# hawkac.pl: the full text > The whole text of the hawkac.pl pages (home page and changelog) as Markdown, for AI assistants and search tools. The short version with links is https://hawkac.pl/llms.txt. Every detection figure was measured in a simulator (the HawkAC benchmark), not on a live server. HawkAC 1.2.0 A new packet engine, with performance profiles # Fair play, read from the packets. AegisTech makes Minecraft server plugins. Our anticheat, HawkAC, catches the cheats that movement simulation does not see, and runs next to GrimAC instead of replacing it. See the plugins (https://hawkac.pl/#products) Open the web panel (https://hawkac.pl/dashboard) - Paper, Spigot, Folia 1.16.5 - 26.x - Built to run next to GrimAC - Bedrock players through Geyser - Cheat sessions flagged - 93.2 % rules and the behaviour model together, across 31 cheat archetypes - False positives - 0 in 100,000 simulated clean sessions - Rules alone - 93.2 % of 31,000 cheat sessions, without the model - Checks - 70 in five areas, 67 on by default Measured in simulation HawkAC 1.2.0 benchmark with simulated players, not a live server. How it was measured ## Rules written from the source code of - Wurst - Meteor - LiquidBounce - Lambda - ThunderHack - Raven - BleachHack - Hydrogen - meteor-rejects - KillAura - MultiAura - SilentAim - AimValidation - AimAssist - AimPoint - Blink - Timer - PacketFly - GroundSpoof - BoatFly - CrashShield - AntiDisabler - PingSpoof - FakeLag - CrystalAura - AnchorAura - BedAura - TriggerBot - Criticals - ArrowDamage - MaceDamage - MacePhase - FastBow - BowAimbot - AutoTotem - AutoArmor - InvManager - ChestStealer - Scaffold - Nuker - PacketMine - TargetPlace - AutoLog - Eagle - AutoMLG - AutoClicker - WeaponSwap - X-Ray - GhostHand - AutoSign - FastPlace - Surround Products ## Plugins by AegisTech. Each one does one job, properly. Bought plugins are delivered by BuiltByBit; the free edition comes from SpigotMC. Your account here is for the web panel. Flagship · BuiltByBit · 1.2.0 ### HawkAC Packet-level anticheat for Paper, Spigot and Folia. It covers what movement simulation does not look at: rotations faked only for the server, held and delayed packets, several targets hit at once, one-shot damage exploits, click, inventory and building automation. - 70 checks, every one written from the source of the cheat it targets - The 1.2.0 packet engine, with six performance profiles and a behaviour model - Live web panel on hawkac.pl, with actions - Ban waves, mitigation, a punishment ladder, a developer API $14.99on BuiltByBit Buy on BuiltByBit (https://builtbybit.com/resources/hawkac-packet-level-anticheat.125055/) How it works (https://hawkac.pl/#how) Free · SpigotMC · 1.2.0 ### HawkAC Lite Seven combat checks that cancel the hit or kick: ArrowDamage, MaceDamage, SilentAim, AimValidation, MultiAura, Blink and FastBow. 53 more modules run in passive mode and only record anonymous data. - Runs next to GrimAC - The same staff tools: alerts, profile, silent watch, debug Free Download on SpigotMC (https://www.spigotmc.org/resources/hawkac-lite-near-zero-false-positive-combat-anticheat-grimac-1-16-26-x.139012/) Anti-bot · BuiltByBit ### AegisZero An advanced anti-bot for Minecraft 1.20 and 1.21 servers, running on several server platforms. It stops bot floods before they reach your players. Ask on Discord (https://discord.gg/aKyCch6eaB) Chat filter · BuiltByBit ### Vanguard 2.0 A chat filter for 32 languages that blocks advertising and promotion in chat, abbreviations and all. Ask on Discord (https://discord.gg/aKyCch6eaB) ### Full or Lite? Both run next to GrimAC and share the staff tools. Full lets every check act, and adds the web panel and the server-owner features. HawkAC on BuiltByBit (https://builtbybit.com/resources/hawkac-packet-level-anticheat.125055/) Lite on SpigotMC (https://www.spigotmc.org/resources/hawkac-lite-near-zero-false-positive-combat-anticheat-grimac-1-16-26-x.139012/) HawkAC Full and HawkAC Lite compared | Feature | HawkAC | HawkAC Lite | | --- | --- | --- | | Checks that cancel, kick or ban | Every check, as you configure it | Seven combat checks | | The other checks | Act as configured; 67 on by default | Passive: record anonymous data only | | Staff tools: alerts, profile, silent watch, bypass, debug | Yes | Yes | | Web panel on hawkac.pl | Yes | No | | Ban waves and mitigation | Yes | No | | GrimAC and Vulcan flags in the layered score | Yes | No | | Developer API (HawkAPI) | Yes | No | | Your own