Collusion detection
Catching the pattern where a staff member funnels spawned items to a friend's account instead of their own.
Argus v1.1.1Paper · Purpur · Folia-safe1.21 – 1.21.x
The oldest trick in staff abuse is not stealing for yourself. It is spawning items and handing them to an alt or a friend, so your own inventory stays clean and the economy damage looks like it came from a player.
Argus detects the hand-off itself.
How it works
When a monitored staff member drops an item, Argus remembers the dropped item entity. If another
player picks up that specific entity within collusion.window-seconds, it is recorded as a
hand-off from the staff member to that player.
After collusion.threshold hand-offs to the same accomplice inside the window, the
collusion signal fires at 30 points.
signals: collusion: threshold: 3 window-seconds: 30Matching by item-entity UUID rather than by "someone picked something up nearby" is what keeps this usable. Two players standing in the same room clearing a farm do not generate matches; a directed drop-and-collect does.
What it catches
- Spawning items in creative and dropping them for an alt account.
- A staff member acting as a laundering step between the console and a player's inventory.
- Repeat gifting to the same account that the giver has no in-game relationship with.
Combined with item_injection, the pattern reads clearly in the timeline: items appear from nothing,
then leave to the same name every time.
What it deliberately does not catch
- A single hand-off. Staff give players items for legitimate reasons all the time — event prizes, returning lost gear after a rollback.
- Hand-offs spread across different players. Helping ten different players once is support work; helping one player ten times is a relationship worth looking at.
- Trades through a chest or a shop plugin. Those are not item-entity pickups.
Tuning
| Setting | Raise it when | Lower it when |
|---|---|---|
threshold | Your staff routinely hand out items during events and you get noise. | You want the first repeat pattern surfaced immediately. |
window-seconds | Hand-offs on your server happen slowly (large builds, lag). | You only care about deliberate rapid transfers. |
On most servers the defaults (3 hand-offs, 30-second window) are the right starting point. If you
run frequent giveaway events, raise threshold to 5 rather than disabling the signal.
Reading a collusion flag
The Why breakdown names the accomplice and lists each matched hand-off with its timestamp. The rewind timeline shows the surrounding actions — which is where you find out whether the items were spawned moments earlier or came out of the staff member's own stock.
Investigate before acting
A collusion flag is a strong signal, not a verdict. Check where the items came from first. A staff member returning a player's rolled-back inventory in three trips looks identical to abuse until you read the two minutes before it.
Relationship graph
A visual relationship graph inside the GUI — who hands off to whom, across the whole team — is on the roadmap rather than in the current release. Today the relationships are visible per member in the Why breakdown.