How this works

What gets recorded

For every server: name, address and port, version, map, capacity, whether a password or queue is set, and the player count at each reading. Servers are identified by address and port, so a rename or a restart does not lose their history. Raw readings are kept for 14 days and condensed into hourly values after that.

What gets checked

Nobody can look inside someone else's server, so the analysis works on the shape of the player curve over time. Several independent checks each contribute to a score:

• ▪Player counts that stop moving while people are supposedly online
• ▪A population that never follows a day and night rhythm
• ▪Servers that are full again immediately after a restart
• ▪Curves that repeat themselves on a schedule
• ▪Numbers that only ever come from a small, tidy set
• ▪Jumps that are larger than the game can physically let people in
• ▪Counts that go up but never come back down
• ▪Capacity, free slots and player count that contradict each other

Small servers are not scored at all — a flat line is perfectly normal when only a handful of people are online. The exact thresholds stay unpublished on purpose. Every flagged server shows what specifically was measured on its own page, so a verdict can always be checked against the data behind it.

What the labels mean

• Clean — nothing unusual found.
• Watch — one weak signal; most likely a quiet server.
• Suspect — several patterns at once, worth a manual look.
• Spoofing — the curve cannot be produced by real players.
• No data — not enough history yet.

An administrator can override any automated result in either direction. Those entries are labelled "by hand" so the difference stays visible.

Where this stops

These checks read a public number over time. A patient faker who mimics a realistic curve will pass, and an unusual but honest server can pick up points. Treat a flag as a starting point for a conversation with the owner, not as proof.