branding in kick and ban messages | Yes | No | | Price | $14.99 on BuiltByBit | Free on SpigotMC | How it works ## The other half of the problem. GrimAC simulates movement; HawkAC reads the rest. Grim simulates movement, reach and velocity. HawkAC does not duplicate that simulation; from 1.2.0 it also judges the protocol around it (dated ticks, teleport answers, ground claims, packet floods). Together they cover both halves. HawkAC's packet pipeline, step by step, is described in the four cards below. ### Captured on the network thread ProtocolLib hands every packet to HawkAC on the player's own Netty thread, before the server acts on it. A rotation that exists only for the attack, five entities hit in one tick, a position faked for a single arrow: proved from what the client sent. ### Judged off the main thread A per-player engine with pooled, preallocated buffers reads each packet right there, dated against what the server itself sent: keep-alives, pings, teleports. Your tick never waits for it. ### Several witnesses, one score Independent checks add to one layered score, so heuristics never punish alone, while proof of something the game forbids acts at once. From the hard profile up, a compiled behaviour model gives a second opinion. ### Acted on in tick context Flags, cancels and punishments move to the player's own thread: the main thread on Paper and Spigot, the player's region on Folia. Nothing on the network side touches the world. Detection, measured ## Measured, not promised. Pick a profile and see what it catches. HawkAC 1.2.0 was benchmarked in a simulator: cheating and clean players, sent packet by packet through the plugin's own engine. Every figure here comes from that run. ### Performance profiles How much CPU the engine may use. A lower profile sees less; it never judges more loosely, so it can miss more but never flag more. Share of simulated cheat sessions flagged, per performance profile | Profile | Rules alone | Rules + model | | --- | --- | --- | | Potato | 74.6 % | 74.6 % | | Low | 93.2 % | 93.2 % | | Medium | 93.3 % | 93.3 % | | Hard | 93.2 % | 93.2 % | | Extreme | 93.2 % | 93.2 % | | Ultimate | 93.2 % | 93.2 % | Set it with `engine.profile` in config.yml, `/hawk performance` or the web panel's slider; `auto` picks one from the server's CPU cores. The behaviour model runs from the hard profile up. ### By cheat family Share of simulated cheat sessions flagged by the rules alone. Movement 99.2 % Network/Timer 97.8 % Crash 100.0 % Aim 96.6 % Click 78.2 % 0 false positives in 100,000 simulated clean sessions of 5 minutes each, measured against 31,000 cheat sessions across 31 archetypes. Measured in simulation The benchmark is a simulator, not a live server. Real servers add their own ping, versions and clients, so read these figures as how the engine behaves under controlled conditions. ### What no server-side plugin can see - Purely client-side modules. ESP, Fullbright, Freecam, zoom and nametags change no packet the server receives. For X-Ray, what can be judged is how somebody mines. - An aura that never rotates. With the target already in view and the camera still, there is no trace to catch. - A carefully configured client. A user who works through every setting for smoothing, misses and hesitation becomes very hard to tell apart. - Paid ghost clients. Without their source we do not pretend to know what they do. Checks and features ## 70 checks in five areas. Each written from the cheat it targets. 67 are on by default. Proofs of something the game forbids can act alone; heuristics only add to the layered score. Pick an area to see what each check looks for. ### Combat 26 checks - SilentAim A rotation sent only for the attack - AimValidation A server-side ray check on every hit - AimAssist A second hand on the camera in melee - AimPoint Every hit on one exact point of the target - KillAura Hits outside the field of view - MultiAura Several targets in one client tick - HeadSnap Instant snaps onto the target - SmoothRotation Machine-smooth turning - AimConvergence Aim assist that settles on a target - Criticals A fake hop sent in front of a hit - PacketOrder Packets out of vanilla order (1.21.2+) - AutoClicker Clicks timed by a program - TriggerBot Hits on the first tick the weapon is ready - WeaponSwap Swap, hit, swap-back cycles - AutoPot A fake look-down around a potion throw - BowAimbot Arrows on an aimbot's arc formula - FastBow Bow spam - ArrowDamage Position-spoofed arrows - MaceDamage Fake