36 checks, four categories.

Lag-compensated reach — catches attackers hitting victims from beyond vanilla melee reach. Ported from Nemesis RangeA + Grim Reach. Since v1.4.0 a motionless-pair branch also catches ghost reach: when neither attacker nor victim has moved, interpolation error is zero, so the check drops the ray and compares the vanilla metric (eye to closest point of the unexpanded hitbox) at a 3.2 ceiling — Koid-style 3.6 and LiquidBounce-style 4.2 ghost modules alert instead of passing as jitter.

Multi-aura / multi-target — a cheater hitting two or more distinct player victims in one tick, or three across a 2-tick lag-absorb window. Grim MultiInteractA proxy.

Autoclicker via five independent signals on a swing: CPS, Robot (sub-10ms nano-delta), StDev (too-uniform intervals), Kurtosis (near-uniform fixed-delay), and Record (a non-constant periodic click loop). Ported from Nemesis AutoClickerA-D.

Through-walls / no-LOS KillAura — landing a hit through a solid block (the aura has no line-of-sight filter).

Criticals spoof (CritOnGround) — the cheat injects a tiny Y hop (~+0.11) around the attack tick so the server awards a crit while the player is grounded (a real jump impulse is 0.42).

MaceKill fall-height fake — a mace-holder warps Y via position-only packets around an attack to inflate the mace's fall-distance smash damage. Visible as a |Δy| > 1.5 spike within ±2 ticks of the attack with no genuine fall lead-in (plan §7.1).

No-swing attack detector — Slinky Hit Select / Grim PacketOrderB. The cheat deals damage with no swing animation in the window (a disabler suppresses the swing packet, or hit-select attacks without the arm animation). Every vanilla melee attack carries a swing, so a no-swing hurt is a cheat OR an unseen attacker — a weak, noisy signal, so this is CORROBORATOR-tier (never initiates a tier alone).

Anti-knockback / Velocity — cancels, scales or redirects the KB a sprint-hit applies so the victim barely moves. One VL pool across four sub-signals: the VelocityC magnitude ratio, the absorbed-KB sustained gate, NoKB(VelocityB) vertical ratio, and NoKB(Vector) direction mismatch. Nemesis VelocityA/B/C proxy.

KeepSprint / NoSlow on attack — cancels vanilla's ~0.6 motion decel on hit so the attacker keeps full speed and sprint never drops.

WTap / SuperKnockback — toggles sprint state (STOP then START) around each attack so the server awards sprint-bonus KB even though the cheater isn't really sprinting.

JumpReset / JumpOnHurt — auto-jumps the instant the cheater is hit to 'reset' knockback.

Backtrack / StalePositionReach — the cheat delays victim packets ~80-150ms to hit the victim at an older (closer) position. Weak, corroborating only.

Unified killaura / silent-aim detector ported from Rain-Anticheat's 1.8.9 KillauraCheck. Thirteen sub-components share one VL pool: heuristic(aim|constant|sync|gcd), pattern(snap), silent(snap|return|track), movement(fix|lock|sprint), consume, drift. Silent-aim swaps yaw/pitch only in look packets so the head visibly snaps onto enemies while the cheater's screen never moves. Tier = CORROBORATOR (corroborates reach/criticals/etc., never initiates a tier alone).

AutoBlock — the use-item-while-attacking family. Three sub-flags share one VL pool: AutoBlock (Rain port — shield/sword-block + swing overlap), AutoBlock(SwingUse) (Grim MultiActionsE fold — swing while eating/drinking; vanilla left-click interrupts consuming), and AutoBlock(AttackUse) (Grim MultiActionsA fold — an AttackEvent while isBlocking||isUsingConsumable; vanilla attacking interrupts using). On 1.8 the block path is block-hit autoblock, on 1.21 shield-while-attacking.

HitFlick / KnockbackDisplace — flicks attacker yaw OFF the victim hitbox at the attack tick (Vape 90/180/270deg; Slinky configurable) to redirect KB sideways, then snaps back. Vanilla never looks away at the hit instant then returns.

Triggerbot — deliberately LAX, only flags really blatant sub-reaction auto-attackers. The cheat auto-attacks the instant the crosshair reaches a victim's hitbox. Unlike KillAura/HitFlick, a triggerbot DOES face the target, so the only inhuman signal is timing.

Horizontal-speed envelope — flags sustained or alternating overspeed. Catches both sustained speed hacks (all 6 ticks over) and alternating BHop (3 over / 3 under) while rejecting 1-2 tick spikes.

