It’s impossible to differentiate between someone using a network lagswitch and someone actually pinging bad. I think this solution I proposed earlier today may be a tad bit more reliable.
PS: These threads are closely related. If you have any more questions in regards to your anti-exploit, making a new thread may not be the best idea if it’s closely related to a previous one.