falls behind mace smashes - MacePhase1.2.0 A mace fall built and undone inside the attack tick - CrystalAura Crystals broken on a fixed rhythm - AnchorAura Anchors placed, charged and detonated in one tick - BedAura Beds placed and detonated in one tick - AutoAnvil Anvils dropped on a player by a bot click - SwapSpam Offhand-swap packet floods - Honeypotoff by default An invisible bait entity for suspects ### Player & movement 13 checks - PacketFly1.2.0 Positions no movement can produce, and teleport answers never asked for - GroundSpoof1.2.0 "On ground" claimed in the air, or the other way round - BoatFly1.2.0 A vehicle rising or hovering with nothing under it - AutoLog Leaving a fight by program - Eagle Sneaking at a bridge edge by program - AutoMLG A water bucket placed by program - AutoSprint Sprinting backwards or without hunger - AntiAFK Camera loops while idle - AutoFish Bite reactions too fast or too regular - AutoReconnect Reconnecting after a kick on a timer - AutoRespawn Respawning faster than the death screen - MassTpa Teleport requests to many players on a schedule - FastRegenoff by default Regeneration faster than the effect level allows ### World & building 16 checks - Scaffold Placing on faces that cannot be seen - TargetPlace Blocks closing in another player - Surround A surround built in one tick - PacketBuild Faked rotations around block actions - FastPlace Placements closer than the cooldown allows - MultiPlace More than one block per client tick - Nuker Many blocks broken at once - WallBreak Digging with no line of sight - PacketMine Breaking while looking away - AutoMine Mining bots and computed aim - GhostHand Placing or opening beyond reach or through walls - InteractAura Mob clicks from inside the hitbox - AutoTool A tool switch synced to the start of digging - AutoFarm Instant harvest and replant - AutoSign Sign text sent before it could be read - X-Raystaff review Rate of hidden ores and a wandering path ### Inventory 9 checks - InvManager Sorting the inventory by program - AutoTotem A totem refilled faster than a hand can - AutoArmor Armour equipped in the same tick as a hit - AutoEat Switch, eat and switch back by program - ChestStealer Looting at a machine rhythm - InventoryMove Moving with an inventory open - FastDrop Many drops in one client tick - FastEatoff by default Eating faster than the item allows - FastUselegacy Retired; kept so older configs still load ### Network & protocol 6 checks - Timer1.2.0 More client ticks than the server's dated replies allow - AntiDisabler1.2.0 Answers to pings the server never sent, or out of order - CrashShield1.2.0 Packet floods and malformed data, dropped before the server reads them - Blink Movement held back and released at once - PingSpoof The keep-alive answer held back on its own - FakeLag Lag spikes that end on an attack ### Performance profiles1.2.0 Six levels, from potato to ultimate, picked from your CPU cores or by you. Under low TPS the engine steps down a level and back up once the server recovers. ### A behaviour model1.2.0 Compiled into the plugin, it gives a second opinion on aim, clicks and network timing over each fight. No outside service is asked. ### Wireframe incidents1.2.0 The last minute around a flagged player, saved as bare geometry: positions, looks and the target. The newest one opens in the web panel, without map coordinates. ### Web panel on hawkac.pl Detections live, players with ping, client and suspicion, every check, the server's health, and actions - from any browser. No port to open. ### A layered score GrimAC and Vulcan flags count towards HawkAC's own score, so a player is judged on everything at once. ### Ban waves and mitigation Hold bans for a wave so cheaters cannot tell what caught them, or weaken a cheater's hits instead of kicking. ### Written from the cheats' code Every rule was built from the source code of the cheat it targets, then measured against simulated clean players: 0 false positives in 100,000 clean sessions. ### A developer API HawkAPI and HawkAlertEvent let your own plugins read HawkAC's verdicts and alerts. ### Bedrock players too Players joining through Geyser and Floodgate are recognised and judged only by the checks that hold for their controls. Nothing to configure. Web panel ## Your server, from any browser. HawkAC Full connects to your account by itself. No port to open, no hosting, nothing to install. Nothing is sent until you link a server. - Create an account An e-mail address and a