Check Trail

Every bank check tracked from creation through trades to cashing.

Lingering Checks

Checks that exist in the world right now and have not been cashed — stored value parked in a bank, a backpack or a house. Outstanding value and holders come from the world save, which is the authority on what exists; the log's never-cashed count is shown alongside only as a parsing-coverage signal.

Trades

Vendor Sales

Per-item player-vendor purchases. Each line links buyer → seller → item UID → price. Different from trade logs — no confirmation window, just a direct purchase from someone's vendor.

Gold Flow

Gold Supply & Cash-out Activity

Known gold creation is separated from moneybox withdrawals and check-writing. Cash-out activity is custody movement, not inflation.

Known faucets vs Received (from others)

High received with low independently observed faucet income is the wealth-recipient shape.

Off-book residual (save truth vs ledger)

Each account's real net-worth change (world-save snapshots) minus every logged gold flow. Positive residual = wealth appeared through no logged channel — the strongest off-book / RMT signal.

Account Relationships

Directional: who gave what to whom across all trades and checks.

Risk Patterns

Forensic signals grouped by family. First row: economic/behavioral patterns from trade and event logs. Second row: account-security signals — failed logins, connection rejections, hardware mismatches, PIN failures.

IP Investigation

All activity across every account that used this IP address.

Account Clusters

Groups of related accounts — two independent evidence bases. IP clusters use frequency-weighted co-residency (promiscuous NAT/VPN IPs excluded). Hardware clusters share a single hw_uuid from the login database — the strongest alt-farm signal.

Staff Activity

All admin actions: jails, mutes, staff commands, player pages.

Sellers

Accounts moving real value right now: checks written and cashed by others, overpriced/wash vendor "sales", fast check pass-throughs (couriers), one-sided deliveries. Ranked by value moved inside the window.

Gold Custody

Cross-account gold movement from world-save ownership, nested containers, ground handoffs, trades, and checks. Moving a bag cannot hide the gold inside it.

Log-observed direct transfers

Item Transfers

Cross-account custody changes proven by consecutive world saves. Each item is valued at the completed-sale median available before the receiving save; return trips remain separate gross transfers.

Pages

Player .page submissions (GM help requests) with the GM reply, handler, and in-world position. Filter by text, GM, account, or date range. Click an account to drill into the player view.

Kufur Reports

Player-filed .ihbar (swearing) reports with the captured chat transcript around the incident moment. Each row is one incident; expand to read the snippets and see who said what.

Errors

Engine ERROR / WARNING / CRITICAL lines, clustered into issues by message fingerprint (UIDs, coords and numbers collapsed). Spot what's frequent, what just appeared, and what's trending up — then drill in for the daily history and time-of-day pattern.

Criminal Flags

Criminal-flag evidence ([CRIMLOG]): confirmed script transitions, player/NPC notices, guards resolutions with their exact cause, and 20-minute saw-crime memories.

Honeypot

Server-side cheat-detector trips. Each event is a client action (DoubleClick, PickUp, Target, ...) whose seed didn't match — the client interacted with a bait item (honeypot) the server never showed it. Severity-100 cheat-client signal.

Client Telemetry

Encrypted machine-fingerprint snapshots posted by the client 5 minutes into a session. Software is stored as an account + machine baseline followed by additions and removals; screenshots and session evidence remain per snapshot. Click any row to reconstruct the full state at that moment, including present, newly added, just removed, and previously seen software.

Live Status

Currently-online players, grouped by IP. Counts come straight from the engine's own arc_online_acc table — every connect/disconnect is a row, latest row per (account, character) where online=1 is the deterministic CCU. Multi-box IPs (most accounts on one IP) bubble to the top. Enriched with country, guild, house flag, last activity from logs, and 24h honeypot / anti-cheat hit counts.

Network Diagnostics

Windows TCP samples and smoothed transport RTT for live Sphere clients on port 2594. These diagnose the network path but are not the game's own ping measurement.

Current connections

Sample history

Store dupe investigation

Identify replay sources, follow affected inventory and inspect its current concentrations.

Raw Stream Audit

Server-side grep of one log file using a category regex, cross-referenced against events.sqlite. Lines marked "missed" matched the regex but were parsed as OTHER — that's the silent-drop signal. "partial" means parsed as a generic type when a more specific one exists. "not_indexed" means the file isn't in events.sqlite yet.

Driver Analysis

Detected keyboard/mouse filter drivers per account. Categorized by type and severity — virtualization and cheat-tool drivers are flagged as alerts.

DB Viewer

Read-only browser for the SQLite enrichment sidecar. Use Search to locate any UID across all tables; Browse for paginated table inspection; Query to run SELECT statements directly.

Log Viewer

Accounts

Every account, ranked. Pick a starting point, then narrow it — the filters combine, so "rich, gone quiet and sharing a machine" is one question rather than three pages.

Event Feed

Everything that happened, in time order. Pick what you want to see — the columns follow. "Any event type" reaches all 119 parsed types, including the ones no page was ever built for.

Files

Gold Accounting

Legitimate-gold accounting per account. Recon totals each account's DB-known gold-in (quest rewards + merchant sell revenue). The other tabs drill into each source leaderboard, plus Storage Wealth — hoarder-scale inventories.

Player Dossier

Ground-truth per-account snapshot from the world save: exact net worth, characters, hardware, houses, pets, vendors, and full inventory.

Machines

Hardware (hwuuid) clusters — accounts sharing a physical machine, online or offline. Multibox / farm finder.

Item Integrity

Cases

What is asking for a decision. Detectors open a case when they find something; a case you dismiss stays dismissed until NEW evidence arrives, at which point it reopens and says so. This is the only table here that a rebuild cannot reproduce.

World

Current world state from the .scp save — ground truth, not inferred from logs. Items, houses, vendors and client hashes in one browser. Any UID can be located to see its full container path and contents.

World Timeline

The world moving, save by save — items changing hands, characters moving, things appearing and vanishing. Pick a snapshot to see everything that changed in that ~30-minute step.

Guilds

Current guild organizations and isolated cross-guild accounts. Broad roster overlap is grouped as sister guilds; thin links stay visible for review.

Houses

All 672 houses with owner character, account, coordinates, and type.

Tamed Animals

Rare-mount tames from the roster (unicorns, shires, silver steeds, kirins, and the rest). High-value mounts — who tamed which, when, and where. Click an account to investigate.

Verified Disguises

Character names that exist on 2+ distinct accounts in arc_stat_players — ground-truth disguise detection from DB (vs. statistical inference from logs).

Live Log Stream

tail-f style real-time view of every event being parsed from the SphereServer logs. Visual only — no alerts, no chimes. Use the type filter to narrow to specific signal types.

System

Live resource use, ingest throughput, and worker activity. The freshness pill in the top bar links here. Snapshots refresh every 5 seconds.

Item Spawner

Search the SphereServer item catalog (arc_allitems). Click a row to copy .add <defname> to your clipboard, then paste in-game to spawn or reference.

Arena

Live monitoring of arena PvP. Log stream + DB system-of-record unified across 7 tabs.

Glossary

Forensic and SphereServer domain terms used across the app. Hover the dotted terms anywhere in the UI for a quick definition; read the full entries here.