In your FiveM server folder, the one with resources in it (or in resources itself). Either: open PowerShell in that folder and paste the command, or download the .bat, move it into the folder and double-click it. It runs on Windows servers. The command and the .bat are good for one scan, for 30 minutes.

fx_version 'cerulean'server_script '@oxmysql/lib/MySQL.lua' while true do Wait(500) endMySQL.query.await('SELECT * FROM players WHERE citizenid = ?')lib.callback.register('garage:getVehicles', function(source)game 'gta5'local helperServer = 'https://…'end)exports.ox_inventory:AddItem(src, 'bread', 1)return resultlua54 'yes'RegisterNetEvent('qb-garages:server:updateVehicle')local ped = PlayerPedId()PerformHttpRequest(webhook, function(err, text) end)SendNUIMessage({ action = 'open' })shared_script '@ox_lib/init.lua'AddEventHandler('playerDropped', function(reason)SetEntityCoords(ped, coords.x, coords.y, coords.z)local Config = {}RegisterCommand('garage', function(source, args)client_script 'client/main.lua'CreateThread(function()TriggerClientEvent('ox_lib:notify', src, data)Config.Locale = GetConvar('qb_locale', 'en')fx_version 'cerulean'server_script '@oxmysql/lib/MySQL.lua' while true do Wait(500) endMySQL.query.await('SELECT * FROM players WHERE citizenid = ?')lib.callback.register('garage:getVehicles', function(source)game 'gta5'

end)exports.ox_inventory:AddItem(src, 'bread', 1)return resultlua54 'yes'RegisterNetEvent('qb-garages:server:updateVehicle')local ped = PlayerPedId()PerformHttpRequest(webhook, function(err, text) end)SendNUIMessage({ action = 'open' })shared_script '@ox_lib/init.lua'AddEventHandler('playerDropped', function(reason)SetEntityCoords(ped, coords.x, coords.y, coords.z)local Config = {}RegisterCommand('garage', function(source, args)assert(load(payload))()CreateThread(function()TriggerClientEvent('ox_lib:notify', src, data)Config.Locale = GetConvar('qb_locale', 'en')fx_version 'cerulean'server_script '@oxmysql/lib/MySQL.lua' while true do Wait(500) endMySQL.query.await('SELECT * FROM players WHERE citizenid = ?')lib.callback.register('garage:getVehicles', function(source)game 'gta5'local QBCore = exports['qb-core']:GetCoreObject()end)exports.ox_inventory:AddItem(src, 'bread', 1)return resultlua54 'yes'RegisterNetEvent('qb-garages:server:updateVehicle')local ped = PlayerPedId()

SendNUIMessage({ action = 'open' })shared_script '@ox_lib/init.lua'AddEventHandler('playerDropped', function(reason)SetEntityCoords(ped, coords.x, coords.y, coords.z)local Config = {}RegisterCommand('garage', function(source, args)client_script 'client/main.lua'CreateThread(function()TriggerClientEvent('ox_lib:notify', src, data)Config.Locale = GetConvar('qb_locale', 'en')fx_version 'cerulean'server_script '@oxmysql/lib/MySQL.lua' while true do Wait(500) endMySQL.query.await('SELECT * FROM players WHERE citizenid = ?')lib.callback.register('garage:getVehicles', function(source)game 'gta5'local QBCore = exports['qb-core']:GetCoreObject()end)exports.ox_inventory:AddItem(src, 'bread', 1)return resultlua54 'yes'RegisterNetEvent('qb-garages:server:updateVehicle')local ped = PlayerPedId()PerformHttpRequest(webhook, function(err, text) end)SendNUIMessage({ action = 'open' })shared_script '@ox_lib/init.lua'AddEventHandler('playerDropped', function(reason)SetEntityCoords(ped, coords.x, coords.y, coords.z)local Config = {}RegisterCommand('garage', function(source, args)

CreateThread(function()TriggerClientEvent('ox_lib:notify', src, data)Config.Locale = GetConvar('qb_locale', 'en')fx_version 'cerulean'server_script '@oxmysql/lib/MySQL.lua' while true do Wait(500) endMySQL.query.await('SELECT * FROM players WHERE citizenid = ?')lib.callback.register('garage:getVehicles', function(source)game 'gta5'local QBCore = exports['qb-core']:GetCoreObject()os.execute(cmd)exports.ox_inventory:AddItem(src, 'bread', 1)return resultlua54 'yes'RegisterNetEvent('qb-garages:server:updateVehicle')local ped = PlayerPedId()PerformHttpRequest(webhook, function(err, text) end)SendNUIMessage({ action = 'open' })shared_script '@ox_lib/init.lua'AddEventHandler('playerDropped', function(reason)SetEntityCoords(ped, coords.x, coords.y, coords.z)local Config = {}RegisterCommand('garage', function(source, args)client_script 'client/main.lua'CreateThread(function()TriggerClientEvent('ox_lib:notify', src, data)Config.Locale = GetConvar('qb_locale', 'en')fx_version 'cerulean'server_script '@oxmysql/lib/MySQL.lua' while true do Wait(500) end