password. Create one (https://hawkac.pl/register). - Add your server The panel shows a one-time code, valid for 10 minutes. - Type it on the server `/hawk code ` in the console. The server appears in your panel within seconds. server console ``` > /hawk code K7QF-M2XA [HawkAC] Asking https://hawkac.pl... [HawkAC] Linked to the hawkac.pl account you@example.com. The server shows up in your panel within a few seconds. [HawkAC] Web panel (hawkac.pl): turned scaffold on -> /hawk check scaffold on ``` - Detections, kicks and bans, live - Players with ping, client and suspicion - Every check, on or off - TPS, MSPT, memory and CPU - The performance profile slider - Kick, silent watch, bypass, reset, ban wave Install ## Running in minutes. Three things required, nothing else. Server software, Java and ProtocolLib are required; the rest is optional. HawkAC has no other dependencies. Required ### Server software 1.16.5 to 26.x - Paper - Spigot - Folia - Purpur - Pufferfish One jar for all of them. Paper forks such as Purpur and Pufferfish work too. Required ### Java 16 or newer - Minecraft 1.16.5 to 1.17 - Java 16+ - Minecraft 1.18 to 1.20.4 - Java 17+ - Minecraft 1.20.5 and newer - Java 21+ Required ### ProtocolLib 5.4.0+ On Minecraft 1.21.2 and newer. On older servers use any build that supports your exact server version. Recommended ### GrimAC Run both. Grim handles movement, reach and velocity; HawkAC covers combat automation, held packets, one-shot exploits, inventory and building. Grim's and Vulcan's flags also count towards HawkAC's layered score. Optional ### Geyser / Floodgate Bedrock players are recognised and judged by the checks that hold for their controls. Nothing to configure. Optional ### ViaVersion With it, HawkAC records each player's real client version. ### Install in minutes - Add the jars Put HawkAC and ProtocolLib in your `plugins/` folder. - Restart the server Do not use /reload. Packet listeners need a clean start. Read the console The packet listener line means HawkAC is running. ``` [HawkAC] Server software: Paper. [HawkAC] Packet listener registered with ProtocolLib. [HawkAC] Configuration looks consistent. ``` Link the web panel Sign in at hawkac.pl, choose Add server, then type the code it shows: `/hawk code ` Give staff their permissions Ordinary permissions, so any permission plugin works. Give `hawk.bypass` to builders before turning punishments on. `/lp group admin permission set hawk.alerts true` Updating later. Stop the server, replace the jar, start it. config.yml updates itself once and keeps what you set. in game ``` > /hawk performance hard [Hawk] Performance profile set to HARD (chosen by the owner). Applied to every player now. > /hawk profile Steve ---------- [Hawk] Steve ---------- Layered score: 64% (killaura, smoothrotation) Violations: killaura 3.0 (4s), smoothrotation 1.5 (11s) > /hawk silent Steve on [Hawk] Silent watch for Steve: on. Flags and alerts continue; nothing is cancelled, nobody is kicked. ``` ### Staff commands - `/hawk alerts` - Your own alerts on or off - `/hawk profile ` - Layered score, violations, ping, status - `/hawk ai ` - What the decision engine thinks, and why - `/hawk silent [on|off]` - Watch without acting - `/hawk bypass ` - Not checked at all for a while - `/hawk debug ` - Every result for one player, live - `/hawk check ` - One check on or off, no restart - `/hawk reset ` - Clear a player's violations and score - `/hawk performance ` - Change the performance profile live - `/hawk banwave [list|run|add|remove|clear]` - The ban-wave queue - `/hawk code | status | unlink` - Link this server to hawkac.pl, show or end the link - `/hawk label ` - Your verdict, for training - `/hawk panel` - The in-game staff panel: who is worth a look now - `/hawk discord test` - Send a test alert to your Discord webhook - `/hawk update` - Ask BuiltByBit for a newer version - `/hawk info` · `/hawk reload` - Version, kicks and bans; reload the config Every command completes with TAB. `hawk.admin` grants all of them; `hawk.alerts` gives alerts, the panel, profile and ai; `hawk.bypass` skips every check. Data and privacy ## Data and privacy, in the open. HawkAC records anonymous behaviour data to improve detection. Read what it keeps, what it sends and how to stop it before you buy. ### What is recorded - Timings - Rotation statistics - Check results - The decision engine's verdict - Server and client version Written to files on your server. Detection is the same whether or not