01 — Capabilities

The truth is
in the details.

From the first trace to the final review, give your team the depth to investigate with confidence.

Ocean / Scan reportSAMPLE DATA

Scan Results

Forensic breakdown of the scanned system.

IDENTITY PINDEMO8PIN

SCAN DURATION1m 04s

GAME: FIVEMSAMPLE REPORT

CHEATING62% player risk history

Interactive product previewOpen dashboard

Scan overview

Detections

Detections6

Warnings12

Legit—

PC Information

Boot time8d ago

VPNNo

Recycle24 min ago

System: Windows 11 Pro
Install date: 2026-01-12 09:30
Game: FiveM
Window text: None

Detection Results 42

Illustrative findings

Overview

Unrecognized moduleIn instanceProcess: game.exe · Module: sample-module.dll

Execution trace foundWarningSource: Prefetch · File: example-loader.exe

Modified file signatureBootSource: Amcache · Signature requires review

This is an illustrative report. Review supporting evidence and context before taking moderation action.

02 — Forensic depth

Follow the traces.

Correlate multiple sources of evidence. Understand what happened, and what deserves a closer look.

FORENSIC SOURCE

Prefetch

Execution history helps you understand which programs have run on a system.

One source of context. Always review the complete report.

Less guesswork. More evidence.

Screensharing the old way leaves too much to chance.

MANUAL SCREENSHARE

The old way.

Hour-long calls to check one player
Screenshots scattered across chats
No shared record of what was checked
Verdicts based on gut feeling

WITH OCEAN

Evidence in about a minute.

A guided scan in about 60 seconds
One report with verdict and traces
Custom rules for your community
Roles and review history for staff

Start Ocean

03 — Custom detections

Your expertise, built in.

Define rules, work with signatures and match strings. Enterprise keeps your rules, strings and GUI templates private.

example-config.json

{
  "name": "Community review",
  "artifact": "Prefetch",
  "severity": "warning"
}

This example illustrates configuration only. Create and manage real rules in the Ocean dashboard.

04 — Deeper checks

Beyond the obvious.

Checks that go past what is running right now. Each one is documented in the detection docs.

Recovery

Files deleted before the scan are recovered on NTFS and FAT32, with download and VirusTotal checks.

Antivirus correlation

See which file the antivirus flagged, the detection type and when it was flagged.

Memory analysis

Volatile memory is checked during the scan, not only what is left on disk.

RUIN mode

Detects the slightest modification to a Minecraft Java instance. Ocean+ only; the game closes at the end of the scan.

Engines

Ranks unknown executables through VirusTotal so new cheats and bypasses do not slip by. Uses your VirusTotal API key from the dashboard.

Untrusted files

Executables with many VirusTotal flags are listed separately for manual review.

05 — Reading the verdict

Every finding has a name.

Ocean sorts what it finds so your team knows what is proof, what needs a look, and what is someone covering their tracks.

Detect logs

Confirmed detections: direct residues of a known cheat, generic highly suspicious executables, and specific tampering methods.

Warning logs

Modifications that can be used to evade detection but are not proof on their own. Your server decides the penalty.

Suspicious logs

Executables flagged with a reason: packers and protectors, .NET tooling, VM checks, macro tools. Read the reason, then check manually.

Self-destruct traces

Files executed and then modified or deleted, and Prefetch entries wiped afterwards, are flagged as anti-forensic behaviour.

Bypass routes

Execution from a network share, an external device such as a phone, or straight out of a RAR archive is flagged as a bypass method.

Custom string matches

Hits on your own suspicious keywords are listed separately, so community-specific rules are easy to spot in the report.

06 — Connected workflows

Fits into your world.

Where your community lives.

Twelve Discord addons support scan workflows, results, bans and team collaboration.

Explore the community

EnglishEspañolTürkçe

scan-reportsSAMPLE

Ocean APPScan complete

DEMO8PIN · FiveM

Ocean API.

RESTful access to scan data, risk scores, and detections. API keys need an active license or Enterprise membership. PIN creation is Enterprise owner only — /v1/version stays public.

GET scanned-users lookup
GET user risk score
GET pin results & status
POST pin create
GET DB query
GET version

Read API documentation

https://api.anticheat.ac/v1x-api-key1,000 req/hour

{
  "found": true,
  "discordId": "123456789012345678",
  "username": "PlayerUsername",
  "totalScans": 5,
  "totalDetections": 3,
  "overallStatus": "cheating",
  "isBanned": true,
  "isWarned": false,
  "bans": [
    {
      "status": "banned",
      "reason": "Cheating detected - Generic Loader",
      "isExpired": false,
      "createdAt": "2024-01-15T10:30:00.000Z"
    }
  ],
  "detections": [
    "Generic Cheat Loader - Detection",
    "Process Injection - FiveM.exe"
  ],
  "reasons": [
    {
      "reason": "⚠️ Possible alt account detected: AltAccount (987654321)",
      "category": "suspicious",
      "addedAt": "2024-01-15T10:30:00.000Z",
      "evidence": null
    }
  ],
  "firstSeen": "2024-01-10T08:00:00.000Z",
  "lastSeen": "2024-01-20T15:45:00.000Z",
  "gamesScanned": [
    "Java",
    "FiveM"
  ],
  "totalHwids": 2,
  "hasRelatedAccounts": true,
  "totalRelatedAccounts": 1,
  "relatedAccounts": [
    {
      "discordId": "987654321098765432",
      "username": "AltAccount",
      "sharedHwidIds": [
        1
      ],
      "totalDetections": 5,
      "overallStatus": "cheating",
      "lastSeenAt": "2024-01-18T12:00:00.000Z",
      "detections": [
        "System Hooking - svchost.exe",
        "Generic Packed File - cheat.exe"
      ]
    }
  ]
}

Paid license or Enterprise for API keys. PIN create needs an Enterprise owner. /v1/version is public.

Your community.
Worth protecting.

Give your team the context to make confident moderation decisions.