Flight envelope — seven airborne sub-signals while groundedProxy is false: physics breach, hover/AirWalk, ascend-without-jump, and the four step-8 sub-signals (FlyB air-friction band, Blink midair freeze, AntiKick dip cadence, StrafeHop impulse), all sharing this VL pool. Ported from AvA checkFlight + Nemesis FlyB.

Wall-climb detector — AvA Spider + NCM ConstantClimb (plan §4 #6). The cheat sticks to a wall and ascends it without a ladder/vine/scaffold. Two sub-flags share one VL pool.

NoFall detector — accumulates downward distance while airborne, flags when a player lands from a damaging fall (fallAccum > threshold 8.0) without a hurt signal. Also catches ground-spoof-over-air and Verus stair-step. Tier = NEUTRAL (was DEFINITIVE; demoted — KitPvP arena-drop / water / ladder / chunk-load glitches avoid fall damage legitly, so a lone NoFall alert must not mark a player suspect).

Step detector — flags the Step cheat raising step height beyond vanilla 0.6: a single-tick deltaY in (threshold, 2.5] that follows a grounded tick (no airborne lead-up) and is not a 0.42 jump, with a solid block within reach below the new feet.

VClip / SlyPort / InfiniteAura detector — single-tick vertical clip |dy| > threshold (1.5) or horizontal teleport > 2x threshold (3.0), with no jump/knockback/velocity source. Only flags the 1.5-8 block range; the >8-block server-teleport heuristic is handled upstream.

LongJump detector — boosted horizontal velocity on jump launch. Vanilla sprint-jump first airborne tick ~0.31; flags if any airborne tick within 6 of the jump impulse (prevDeltaY ~0.42) has horizontal delta > threshold (0.6/tick ~12 bps) with no knockback/velocity/elytra source.

NoSlow detector — vanilla slows to ~20% while using an item; NoSlow cancels that, so the player sprints full speed with using-item metadata set.

BackwardSprint / OmniSprint detector — vanilla cannot sprint backward; OmniSprint forces it. BLATANT-ONLY by design.

WallSprint detector — Grim SprintE / OmniSprint wall-sprint (plan §4 #3). Vanilla cancels sprint the instant a player collides horizontally with a wall; the cheat forces the sprint metadata to stay set while pressed against a wall. backwardSprint covers the yaw case; this covers the wall case.

SprintHack — three sprint-metadata-should-be-canceled sub-flags sharing one VL pool (Grim SprintG/B/D, plan §4 #4-5): Sprint(Water) feet-in-water + head-above + not-swimming; Sprint(Sneak) sprinting while sneaking; Sprint(Blind) sprinting while Blind. All three are mutually exclusive with sprint in vanilla.

LiquidWalk / Jesus detector — the cheat rewrites liquid bounding boxes to solid so the player stands/walks on water. Signature: near-constant Y with horizontal motion while the block at the feet is a liquid and NOT a solid, sustained >=3 ticks.

ElytraFly detector — vanilla elytra caps ~1.5 b/t (30 bps); firework boosts briefly 40-50 bps. Flags when gliding is active for >=3 sustained ticks of blatant (bps > 40), a pitch-vs-speed anomaly (bps > 34 while |pitch| < 8deg), OR the glidingSprint sub-flag (sprint metadata held while gliding — Grim SprintF, plan §7.1 fold; vanilla cancels sprint on elytra deploy).

Phase / no-clip detector — the Phase cheat moves through solid blocks. Samples lower-body and upper-body centers; requires BOTH bands inside a FULL-CUBE solid (not either), so a player standing against a wall has at most one band in a solid. Sustained >=5 ticks.

Silent-aim / AimAssist detector — the cheat silently rotates to face a target; the player's look consistently points at one nearby entity's body center.

Snap-back KillAura tell — the attacker yaw snaps to the victim on the attack tick, then snaps back to the pre-attack travel bearing within 1-3 ticks.

Max-rotation-rate / snap detector — flags a single-tick yaw rotation larger than threshold (165deg) coming out of a near-still tick (previous wrapped delta < 30deg): a classic aimbot snap from rest.

Invalid-pitch detector (BadPacketsD / NCM WrongTurn) — the server normally clamps pitch to +-90deg, so a broadcast |pitch| > threshold (90) is impossible from a legit client. Trivially portable, low fire-rate, zero FP.

Scaffold / BridgeAssist detector — two paths share one VL pool: (1) rotation-snap godbridge (snaps pitch to ~78deg and yaw to cardinal while airborne over air, sustained >=8 ticks), and (2) LegitScaffold sneak-tap bridge (taps sneak 1-2 ticks at crouch-end with a swing timed to crouch-end, looking down holding a block).

Blink / FakeLag / ScaffoldBlink / LagRange detector — the cheat cancels and queues outgoing packets, so the entity appears frozen then snaps a large distance.