you send them. ### What is never recorded - Chat - IP addresses - Coordinates - Other players' names Players appear only as salted hashes. The salt is made on your server and never leaves it. ### What is sent - Those files, once a week - A weekly summary: kicks and bans per check, and how many players were punished It goes to AegisTech to train the detection model for future versions. The summary is numbers only, no player data. On by default. ### One switch turns it off. Set it to false and nothing leaves your server. The address it sends to is written in config.yml and printed in the console at every startup. The kick and ban counters in /hawk info keep working. config.yml `ai-telemetry: false` ### Every other connection HawkAC makes - Update check Asks BuiltByBit for a newer version at startup and every 6 hours. It never downloads or replaces the jar. - bStats Anonymous server statistics, like most plugins. - Discord alerts Only if you paste a webhook. Off by default. - Web panel Only once you link a server: what the panel shows, never chat, IP addresses or coordinates. See the Privacy Policy (https://hawkac.pl/privacy). Support ## Found a bug or a false positive? Tell us. ### Discord Bug reports, questions, suggestions and announcements. A report with the console lines around the flag is usually enough to fix it. Join discord.gg/aKyCch6eaB (https://discord.gg/aKyCch6eaB) ### Before you write `/hawk debug ` shows every result live, and `/hawk check off` switches a check off at once. Turn on `debug-exemptions` in config.yml, then send us the lines. What we fix first: false positives, then crashes and TPS drops, then new client versions, then new features. Changelog # What changed, and when Every release of HawkAC (BuiltByBit) and HawkAC Lite (SpigotMC), newest first. Current version: 1.2.0 for both editions. ## HawkAC 1.2.0: a new packet engine, with performance profiles October 2026 · HawkAC (Full) · BuiltByBit A packet engine that judges movement, network timing, aim and clicks over the whole session, six performance profiles, a behaviour model as a second opinion, and seven new checks (70 in total). ### Engine and profiles - The packet engine reads movement, network timing, aim and clicks on the player's own Netty thread. Flags are carried out in the player's own tick, so it is safe on Folia. - Six performance profiles: Potato, Low, Medium, Hard, Extreme and Ultimate, or auto. HawkAC moves down a profile by itself when TPS drops. Change it live with `/hawk performance` or the slider in the web panel. A lower profile sees less; it never judges more loosely. - A behaviour model gives a second opinion after the rules, never instead of them. ### New checks - MacePhase : the fall that pays for a mace smash, built and undone in the tick of the attack (Wurst MaceDMG, LiquidBounce MaceKill). Wind charges, elytra, riptide and levitation are not judged. - PacketFly , BoatFly and GroundSpoof : flight by packets, boat flight and a faked on-ground state. - Timer : more client ticks than the server's own clock allows since a dated reply. - AntiDisabler : keep-alive and ping replies the server never sent, replies that overtake older ones and replies held back (ThunderHack and LiquidBounce disablers, PingSpoof by reordering). - CrashShield : packet floods, oversized data, book and item data beyond what the protocol uses, slots outside the open window, NaN and out-of-world coordinates. `cancel_event` drops the packet before the server handles it. ### Aim and clicks over the whole session - Every turn in a fight is compared with where the target was at the delay the client sees it with, and at both neighbouring delays, because the server knows that delay only to within a tick. - AimAssist judges the session: aim error closed almost to zero, a crosshair that never leaves the hitbox while the target strafes, turns by a fixed share of the error (also under a random aim-point offset), one fixed curve. The share and curve rules use a lower confidence bound, so a short streak does not flag by chance. - AutoClicker and TriggerBot judge the click structure of the session: a fixed schedule within each second, attacks synced with the crosshair entering the target, no misses, recorded sequences replayed at every press, a tempo without human pauses. These rules run on exact client ticks (1.21.2+ and 1.8 clients). - 1.8 clients through ViaVersion: their movement packets count their ticks, so the click and aim rules work for them too. - New flags