If you have ever opened a Discord ticket that reads "some guy is flying around in a tank," the cheat behind it almost certainly came from one of three vendors. Eulen, Redengine, and HamMafia are the names you run into most on FiveM, and the differences between them decide which detection layers actually catch them.
This is not a how-to. It is a plain field guide for server owners and admins. The goal is simple: know what is hitting your server, talk to your anticheat vendor without guessing, and see through the marketing language that shows up in support tickets.
The three big names
Eulen
Eulen is the closest thing to a household name in the FiveM cheat scene. It has been around for years, runs a public website, and sells on a recurring subscription that looks more like a SaaS product than an underground tool. Pricing usually sits somewhere in the $20 to $40 a month range.
Under the hood it is a Lua executor first and a mod menu second. It loads custom Lua into the FiveM client, lets the operator run arbitrary code, and ships pre-built scripts for the usual abuses: money drops, entity spawning, godmode, ESP. The interface is easy to use, and that is a big part of why it spreads. A teenager with a credit card can be causing problems inside ten minutes.
Redengine
Redengine is Eulen's direct competitor. Similar pricing, similar feature set, a slightly different engineering philosophy. Eulen leans on a polished script catalog. Redengine leans on a more modular architecture that makes it easier for users to write their own modules.
For detection purposes the two are mostly interchangeable. An anticheat that catches one tends to catch both within a few weeks of each release.
HamMafia
HamMafia is the rougher product. Cheaper, less polished, with a community that openly trades stolen scripts and leaked resources. It pulls a different crowd than Eulen. Less "I want godmode for fun in roleplay," more "I want to break this server."
Detection is usually easier here because HamMafia does less to dodge signature scans. The catch is that its users tend to be more aggressive once they are in, so a missed detection costs you more.
What they all have in common
All three inject code into the FiveM process. The injection vector differs, but the practical result is the same. Once the cheat is in, it can:
- Run as part of the FiveM client, with full access to the Lua state and the rendering pipeline.
- Call any client-exposed server event the running resources allow.
- Read memory, including the positions of other players, vehicle pointers, and ammo counts.
- Hook the input handler to deliver aimbot snaps and trigger-bot fires.
How anticheats catch them
These vendors get caught in roughly the same handful of ways.
- Memory signatures. The injected cheat leaves identifiable byte patterns in process memory. A client-side scanner that reads its own process can match those patterns and report them.
- Hook detection. The cheat hooks game functions to install its features. A scanner that knows what the real game functions look like can tell when they have been altered.
- Behavioral anomalies. A player teleporting 40 metres in a single frame is not something the legitimate engine produces. Server-side trust scoring catches this even when the client signature scan misses.
- Event-call shape mismatch. Cheats often call server events with argument patterns a real client would never produce. Validating input shape and source is one of the cheapest detections you can run on the server.
Practical takeaway for owners
If a player on your server is running one of these cheats, your logs will usually show some mix of the following:
- A spike of
TriggerServerEventcalls from one player. - Position reports that imply movement faster than any vehicle.
- Inventory or balance changes with no matching transaction on your end.
- Other players reporting visual cheats they cannot ignore.
A decent anticheat should flag at least one of those before your players do. If yours does not, ask your vendor a direct question: which of Eulen, Redengine, and HamMafia do they currently detect, and how long does it typically take them to patch a signature after a new cheat release?
The cheat market moves fast, and new builds ship constantly. Knowing which vendor your problem player is using makes that support conversation a lot quicker. It is also a good filter when you are shopping for an anticheat. Any vendor that cannot tell you specifically how they handle these three is selling you marketing, not detection.