Article

How to detect an x-rayer with CoreProtect

A player logs off with three stacks of diamonds after one evening. You suspect x-ray. Two instincts kick in — ban on gut feeling, or trust an ore counter — and both are wrong. Here is a method that holds up, using logs your server already records.

Updated 22 August 2026

What you are trying to prove is not what you think

The instinct is to demonstrate that a player found too much ore. That road leads nowhere: luck exists, caves exist, and so does a good miner who knows the right layers. A high total is never proof — only a reason to open the case.

What you are actually trying to establish is something else:

Before you start: check your retention

CoreProtect automatically purges old data based on the duration set in its config.yml. If your retention is 7 days, no command will give you last month back. Check that value before promising your staff an investigation — and if you moderate seriously, raise it: it is the only memory you have.

Step 1 — Count ore and stone separately

The classic mistake is looking at the diamond count on its own. That number means nothing without its denominator: how much stone did the player have to break to reach them?

The #count hashtag skips pages of scrolling and returns a total directly:

Ore collected

/co lookup u:PlayerName a:-block t:7d i:diamond_ore,deepslate_diamond_ore #count

Stone broken over the same period

/co lookup u:PlayerName a:-block t:7d i:stone,deepslate,tuff,andesite,diorite,granite #count

A few syntax reminders: a:-block keeps only blocks that were broken (a:+block = placed); i: filters on a list of blocks; t:7d accepts combined forms such as t:5d2h; r:#global widens the search to every world.

Step 2 — Read the composition, not just the total

The breakdown of what was broken usually tells you more than the totals:

• Lots of stone, on a single layer, continuously → classic strip-mining profile. The player is digging blind, and it adds up.
• Little stone, varied ore, at very different heights → the player was not digging to move forward; they were travelling through existing empty space. Probably a cave — or x-ray.
• Stone in short separate bursts, each one followed by an ore → this is the interesting pattern. Dig a little, find something, dig a little, find something: that does not happen blind with any regularity.

Step 3 — Rebuild the path

A technical point many people miss: CoreProtect does not record player movement. But it does record the coordinates and timestamp of every block broken — and that sequence of points, put back in order, is a path, sampled once per pickaxe swing.

This is where you find the signals luck cannot explain:

• The detour and the return. A straight corridor, a sharp step aside towards one specific vein, then a return exactly onto the corridor's axis. A blind miner who stumbles onto ore has no reason to resume their line block for block.
• The descent that stops dead. A vertical shaft that ends exactly at the height of a vein, not one block deeper.
• The early turn. A change of direction started before the ore was visible from where the player stood.
• The absence of dead tunnels. A real miner digs a lot for nothing. A run of sessions without a single unproductive tunnel is abnormal.

The practical limit: reading all this in chat, page by page, is workable across a few dozen blocks. Past a few hundred, over several players and several weeks, it stops being feasible by hand — which is exactly the work a tool should be doing for you.

Step 4 — Inspect the surroundings of a find

Note the coordinates of one of the ores, go there, and turn on the inspector:

/co inspect

Every click on a block shows its history. The question to settle is always the same: was the ore touching air that was already there? If it bordered a natural cavity, anyone could see it. If it was sealed inside solid stone, nobody could.

For a quick overview of what happened around you:

/co near

The equivalent of a lookup within a 5-block radius. Handy once you are on site.

The false evidence to rule out

The special case of trap ores

Burying artificial, fully isolated ores and watching who breaks them remains a valid technique. Two strict conditions: the block must be genuinely invisible (surrounded by solid stone, never at the edge of a cave), and isolated enough that it cannot be found by chance while digging. A badly placed trap produces unfair accusations.

Before you sanction

A false positive does not just cost you a player: it costs you the trust of everyone who knows them, and that kind of story travels fast. Conversely, letting a proven cheater run demoralises the people playing honestly.

Hence the common-sense rule: a score, a counter or an alert is there to decide what to look at, never to decide a sanction. The decision belongs to a human who opened the case, cross-checked at least two independent signals, and verified the surroundings on site.

The checklist

1. Check CoreProtect retention first.
2. Count ore and stone separately with #count.
3. Compare against your own trusted players, not a threshold found online.
4. Look at composition and height distribution, not just totals.
5. Look for path patterns: detour-and-return, a descent that stops dead, an early turn.
6. Look for what exonerates too: ore passed close by and left untouched.
7. Inspect the surroundings: was the ore touching pre-existing air?
8. Decide as a human, on at least two independent signals.