of these checks only log by default (`kick: false` , `ban: false` ). ### Fixes - The click rules did not run for 1.21.2+ clients: the tick source was fixed when the player joined, before a tick-end packet could arrive. A session now switches to client ticks at its first tick-end packet. - A 1.8 client through ViaVersion on a 1.21.2+ server no longer has every tick counted twice. - `suspicion_score` always stays between 0 and 1. ### Tested before release Benchmark in a simulator, not a live server: 0 false positives in 100,000 simulated clean sessions; the rules detect 93.2 % of 31,000 cheat sessions (31 cheat archetypes, sessions of 5 minutes). The figures per profile are in Detection (https://hawkac.pl/#detection). On a live server the result will differ in both directions. ### Updating Stop the server, replace the jar, start it again (a restart is better than `/reload` ). `config.yml` updates itself once (`config-version: 7` ): the `engine` section (`engine.profile` , `engine.auto-downscale` , `engine.behaviour-model` , `engine.incidents` ) and the new checks are added; nothing you set is changed. Requirements: Paper, Spigot or Folia 1.16.5 to 26.x, Java 16 or newer, ProtocolLib for your server version (5.4.0 or newer on 1.21.2+). ## HawkAC Lite 1.2.0 October 2026 · HawkAC Lite · SpigotMC - Fixed: the layered suspicion score could go past its full value (a live test recorded more than 1). It now always stays between 0 and 1, in alerts, in `/hawk` commands, in the API (`getSuspicionScore` ) and in the recorded data. - Everything else is as in 1.1.1: the same seven enforcing checks, Paper, Spigot and Folia, Bedrock players judged by what holds for their controls. The 1.2.0 packet engine is in HawkAC (Full). - Updating: stop the server, replace the jar, start it again. Nothing in `config.yml` changes. ## HawkAC Lite 1.1.1: Spigot and Folia, Bedrock players protected, false-positive fixes 9 October 2026 · HawkAC Lite · SpigotMC Runs on Spigot and Folia now, judges Bedrock players by what holds for their controls, and two false positives found in testing are gone. Before release: 0 flags and 0 kicks on 52,000 simulated legit players. ### Spigot and Folia - One jar for Paper, Spigot and Folia, 1.16.5 to 26.x. On Spigot HawkAC measures TPS and tick time itself; on Folia every task runs on the region that owns the player, as Folia requires. The console names the platform at startup. - Tested like Paper: the same 2,520 cheat configurations were run on Folia and on Spigot with the same results as on Paper, and 0 of 10,000 simulated legit players were flagged there. ### Bedrock players (Geyser / Floodgate) - Until now Bedrock players were never judged, which also let a Bedrock client use the one-shot mace and arrow exploits. - ArrowDamage and MaceDamage now judge every Bedrock player: the server measures the arrow's launch speed and the fall itself, whatever the controls. - SilentAim and AimValidation judge those who play with a mouse or a controller (there is a crosshair). Touch players attack wherever the finger taps, so they are not judged by aim. - Geyser answers the server's keep-alives itself, so the measured ping is Geyser's, not the phone's: a Bedrock player's look is replayed with a wide latency allowance. - 360 simulated Bedrock fights (touch, controller, mouse) and 12,000 Bedrock profiles: 0 flags. New setting `settings.bedrock-mode` : `profile` (default), `exempt` (the old behaviour) or `java` . ### False positives fixed - Hitting a player while holding the mouse completely still could be read as a no-rotation aura (KillAura) or a machine turn (SmoothRotation): one old turn was judged again at every hit. Both research modules are passive in Lite, so this only touched the recorded data; fixed anyway. 240 simulated frozen-mouse fights: 0 flags. ### Tested before release - 13,000 simulated legit players on each of four server versions (1.16.5, 1.19.4, 1.21.4, 26.1): 0 flags, 0 kicks in 52,000 runs, plus Folia, Spigot and Bedrock runs. - 2,520 cheat configurations from 8 clients: the seven enforcing checks kicked 231 of the 280 built to trigger them, 801 cheat runs in all, and no legit player. - 880 automated tests pass, also on the obfuscated jar. Updating: stop the server, replace the jar, start it again. `config.yml` updates itself once (`config-version: 5` ): `settings.bedrock-mode` is added. If you had `exempt-bedrock-players: false` , it becomes `bedrock-mode: java` , so your choice is kept. Requirements: Paper, Spigot