Suspect a Cheat or Hack? READ THIS!

We need to have some guidelines for everyone to use if they suspect someone cheating or hacking on our servers.
The key is to compile as much information as possible.

#1: InGame Name of the individual.
#2: PBGUID of the individual.
#3: A ScreenShot that will support accusations (if applicable).
#4: A detailed description of what occured.

The more of the info listed above, the easier it will be for the anti-cheat crew to do a background check.

Please put the information in a REPLY to THIS TOPIC.

Thanks.

can someone take a look at this guy?
[u]Name: .!.W!Ll.$uR^!vE.
GUID: 031297FB20A441ADC9CA052A468E1298

unbelievable accurate shots with r and g. 21 kills in 5 rounds. 5 kills in 3 shots with g, different shots all over the map. Just smells funny.

Background look ok. Linked accounts are:

.!.W!Ll.$uR^!vE.
031297fb20a441adc9ca052a468e1298
98.236.23.142

.The.Soldier.Boy.
90bf5b595a4f056d416c6c2f4272b39e
98.236.23.142

ELIT3GAM3R
031297fb20a441adc9ca052a468e1298
24.8.33.190

SGT.203
031297fb20a441adc9ca052a468e1298
24.8.33.190

InGame name: Sw0o0sh

PB: IDK

NO SS

I Would just like a background done on him, multiple complaint of hacking w/ RPG. 5:09 EST.

Mack...I would have to agree with them. This guy needs to be banned from our servers. It is the longest history of cheating I personally have ever seen. HOOAH!


Background Search for : 4b9ab0384dd202e588c26ee3ba86dc81

1 IP's checked for accounts

Quote :

70.80.156.48

15 GUID's checked for bans and kicks

Quote :

bec434ba2a94df772901d0a2de216227
2d4b5e59ed621e78068e5b00ac98a2e1
266363a6a9f2ac236ff1cb6e3180c6cc
8438cba49a3f6f3ff536a1a050b694e7
bc8f5a51ff0f974a6ab09a72db842f12
32aa5c1de1a396e4dd50a28b541c2185
e0b1a69ea68c37f007607087f1e8ae60
f5b6218f4f7aefe875b181cf83060b50
fc3742e1183f1522bc0fdcedaa27522c
84a728211685e2f263a72093ba20850f
1bbac8da35e0a46ff949f02842a78e3d
a720e538e82c79e5c7e6ae0f6b5b0a71
a955a98bb253ce04f31bda6ab25deaaa
4b9ab0384dd202e588c26ee3ba86dc81
bf5f4f7111f582418347701f58fc36ec

89 Player Names found in history

Quote :

CooLall
Fidj!
Getzlaf
humble_mumble
Muskol
old_agp
Polarz
praeputium
Qc_M39
spray_nine
thylacine_taz
Winter_Owl
[CaK]sukorz
$uicider
All-Purpose
BlackMaple
Combat_Wound
Fidj!
GLASTRON
GunjaMan
HARF@NG
HARF@NG01
la_vache
MiKaZaRu
minoune
Mizaru
Nestle_Quick
Nostidfou
Oizys
Oka_zou
Petrooka
Prae^putium
Prepuce
Q-T!P
SGT.EDELBROCK
ST-Ciboire
T@barn@k
The_Puppet_Man
winter_owl
xXX-Sylvie-XXx
ZaG_ZiG_ZaG
$uicider
BEFUDDLE
BlackMaple
chiensale
fidj!
GunjaMan
Johnny.Bgood
Kantaloops
Polk_Salad_Annie
S!x_Bl@de_Kn!fe
SGT.EDELBROCK
STEKISA
Steve_Roger_!
Sw0osh
UNOSTIE
VERSOO
xXX-Sylvie-XXx
{0o}_Samurai
S!x_Bl@de_Kn!fe
[THANATOS].MICKPICK
[THANATOS].Mick[GT]
[TR].MICKPICK
eddie_bauer
Gunjaman
Kovalev_AK-27
no_tampax
prepuce
spray_nine
sweet_caroline
ThE_fLoWeR
Uc-FoRuM.CoM
Big_Cap
Getzlaf
humble_mumble
Mikazaru
polk_salad_annie
raz_ta_plotte
eddie_bauer
eddie_bauer
eddie_bauer
Eee_zz
franfreluche
NeTzBoT_1.2
Iced_tbag
fr_angel
saperlipuppets
Sw0o0sh
Sweetness_34

4 Accounts found banned in players history

Quote :

bec434ba2a94df772901d0a2de216227	Fidj!
bc8f5a51ff0f974a6ab09a72db842f12	Uc-FoRuM.CoM
32aa5c1de1a396e4dd50a28b541c2185	Getzlaf
1bbac8da35e0a46ff949f02842a78e3d	NeTzBoT_1.2

5 Kicks found in players history

Quote :

09.28.2008 13:01:08	bec434ba2a94df772901d0a2de216227	Engine.Player ConfiguredInternetSpeed * = 100
10.04.2008 19:54:41	bec434ba2a94df772901d0a2de216227	Maps/SMU_GH_SFFloodgate.aao
02.01.2008 15:47:03	2d4b5e59ed621e78068e5b00ac98a2e1	Throw_M84_Stun _fEffectDuration *
02.01.2008 19:10:58	2d4b5e59ed621e78068e5b00ac98a2e1	Throw_M84_Stun _fEffectDuration *
01.02.2009 15:46:42	32aa5c1de1a396e4dd50a28b541c2185	Maps/ES2Border.aao

Login History - 508 Logins from IP's used by a banned account.

