If you have ever opened a Discord ticket that reads "some guy is flying around in a tank," the cheat behind it almost certainly came from one of three vendors. Eulen, Redengine, and HamMafia are the names you run into most on FiveM, and knowing the differences between them helps you protect your server against them.
This is not a how-to. It is a plain field guide for server owners and admins. The goal is simple: know what is hitting your server, talk to your anticheat vendor without guessing, and see through the marketing language that shows up in support tickets.
The three big names
Eulen
Eulen is the closest thing to a household name in the FiveM cheat scene. It has been around for years, runs a public website, and sells on a recurring subscription that looks more like a SaaS product than an underground tool. Pricing usually sits somewhere in the $20 to $40 a month range.
Under the hood it is a Lua executor first and a mod menu second. It loads custom Lua into the FiveM client, lets the operator run arbitrary code, and ships pre-built scripts for the usual abuses: money drops, entity spawning, godmode, ESP. The interface is easy to use, and that is a big part of why it spreads. A teenager with a credit card can be causing problems inside ten minutes.
Redengine
Redengine is Eulen's direct competitor. Similar pricing, similar feature set, a slightly different engineering philosophy. Eulen leans on a polished script catalog. Redengine leans on a more modular architecture that makes it easier for users to write their own modules.
For detection purposes the two are mostly interchangeable. An anticheat that catches one tends to catch both within a few weeks of each release.
HamMafia
HamMafia is the rougher product. Cheaper, less polished, with a community that openly trades stolen scripts and leaked resources. It pulls a different crowd than Eulen. Less "I want godmode for fun in roleplay," more "I want to break this server."
Detection is usually easier here because HamMafia does less to hide itself. The catch is that its users tend to be more aggressive once they are in, so a missed detection costs you more.
What they all have in common
All three inject code into the FiveM process. The injection vector differs, but the practical result is the same. Once the cheat is in, it can:
- Run as part of the FiveM client, with full access to the Lua state and the rendering pipeline.
- Call any client-exposed server event the running resources allow.
- Read memory, including the positions of other players, vehicle pointers, and ammo counts.
- Hook the input handler to deliver aimbot snaps and trigger-bot fires.
What a good anticheat catches
A good anticheat should be able to catch these vendors in more than one place.
- The cheat itself. The executor or menu running alongside the game, including fresh builds.
- Tampering with the game. The changes a cheat makes to the game to install its features.
- Impossible behaviour. Movement, combat, and spawns that the legitimate game never produces.
- Abusive server events. Event calls a real client would never send. Validating what your server events accept is one of the cheapest protections you can run on the server.
Practical takeaway for owners
If a player on your server is running one of these cheats, your logs will usually show some mix of the following:
- A spike of
TriggerServerEventcalls from one player. - Position reports that imply movement faster than any vehicle.
- Inventory or balance changes with no matching transaction on your end.
- Other players reporting visual cheats they cannot ignore.
A decent anticheat should flag at least one of those before your players do. If yours does not, ask your vendor a direct question: which of Eulen, Redengine, and HamMafia do they currently detect, and how long does it typically take them to catch a new cheat release?
The cheat market moves fast, and new builds ship constantly. Knowing which vendor your problem player is using makes that support conversation a lot quicker. It is also a good filter when you are shopping for an anticheat. Any vendor that cannot tell you specifically whether they catch these three is selling you marketing, not detection.