or Folia 1.16.5 or newer (or a Paper fork), Java 16 or newer, ProtocolLib for your server version (5.4.0 or newer on 1.21.2+). ## HawkAC Lite 1.1.0: Paper 1.16.5 to 26.x, Blink enforced, ten new checks, shadow decision engine 9 October 2026 · HawkAC Lite · SpigotMC - Server versions: Paper 1.16.5 to the yearly releases (26.1, 26.2) on Java 16 or newer, and Paper forks such as Purpur, Pufferfish and Leaf. (Spigot and Folia followed in 1.1.1.) - Blink becomes the seventh enforcing check in Lite: movement held back and flushed in a burst ends with the packets dropped and a kick. Ten new modules , each built from the code of the cheat it targets (Meteor, Wurst, LiquidBounce, ThunderHack, BleachHack, Lambda, Raven, Hydrogen): - Blink (enforced): movement packets held back and sent at once; on 1.21.2+ clients per client tick, on older clients dated against the server's keep-alives. - PingSpoof : keep-alives delayed on purpose while chunks and teleports are answered at once. - FakeLag : a held packet queue released the instant an attack is sent. - AutoLog : disconnects timed to low health, remembered across restarts. - InvManager : inventory sorting and cleaning bots, by Fitts's law timing and clicks locked to the client tick. - AimAssist : synthetic mouse pulling that leaves the grid of the player's own mouse sensitivity. - TargetPlace : blocks placed around an opponent faster than a crosshair can. - Eagle : automated bridge sneaking at the block edge. - AutoMLG : automated water-bucket clutches. - AutoSign : sign-editor automation. - Shadow decision engine: behaviour features over several time windows and against the player's own session baseline, grouped in six families (aim, click, network, inventory, world, movement). It observes only and never punishes. `/hawk ai ` shows its state, `/hawk label ` saves a verified verdict, and an offline training kit trains gradient-boosted trees. - False positives fixed: PacketMine on miners sweeping across block faces, SilentAim and PacketBuild timing, AnchorAura on fast rhythmic manual players, BowAimbot on steady archers. - Benchmark: 0 false positives and 0 kicks across 104,000 simulated legit sessions on four server versions; 2,520 cheat configurations detected at 85.0% on Paper 1.21.4 and 26.1, 79.4% on 1.20.4 and 78.1% on 1.16.5. - Updating: `config.yml` updates itself once (`config-version: 4` ): the sections of the new checks are added from the jar; nothing you set is changed. ## HawkAC Lite 1.0.9: Paper 1.20.1 and newer, three new checks, false-positive fixes 2 October 2026 · HawkAC Lite · SpigotMC - Paper 1.20.1 to 1.21 and newer, on Java 17 and 21. Bukkit names that depend on the server release are resolved at startup; MaceDamage is switched off on 1.20.x with a notice. - Three new checks, passive in Lite: Criticals (fake hops that claim critical damage), PacketSequence (movement timing around swings on modern clients) and AimPoint (hits pinned to one exact point of the target). - False positives fixed: ChestStealer (Mouse Tweaks drags and shift double-clicks; the rhythm rule needs more samples), GhostHand (container interactions are validated through obstructions and distance), AutoFish (quick human reflexes), AimValidation (target positions replayed across the latency window), MaceDamage (the smash paired with its airborne hit), CrystalAura (judged only on steady connections), InteractAura (block edges count as visible when a neighbouring face is), AutoTotem (the click pair must match the pickup slot), Scaffold AirPlace (blocks changed by world events are ignored). - Layered detection needs at least two independent checks to agree before it acts. SupportReminder is off by default in Lite. - Tested: 0 false flags and 0 kicks across 3,500 clean player sessions in Full and Lite; 596 unit tests pass under the standard and the pl_PL locale; every class of the obfuscated build verified by the JVM. `config-version: 3` . ## The official 1.21 test server is live 27 September 2026 · HawkAC Lite Test HawkAC Lite live against combat exploits (mace and arrow damage, SilentAim) on the official server: `149.50.116.48:30122` . ## HawkAC Lite 1.0.7: client ticks, zero false kicks, exploit patches 26 September 2026 · HawkAC Lite · SpigotMC - Client ticks on 1.21.2+: HawkAC counts ticks from the client's end-of-tick packet instead of guessing from the server clock. ViaVersion is a soft dependency; rules that need true client ticks are skipped on synthetic ticks. - False kicks removed: AimValidation on stationary targets (mob stackers, dummies), MultiPlace and FastDrop on weak Wi-Fi (now per client tick), PacketBuild when pillaring on the block axis, FastUse removed (vanilla cooldowns already enforce it), CrystalAura kick off by default in Full, GhostHand on recently updated blocks. - Exploits patched: duplicate movement packets in one tick right before an arrow release or a mace strike (Wurst ArrowDMG, Meteor mace criticals, LiquidBounce MaceKill); TriggerBot criticals judged from the ground state at the end of the previous tick; taking damage no longer silences MultiAura, AimValidation or FastBow; wind-charge knockback is tracked. - Other: the Honeypot crash on 1.20.4+ fixed; AutoRespawn and AutoReconnect flag instant-respawn mods and reconnect bots; new panel permissions `hawk.panel.unban` and `hawk.panel.teleport` ; `config-version: 2` . ## Kick and ban counters, cleaner data, a support link 26 September 2026 · HawkAC Lite · SpigotMC - `/hawk info` shows how many kicks and bans HawkAC handed out this week and since install, per check, and to how many players; kept in `data/punishments.properties` . - A weekly summary file (`data/summary-2026-W39.csv` and so on), sent with the weekly upload only with `ai-telemetry: true` : numbers only, no names, UUIDs or IPs. - Cleaner behaviour data: rotation figures from the turns of their own window, clicks count the attack button only, `click_entropy` ignores pauses, aim columns relative to the hitbox, no ping in the first minute online, an empty cell means not measured. - Operators see a support link once per hour online (`support-reminder.enabled: false` turns it off). No check, threshold or punishment changed. ## HawkAC Lite 1.0.5: 50 checks, Discord webhooks, Bedrock support, staff suite 25 September 2026 · HawkAC Lite · SpigotMC - Eight new passive checks: AutoClicker, TriggerBot, AnchorAura, BedAura, AutoEat, AntiAFK, InteractAura, WallBreak; also AutoMine for Baritone-style bot mining. - Staff commands with TAB completion: `/hawk alerts` , `/hawk profile` , `/hawk silent` , `/hawk bypass` , `/hawk debug` , `/hawk discord test` , `/hawk help` . - Discord alerts through a webhook, batched and never with @mentions. - Fewer false punishments: Bedrock players are not judged by checks built for Java input; 1.21.11 spear hits and damage from other plugins are not judged as aimed hits; a hit is only cancelled when the flag behind it counts. - Fixes: the plugin never writes `config.yml` (the data salt lives in `salt.txt` ); players already online are checked when the plugin is enabled; decimal dots in the behaviour CSV on every locale; each finished file is sent once; a rare thread race in click counting fixed. - The limits of the free edition are built into the code; the jar is name-obfuscated with ProGuard (the alert API keeps its names). On 1.21.2+ use ProtocolLib 5.4.0 or newer. ## HawkAC Lite 1.0.4: privacy and compliance fix 23 September 2026 · HawkAC Lite · SpigotMC - Other players' names are removed from check details before a row is saved, so uploaded data is anonymous. - A promotional line was removed from the startup message and the `config.yml` header. No detection changes. ## HawkAC Lite 1.0.3: rebuilt exploit and combat detection 23 September 2026 · HawkAC Lite · SpigotMC - Every check was compared with the source code of popular cheat clients (Wurst, Meteor, LiquidBounce, ThunderHack, Lambda, BleachHack, Raven) and many rules were rebuilt. - Active checks: ArrowDamage checks the launch speed when the arrow is fired and cancels a spoofed arrow; MaceDamage audits the fall behind every smash; SilentAim rebuilt; MultiAura judged from attack packets (sweeping and Thorns ignored); AimValidation thread race fixed; FastBow catches release-and-redraw in one tick. - Many passive checks fixed or rebuilt; FastEat and FastRegen off by default (the 1.21 server controls them itself). - Behaviour CSV: 16 new columns (57 in total), a new file every day, built-in data-quality checks. New option `checks.arrowdamage.max-arrow-speed` ; a much smaller jar. ## HawkAC Lite 1.0.2: stability, telemetry and null-safety 23 September 2026 · HawkAC Lite · SpigotMC - Fixed a NullPointerException in AutoTotem when a player disconnects in the tick of taking combat damage; redundant inventory listeners removed. - Four new telemetry metrics: `movement_duration_ms` , `attacks_count` , `combat_duration_ms` , `action_duration_ms` ; the CSV schema is kept in sync with DataQualityMonitor.