Alt Accounts and Ban Evasion: Detection Without False Positives

Your punishment plugin has just pinged staff chat. A player called kaz__ connected ninety seconds ago from an address that also belongs to someone you permanently banned in March, and one of your moderators is already typing the ban command. The new account is four days old. He has said nothing in chat and is currently stuck on the spawn platform trying to work out where the shop is.

You are about to make one of two mistakes, and they are not the same size. Here is the order to weigh the evidence in, and the one rule that keeps you out of trouble.

1. Price the mistake before you price the evidence

Most ban policies are written as though the two failure modes cost the same. They do not.

Miss an evader and you lose time. They stay a week, do the thing that got them banned, and you catch them on a different signal — because evaders repeat themselves, which is the whole reason this article is possible to write.

Ban an innocent newcomer and the loss is permanent. They were on your server four minutes, they have no relationship with you, no reason to think your appeal form goes anywhere, and no shortage of other servers. They do not appeal or argue. They leave, and they mention it to the two friends they were about to bring. Owners spend months wondering why nobody joins their server without considering that some of the missing were shown the door on their first night by an automated rule.

A ban is not a verdict returned after a trial. It is a bet placed on partial information, and the two ways of losing it are different sizes: the evader you miss comes back and gets caught next month, and the newcomer you ban never comes back at all.

2. IP is the weakest signal you have, and it keeps getting weaker

An IP address identifies a network path at a moment in time. It does not identify a person, and the gap between those two things widens every year.

Carrier-grade NAT is the main reason. IPv4 ran out, so ISPs put many subscribers behind one public address — RFC 6598 reserved 100.64.0.0/10 for the link between a subscriber's router and the carrier's NAT. Two people on the same mobile network can present the same public address while living in different cities. Mobile connections also move, so the same person can appear from three addresses in an evening simply by walking between cell sites: the absence of an IP match tells you almost nothing either.

Then there are ordinary shared addresses. Brothers. Flatmates. Halls of residence. Internet cafés and LAN centres, which on some games are a meaningful share of the population. A shared address is exactly as consistent with two people who live together as with one person on two accounts, and the first is far more common.

Which is why the setting matters more than the feature. LiteBans, for one, has linked-account detection that notifies staff when someone connects from an address associated with a banned account, and can be configured to ban automatically. Turn the notification on. Leave the automatic ban off. An alert is a reason to look, not a finding.

Never ban a subnet or a range. A /24 on a residential ISP is a street; a range ban on a mobile carrier removes a city. VPN and proxy checks sit in the same category — they catch lazy evaders, and they also catch privacy-conscious players, people on corporate or university networks, and anyone whose ISP holds a datacentre-adjacent allocation. Use them to raise a flag, never to close a case.

3. Hardware and client IDs: what they measure, and what they only claim

FiveM is the best case in this category, so it is worth knowing what "best case" looks like. A FiveM server sees several identifiers on every connection — license, license2, steam, discord, live, xbl, fivem — plus the IP and a set of machine-derived tokens, and tooling like txAdmin stores all of them per player so a ban can land on more than one at once. Somebody who makes a fresh Steam account still trips the same license. That genuinely works, and it is why FiveM evasion takes real effort.

Now the limit. Every one of those values is something the client sends, and a client that can be modified can send something else; tokens tied to the machine live in files and registry keys that a determined person will clear. An identifier is a claim, not a measurement. The honest phrasing is this raises the price of another account, never this is the same human.

On most other games you do not have even that. On Source titles you have a Steam ID and an address; on Minecraft a UUID and an address. There is no hardware fingerprint, and any plugin promising one is inferring it from things the client volunteered.

Which makes one setting decisive. If your Minecraft server runs online-mode=false, identity is a hash of a username: the offline UUID is a version-3 UUID derived from OfflinePlayer:<name>, so a rename produces a new person and anyone can arrive as anyone. Evasion there is not a detection problem, it is a configuration problem — run online mode, or put an authenticating proxy in front. And the old fallback of checking someone's previous usernames is gone: Mojang removed the public name-history endpoint in September 2022, so no authoritative source for it exists.