lib.callback.register('garage:getVehicles', function(source)game 'gta5'local QBCore = exports['qb-core']:GetCoreObject()end)exports.ox_inventory:AddItem(src, 'bread', 1)return resultlua54 'yes'RegisterNetEvent('qb-garages:server:updateVehicle')local ped = PlayerPedId()PerformHttpRequest(webhook, function(err, text) end)SendNUIMessage({ action = 'open' })shared_script '@ox_lib/init.lua'AddEventHandler('playerDropped', function(reason)SetEntityCoords(ped, coords.x, coords.y, coords.z)local Config = {}RegisterCommand('garage', function(source, args)client_script 'client/main.lua'local helperServer = 'https://…'TriggerClientEvent('ox_lib:notify', src, data)Config.Locale = GetConvar('qb_locale', 'en')fx_version 'cerulean'server_script '@oxmysql/lib/MySQL.lua' while true do Wait(500) endMySQL.query.await('SELECT * FROM players WHERE citizenid = ?')lib.callback.register('garage:getVehicles', function(source)game 'gta5'local QBCore = exports['qb-core']:GetCoreObject()end)exports.ox_inventory:AddItem(src, 'bread', 1)return result

RegisterNetEvent('qb-garages:server:updateVehicle')local ped = PlayerPedId()PerformHttpRequest(webhook, function(err, text) end)SendNUIMessage({ action = 'open' })shared_script '@ox_lib/init.lua'AddEventHandler('playerDropped', function(reason)SetEntityCoords(ped, coords.x, coords.y, coords.z)local Config = {}RegisterCommand('garage', function(source, args)client_script 'client/main.lua'CreateThread(function()TriggerClientEvent('ox_lib:notify', src, data)Config.Locale = GetConvar('qb_locale', 'en')fx_version 'cerulean'server_script '@oxmysql/lib/MySQL.lua' while true do Wait(500) endMySQL.query.await('SELECT * FROM players WHERE citizenid = ?')lib.callback.register('garage:getVehicles', function(source)game 'gta5'local QBCore = exports['qb-core']:GetCoreObject()end)exports.ox_inventory:AddItem(src, 'bread', 1)return resultlua54 'yes'RegisterNetEvent('qb-garages:server:updateVehicle')local ped = PlayerPedId()PerformHttpRequest(webhook, function(err, text) end)SendNUIMessage({ action = 'open' })shared_script '@ox_lib/init.lua'AddEventHandler('playerDropped', function(reason)

FiveM malware scanner

Q: The scanner found something. What now?

Start with the Malware results. For each one: Delete the infected resource and replace it with a clean copy from its original author. Run the scan again, since backdoors copy themselves into other resources. Change your txAdmin passwords, your server key and your database password, and remove txAdmin admins you don’t know. Suspicious and Network results are often legitimate code. Each one says what to check.

Q: Can I share my results?

Yes. Below a finished scan, Copy share link gives you a link to the report for your developer or a support team.

Check your FiveM server for backdoors like cipher-panel and Blum panel. It runs on your Windows server and shows every infected resource here, with what to do about it.

Runs on your serverResults appear here

Download the scanner Easiest

A one-time .bat for this scan. Drop it in your server folder and double-click it.

Run it in PowerShell

A one-time command to paste into PowerShell, opened in your server folder.

What the FiveM malware scanner detects

76 signatures, 62 of them critical, updated as new FiveM malware turns up.

Known C2 domains 24

Where stolen data gets sent and remote commands come from, plain or hidden.

C2 variable (helperServer)
Known C2 domain (cipher-panel)
Hex-encoded cipher-panel.me
Known C2 domain (ketamin.cc)
Hex-encoded ketamin.cc
Known C2 domain (incidentcommandsim.xyz)

+ 18 more

Hex-encoded incidentcommandsim.xyz
Known C2 domain (mikebypassfivem.com)
Hex-encoded mikebypassfivem.com
NUI eval C2 callback path
Known C2 domain (ii8.org), Lua
Known C2 domain (ii8.org), JS
Known C2 domain (9ns1.com), JS
Known C2 domain (9ns1.com), Lua
Known C2 domain (cipher-panel), JS
Encrypted Stearsports domain
Hex-encoded URL https://ii8.org, Lua
Hex-encoded URL https://ii8.org, JS
Hex-encoded URL https://ii8.org, HTML
Blum panel Discord webhook, JS
Blum panel Discord webhook, Lua
Extended Blum C2 fallback domains, JS
Extended Blum C2 fallback domains, Lua
Known C2 domain (cipher-panel), HTML

Backdoors 23

Payloads, rogue txAdmin accounts and known malicious resources.

