For the player being checked

Download the scanner.

A staff member from your server gave you a 6-digit PIN. The scanner uses it to send the result to them and to nobody else.

The download link has not been published yet.Ask the staff member who gave you the PIN.

How to run it

  1. 01Download the file and open it.Windows may ask you to confirm, because the scanner needs to read system records.
  2. 02Type the 6-digit PIN you were given.A PIN works once and expires, so ask for a new one if it is rejected.
  3. 03Read the list of what is scanned and what is sent, then tick the box to agree.Nothing is scanned before you agree.
  4. 04Leave the window open until it says the scan is finished.This takes a few minutes. Keep Minecraft open if staff asked you to.

What it will look at

  • The running gameWhether Minecraft is open, a picture of its window, and pieces of known cheat clients in the game's memory.
  • Every mods folderEvery jar in the folder the game is using is compared with the published version of the mod it claims to be. Other launchers and instances too, plus x-ray packs and cheat versions.
  • Run history and downloadsPrograms Windows remembers being started, the browser's downloaded jars and programs, cheat sites in the history and DNS cache, and what starts with Windows.
  • Cheat clientsKnown cheat client files anywhere in the user's folders, checked by what is inside them. Also their config folders, and whether one looks like it is running.
  • Service memoryCheat-related strings in the memory of Windows diagnostic services, which remember what ran recently.
  • Accounts and altsMinecraft accounts found in launchers and in game logs, with the main account marked.
  • Mouse softwareMacros and profiles in Logitech, Razer and other mouse software, with when they were last changed.
  • Unsigned executablesExecutables with no valid signature, and ones signed with certificates that cheat developers use.
  • Bypass attemptsCleared USN journal or event logs, hidden, read-only or duplicate prefetch files, a freshly emptied recycle bin, renamed executables.
  • PowerShell historyCommands in the PowerShell history that delete files or clear system records.
  • USB and other drivesThe programs, jars and archives on USB sticks and other drives that are plugged in, checked by what is inside them. Also USB devices plugged in recently and files opened recently.
  • VM and sandboxSigns that the scanner is running inside a virtual machine or sandbox instead of the real PC.

It does not record keystrokes. The only picture it takes is of the Minecraft window, never the rest of your screen. The full list of what is stored, and who can see it, is on the privacy page.

Only run it for a server you know

Get the scanner from this page, and only type a PIN that came from staff of a server you play on. If the SHA-256 above is shown, you can compare it with the file you downloaded to make sure it was not changed.