4. Account signals are cheap for you and expensive for them

These are the most underused signals in community moderation, and they take an afternoon to wire up.

For any Steam ID, ISteamUser/GetPlayerBans returns VACBanned, NumberOfVACBans, NumberOfGameBans, DaysSinceLastBan, CommunityBanned and EconomyBan. A DaysSinceLastBan of six, on an account claiming to be a regular returning from last year, is a checkable inconsistency. GetPlayerSummaries gives account creation time — but only on a public profile, and plenty of legitimate players keep theirs private, so a private profile is a reason to ask a question rather than a mark against anyone.

Cost of entry varies enormously by game, so calibrate to yours. CS2 is free to play and an alt costs minutes; Steam's limited-account rules only start biting at $5 of store or wallet spend, and CD keys and gifts do not count toward it. Rust and Minecraft Java cost the price of the game, so throwaway accounts are rarer there — which cuts both ways, since a genuine new account on a paid title is also more likely to be a genuine new player.

None of this identifies a person. It tells you how cheap the account in front of you was to create, which is a different and more answerable question.

5. Behaviour is the strongest signal and the easiest to fool yourself with

In practice this is what catches people, because habits are involuntary.

Names rhyme: the same suffix, the same underscore placement, the same odd capitalisation, the same clan tag with one character changed. Connection times cluster, because someone who always played at 19:00 local still does — that is when they get home. Map knowledge gives people away; a four-day-old account that walks to the off-angle, or straight to the loot room in a base layout you built last week, is doing something a new player cannot. And voice is the most reliable signal anyone has and the one nobody writes into their policy: same voice, same phrases, same grudge, same way of losing an argument.

Two cautions. All of these have innocent explanations — friends watch each other stream, newcomers watch YouTube, people in one time zone share a schedule. And once you suspect someone, everything they do reads as confirmation. The countermeasure is boring and works: before acting, write down what you would expect to see if you were wrong, then check whether you are seeing it.

On timing, use your own connection log and nothing else. JoinGG reports a busiest UTC hour per listing, but that comes from hourly readings of the whole server rather than of individual players — how that is measured is published precisely so nobody mistakes it for something it isn't.

6. Require corroboration from different families of evidence

Here is the rule worth adopting verbatim: act only on two independent signals from different families — network, account, behaviour. Two signals from the same family are one signal wearing a hat. Same IP and same subnet is not corroboration. Same IP, plus an account created the day after the ban, plus a name following the same pattern, is.

Escalate in steps rather than jumping to the end. Watch. Flag them internally so other moderators know. Then ask — a direct, non-accusatory do you know this player?, naming the banned account, resolves a startling number of these, because evaders often confirm it and innocent players clear it up in a sentence. Only then restrict, temporarily. Only then ban.

Whatever the outcome, write the reason into the ban record naming the actual signals, and attach the evidence. If the original ban was for cheating, that evidence is usually a demo, which is one more argument for recording every match by default. And if evasion is a constant drain, the structural fix is not a cleverer detector but a smaller front door: a whitelist people actually apply to turns a detection problem into an admission problem, which is far easier to get right.

7. Publish the policy, then live with it

Write down what triggers an automatic action (ideally nothing does), what only raises an alert, how long you keep evidence, and how someone appeals and roughly when they will hear back. Then put it somewhere players can read it. This is the same thing that separates a listing worth joining from one worth ignoring — visible, checkable claims rather than assurances.

The test of all of it is not how many evaders you catch. It is whether the account that connected four days ago, got flagged by a shared address, and turned out to be somebody's brother is still playing on your server a month from now. If your rules would have removed him on sight, fix the rules before you put the server in front of more people.