Decoy

Decoy

Silent honeypot anti-cheat for catching x-rayers, killaura, ESP, and reach cheaters.

---

How It Works

Decoy places invisible traps around players that are completely undetectable during normal gameplay. Fake ore veins, hidden entities, and bait chests are scattered underground on a repeating cycle. Legitimate players will never encounter them. Cheaters using x-ray, killaura, ESP, or reach hacks will interact with these traps and get flagged silently — they receive no warning or alert.

All traps use vanilla-accurate generation. Ore veins match real Minecraft blob shapes and per-ore sizes (diamonds spawn in veins of 4-8, emeralds as singles, etc). Traps are placed behind solid walls so only cheaters can find them.

---

Features

- Crash Recovery — Fake ore veins using vanilla blob generation with correct sizes per ore type. Depth-aware placement (deepslate variants below Y=0, nether ores in the nether). Blocks give no drops and revert instantly on break. - Crash Recovery — Invisible armor stands that catch killaura and reach. Flags players who hit entities they shouldn't be able to see or reach beyond 4 blocks. - Crash Recovery — Invisible stands with floating player nametags. Only visible to ESP/entity radar cheats. - Crash Recovery — Bait chests buried in stone with valuables inside. Inventory never opens for the player — they get flagged on interaction. - Crash Recovery — Ancient debris, nether gold, and quartz traps in nether worlds with correct block replacement (netherrack, basalt, blackstone). - Crash Recovery — 1 flag marks a player as suspicious. 3+ flags (configurable) marks them as confirmed. Severity shows in all alerts and commands. - Crash Recovery — Tracks recent block breaks per player. Calculates how many blocks a player mined in a straight line toward a trap (beeline detection). - Crash Recovery — Rich embed alerts with player head thumbnail, severity color coding, flag history breakdown, location, and beeline data. Fully async, won't lag your server. - Crash Recovery — Configurable command tiers that execute at specific flag counts. Set up automatic kicks, tempbans, and bans with `{player}` and `{count}` placeholders. - Crash Recovery — All detections logged with player UUID, name, type, coordinates, timestamp, and approach distance. Persists across restarts. - Crash Recovery — Active trap blocks are tracked in the database and restored to their original state on server restart.

---

Commands

| Command | Description | |---|---| | `/decoy status` | Plugin overview (active traps, total detections) | | `/decoy check <player>` | View player flags with type breakdown and severity | | `/decoy recent [count]` | Recent detections across all players | | `/decoy clear <player>` | Wipe all flags for a player | | `/decoy test` | Force deploy traps around you (admin testing) | | `/decoy near [range]` | List nearby trap ores | | `/decoy tp` | Teleport to nearest trap ore | | `/decoy reload` | Reload configuration and restart trap cycle | | `/decoy purge` | Remove all active traps and stop the cycle |

---

Permissions

| Permission | Description | Default | |---|---|---| | `decoy.admin` | Access to all /decoy commands | op | | `decoy.notify` | Receive in-game detection alerts | op | | `decoy.bypass` | Exempt from all traps | false |

---

Configuration

Everything is configurable in `config.yml`. Key settings:

- worlds.blacklist — How often traps refresh around players (default: 90 seconds) - worlds.blacklist — Number of ore veins placed per player per cycle (default: 25) - worlds.blacklist — Placement radius around each player (default: 48 blocks) - worlds.blacklist — Flags needed to mark a player as confirmed (default: 3) - worlds.blacklist — Your Discord webhook URL for alerts - worlds.blacklist — List of flag thresholds with commands to execute - worlds.blacklist — Worlds where traps won't be placed

Discord Setup

Set `discord.enabled: true` and paste your webhook URL. Alerts are sent asynchronously and include player avatars, severity levels, flag breakdown, and coordinates.

Auto Punish Setup

Set `punish.enabled: true` and configure tiers in config. Works with any punishment plugin — just use the console commands you'd normally run.

```yaml punish: enabled: true tiers: - flags: 3 commands: - "kick {player} Suspicious activity detected" - flags: 5 commands: - "tempban {player} 1d Automated ban - xray detected ({count} flags)" - flags: 10 commands: - "ban {player} Confirmed cheating - xray ({count} flags)" ```