Quote :

LMAO!!! I had to EDIT the banned Logins due to the length of this post!!!

What was his RPG hack? Heat seeking?

GUID: EB08FBD757ED50F102A4438196AE8572
In game:[NL]de-super-tker
Linked accounts:
Collapse Section
[NL]de-super-tker EB08FBD757ED50F102A4438196AE8572 195.241.173.210 Unknown 2009-05-04 09:42:23 GMT -7
-=TroY[nl]=- 8950F13383A2836F2033208598AF14F7 195.241.173.210 00:1B:63:C4:40:XX 2009-01-05 12:19:48 GMT -8
Ron[K] 59648799FF0A4CC6C08BB61761A5B330 195.241.173.210 00:1B:63:C4:40:XX 2009-01-05 12:24:33 GMT -8
[NL]the-g@ylord 23695C31271C1FB71ADFED81D0AE4FCF 195.241.173.210 00:13:8F:F3:AB:XX 2008-10-19 07:08:39 GMT -7
-=ronofich=- FA82E02357FBDC90F5B30E6C6F16955E 195.241.173.210 00:1B:63:C4:40:XX 2009-01-05 12:16:50 GMT -8
d4rkw4rl0rd 197F059150A3C02C6D11A7945F972A25 195.241.173.210 00:1B:63:C4:40:XX 2009-05-04 09:43:34 GMT -7

he has been on server lately,just trying 2 help out

Is it possible for some of us to get some training in how to read these things. Sometimes the linked accounts don't mean anything, sometimes they do. I know that the ACI and AON checks that we do aren't anywhere as indepth as what the PSA's can do but it would be nice to see how it all works.

NO. The reason is that Storm is the AON PSA and he will do everything possible NOT to share that knowledge with anyone.

(Phil...when I get a little free time I will get you and S!ck some tools to make that shit easier. It sometimes is a judgment call, but I can get you to feel a little better about the stuff you are seeing.)

Kool,than you soul..was checking those guys playing earlier n clicked on pb guied thing n it showed linked accounts some highlighted in red saying they had some multihack or pbhack on them..but dont know if "linked" means its other accounts they use.. and when im on they tell me someone is hacking n i want to know how check n catch them mofos. HeHe

I agree, anything to help us lowly player admins make a quick check if we suspect someone. Then if we see something, we can post it to be addressed.

check this guy that was earlier " grinia" it looks bad with a couple hackedd links like that dam souljaboy guy,remember mid screen said something about www.souljaboy something? =Xtrem[Russ]

grina does have a "linked" account. The problem is that his account is associated with 231 IP addresses. A few of his IP addresses are the same one(s) that have been used by accounts that have bans placed on them. The time from the banned account using the IP and HIS account using the IP is separated by about 6-8 months. When I do a lookup on these IP's, I find that they originate in Israel. This is an area that "reuses" dynamic IP addresses from a relatively small "pool" of numbers. This dramatically increases the odds of a clean player being LINKED via IP address to someone with an actual banned account. This is one of those times that research is necessary and a reason why we always give someone the benefit of the doubt. Besides, if their account isnt banned by AON...our clan policy is to let them play unless WE get a screenshot proving otherwise. There will always be someone with a "new hack" or "new cheat" that the system hasnt caught up with yet so we try to watch the screenshots as much as possible. When people say someone is cheating because they have done a quick check and notice "linked" accounts, 90% of the time they have not done the follow up work to see WHY and HOW the accounts are linked.

Yup to actually catch a hacker we need to post a SS etc. What we mean is if we suspect someone of hacking - how do we interpet what we see via the ACI website?

Yes like how the CMW guys like to come on the server and ask why admins don't ban people with linked accounts. We just can't without solid proof.

I will accumulate a few examples over the next few days and try to get some type of post explaining some. It would almost be easier to do on TS but getting everyone on at the same time is always a pain in the ass. I'll get some of the basics and try to move forward from there.

I'm certainly not an expert, but I'm really starting to understand how everything works. Its quite complicated and might take some time to break it down into posts for the website, but I think we can get something going.

I'll actually start a Reading A Background Check thread and try to do something like weekly lessons. I'm sure we can get some "guest speakers" to contribute their knowledge too. (FraggeR comes to mind)

Yeah n funny thing is some of there names come up with these linked accounts lol!