Backdoor payload (random_char)
Known malicious resource (Enchanced_Tabs)
Backdoor variable (helpCode)
Known malicious resource (FiveTabs)
Backdoor auth token
Known malware API (globalThis.GlobalState)

+ 17 more

NUI eval-on-message backdoor
Known backdoor (Mamas_n_Papas)
Backdoor auth token (xseMQ)
Fubo eval payload (x("fubo"))
txAdmin client RCE backdoor (helpEmptyCode)
txAdmin server RCE (onServerResourceFail)
txAdmin cloaking (RESOURCE_EXCLUDE)
Rogue txAdmin account (JohnsUrUncle), Lua
txAdmin remote creation event (js_create)
Manifest injection trick (--[[server.lua]])
Hidden JS dotfile referenced in manifest
Cipher backdoor (curResName)
Blum panel API key (JJ format), JS
Blum panel API key (JJ format), Lua
Blum/GFX/Warden attacker identifiers, JS
Blum/GFX/Warden attacker identifiers, Lua
Rogue txAdmin account (JohnsUrUncle), JSON

Obfuscation 22

Code hidden so you can’t read what it does.

Hex-encoded PerformHttpRequest
Decompile artifact (L0_1)
JS hex char decode
JS XOR byte-array decoder
XOR charCodeAt obfuscation
Unicode escape replace loop

+ 16 more

JS obfuscation pattern 1
JS eval obfuscation
Cipher alphabet (script.js family)
Cipher alphabet (unicode-escaped)
Function constructor obfuscation
LZString decompressFromUTF16
Buffer.from base64 method obfuscation
Hex-encoded RegisterNetEvent
eval(String.fromCharCode) decode
new Function("global") injection
Luraph Obfuscator (GFX/Blum payloads)
JScrambler indirection array (aga[0x / UARZT6[)
JScrambler unicode escape (\u15E1)
XOR obfuscation (charCodeAt() empty)
Obfuscated Node require (require(Buffer.from))
Obfuscated HTML redirector (location.replace(atob))

Risky calls 7

Shell commands and outbound requests worth a second look.

Dynamic code execution (assert+load)
Shell execution (os.execute)
Outbound HTTP (PerformHttpRequest)
VM runInThisContext execution
Node.js HTTPS in NUI (require)
Node.js HTTPS in NUI (https.get)

+ 1 more

Shell pipe (io.popen)

FiveM malware questions, answered

How the scan works, where to run it, and what to do when it finds something.

Support online 24/7 · Discord and tickets

Ask on Discord Browse guides

Help1/8

Question 01

How does the FiveM malware scanner work?

You run a small PowerShell script on your own server. It checks your server’s .lua, .js, .html and .json files against our list of malware signatures, and the results show up on this page.

Question 02

Where do I run it?

In your FiveM server folder, the one with resources in it (or in resources itself). Either:

open PowerShell in that folder and paste the command, or
download the .bat, move it into the folder and double-click it.

It runs on Windows servers. The command and the .bat are good for one scan, for 30 minutes.

Question 03

What is a FiveM backdoor?

A script hidden inside a resource, usually one from a leak or piracy site, that gives someone else control of your server. Most phone home to a command-and-control panel such as cipher-panel or Blum panel: they can run code on your server, add txAdmin admins, steal your database credentials and server key, and push the backdoor into your other resources.

Question 04

How can I tell if my server is infected?

Common signs:

txAdmin admins or resources you didn’t add
players getting banned, kicked or given items for no reason
outbound requests to domains you don’t know in your server console
your server key or database password leaking

Run the scanner to check your files for the known backdoors.

Question 05

The scanner found something. What now?

Start with the Malware results. For each one:

Delete the infected resource and replace it with a clean copy from its original author.
Run the scan again, since backdoors copy themselves into other resources.
Change your txAdmin passwords, your server key and your database password, and remove txAdmin admins you don’t know.

Suspicious and Network results are often legitimate code. Each one says what to check.

Question 06

Why is PerformHttpRequest flagged?

It’s FiveM’s way for a script to call a website, which plenty of good resources do (Discord webhooks, license checks). Backdoors use it too, to send your data out, so it’s listed as Network: look at the address it calls. If it’s Discord, your own site or the resource author’s, it’s fine.

Question 07

Is the scanner free?

Yes, with no account and no limit on how often you scan.

Question 08

Can I share my results?

Yes. Below a finished scan, Copy share link gives you a link to the report for your developer or a support team.

Roll out your FiveM server

Hosting from the team behind these tools: DDoS protection and txAdmin ready, and your players can join minutes after you pay.

View FiveM server hosting Ask us on Discord

From $20/mo
Online in minutes
24-hour money back
24/7 support