WallBreak; also AutoMine for Baritone-style bot mining.
Discord alerts through a webhook, batched and never with @mentions.
Fewer false punishments: Bedrock players are not judged by checks built for Java input; 1.21.11 spear hits and damage from other plugins are not judged as aimed hits; a hit is only cancelled when the flag behind it counts.
Fixes: the plugin never writes config.yml (the data salt lives in salt.txt); players already online are checked when the plugin is enabled; decimal dots in the behaviour CSV on every locale; each finished file is sent once; a rare thread race in click counting fixed.
The limits of the free edition are built into the code; the jar is name-obfuscated with ProGuard (the alert API keeps its names). On 1.21.2+ use ProtocolLib 5.4.0 or newer.
HawkAC Lite 1.0.4: privacy and compliance fix
· HawkAC Lite · SpigotMC
Other players' names are removed from check details before a row is saved, so uploaded data is anonymous.
A promotional line was removed from the startup message and the config.yml header. No detection changes.
HawkAC Lite 1.0.3: rebuilt exploit and combat detection
· HawkAC Lite · SpigotMC
Every check was compared with the source code of popular cheat clients (Wurst, Meteor, LiquidBounce, ThunderHack, Lambda, BleachHack, Raven) and many rules were rebuilt.
Active checks: ArrowDamage checks the launch speed when the arrow is fired and cancels a spoofed arrow; MaceDamage audits the fall behind every smash; SilentAim rebuilt; MultiAura judged from attack packets (sweeping and Thorns ignored); AimValidation thread race fixed; FastBow catches release-and-redraw in one tick.
Many passive checks fixed or rebuilt; FastEat and FastRegen off by default (the 1.21 server controls them itself).
Behaviour CSV: 16 new columns (57 in total), a new file every day, built-in data-quality checks. New option checks.arrowdamage.max-arrow-speed; a much smaller jar.
HawkAC Lite 1.0.2: stability, telemetry and null-safety
· HawkAC Lite · SpigotMC
Fixed a NullPointerException in AutoTotem when a player disconnects in the tick of taking combat damage; redundant inventory listeners removed.
Four new telemetry metrics: movement_duration_ms, attacks_count, combat_duration_ms, action_duration_ms; the CSV schema is kept in sync with DataQualityMonitor.
AEGISTECH