SRL Archive - Banned from RS

some days ago 2 acc's banned I don't care about, today my main goldfarmer I just used a bond on … I have been goldfarming on this account for 30 days no ban, now +-3 days after 2 other accounts got banned this one also got banned, so I think they flagged my ip.
I don't care about the account, but now I don't feel safe giving 6 Mil to an account to goldfarm with it :( and losing the 6 M on that account and maybe getting my main banned …

IP flags don't exist.. Something is detectable. Maybe the client? I don't think anyone has any idea..

RSBot has it worse off but you can see it rubbing off over here as well in both OSRS and RS3..

From: Brandon
IP flags don't exist..

^^ This.

Also, I really don't think the client is detectable, it's almost certainly his script/botting habits. I'm still running 20+ accounts simultaneously, and I haven't seen any bans in 2 months. That's not to say I won't get hammered tomorrow, but I think we're still ok as far as the client goes.

Your post did get me thinking though, does SRL have a plan for if/when Jagex decides to start detecting SMART?

Well I haven't been banned since 2013, and I've been running scripts quite a bit recently. Sometimes 2-3 days straight. I'd say they are not detecting Simba/SMART, they are detecting your script. Scripts that were once undetectable might now be detectable.

People always blame the client yet overlook the most obvious answer.

From: Gunner

Your post did get me thinking though, does SRL have a plan for if/when Jagex decides to start detecting SMART?

Well if they do I don't think there's anything we can do about it. Maybe there are some things we could do to disguise it as an allowed client, but I think they can still do something to the real client that we could not do that makes it identify as allowed to jagex.

One thing people can try would be not using SMART at all, but from in my situation that doesn't seem to be necessary at the moment.

From: The Mayor
Well I haven't been banned since 2013, and I've been running scripts quite a bit recently. Sometimes 2-3 days straight. I'd say they are not detecting Simba/SMART, they are detecting your script. Scripts that were once undetectable might now be detectable.

People always blame the client yet overlook the most obvious answer.

it's the honeycomb collector someone else already posted that he got banned with it some time ago, never saw a ban with it until 3 days ago.
Maybe they detected the script cus so many people are running it, the price of honeycombs is dropping fast.
aren't ip flags a thing in 07? Many people on tribot are talking about it, And I don't know cus my ip changes at random times … ( sometimes a day sometimes a week, …. )
I know what to do, time to edit the script a bit, changing the important ( most detectable ) code.

And about smart getting detected, can't we just use color detection in the official client, for os this will be harder, but for rs3 this seems possible 2 me.

From: The Mayor
Well I haven't been banned since 2013, and I've been running scripts quite a bit recently. Sometimes 2-3 days straight. I'd say they are not detecting Simba/SMART, they are detecting your script. Scripts that were once undetectable might now be detectable.

People always blame the client yet overlook the most obvious answer.

This. If SMART was actively detected almost everybody on this forum would be insta-banned.
As for a plan if they start detecting it, browser botting isn't that difficult. If they detect that, then maybe a rework of mouse/keyboard inputs needs to occur.

From: Clarity
This. If SMART was actively detected almost everybody on this forum would be insta-banned.
As for a plan if they start detecting it, browser botting isn't that difficult. If they detect that, then maybe a rework of mouse/keyboard inputs needs to occur.

I dont think there's any other way to input mouse/keyboard so i'm not sure how a re-work would work. :p

ALRIGHT ALRIGHT. before we start a whole 'Jagex doesnt track IP addresses' war let me ask…
Does anyone have any definitive proof that Jagex does/does not use IP addresses as a factor in their banning/tracking/flagging system?

I see someone posting almost every day that 'jagex doesnt ban by ip' yet i see no proof.

Yes, i realize that jagex does not use IP addresses as a sole reason for banning, but if you were a company that tracked users, wouldnt use at least consider checking the IP addresses that are already partially logged?


(im not for or against tracking by IP, but would just like to know with a little certainty)

As far as I'm concerned a lot of bans are manual from JMods. I remember when I was using Nexus client they made it so a lot of bots logged out if a JMod were around you for a certain amount of time. Main place this happened was Rimmington mine. Obviously the JMods were invisible but they would hit up hot spots for bots and just issue manual bans. The manual bans showed up as any normal macro-ban. This is the case with nearly every divination bot. It's hard to say if you can get IP flagged, etc. but I would say a good chunk of bans are handed out manually.

From: Turpinator
ALRIGHT ALRIGHT. before we start a whole 'Jagex doesnt track IP addresses' war let me ask…
Does anyone have any definitive proof that Jagex does/does not use IP addresses as a factor in their banning/tracking/flagging system?

There's no proof that they do track them either. If they did, someone would have seen it a long time ago

It doesn't make any sense at all to track IPs. Especially when not everyone bots. For instance, lets say runescape has 1m players.

It'd roughly take up 4mb on their servers assuming it's stored as unsigned int and 6gb if it's a 64-bit unsigned long. And this assumes that all 1m players are under some suspicion to have their IP's logged. These are all assumptions btw.. but it's not that much actually. 8mb isn't too much.

But it's a waste if there's no other information to go along with it. It'd be a waste to track innocent IP's. When an IP is released, it goes back into the pool. Some other unlucky person could receive that IP the next time around..

Information needs to be stored with it. Information such as whether or not that player is using a bot.. That would require them to first detect said bot.

Since they are required to detect the bot in the first place, why store the IP? They can just outright ban you instantly and not waste time and space on their servers. Why bother iterating a bunch of IP's when:

1. IP's can change easily.
2. Proxies and/or VPN's can be used.
3. They have to detect you in the first place.


If valve tracked and/or banned by IP's, no one would be banned. Again, some unlucky soul could possibly be assigned a "banned" IP.

If there were IP bans, the amount of bot developers out there, one would have certainly found it by now.

From: Turpinator
ALRIGHT ALRIGHT. before we start a whole 'Jagex doesnt track IP addresses' war let me ask…
Does anyone have any definitive proof that Jagex does/does not use IP addresses as a factor in their banning/tracking/flagging system?

I see someone posting almost every day that 'jagex doesnt ban by ip' yet i see no proof.

Yes, i realize that jagex does not use IP addresses as a sole reason for banning, but if you were a company that tracked users, wouldnt use at least consider checking the IP addresses that are already partially logged?


(im not for or against tracking by IP, but would just like to know with a little certainty)

As far as pure, unadulterated proof and hard evidence, I doubt there will ever be any, and that's by design from Jagex. If we could prove to ourselves that "x" thing is a sure ban, we would just avoid doing "x" thing.

There is however tons of circumstantial evidence that says Jagex does NOT ban based on IP. For one, you can see my farming thread: https://villavu.com/forum/showthread.php?t=108878&highlight= and just look at all the bans I've had. At this point I'm well over 40 accounts banned since January, and the only accounts that ever get the hammer are accounts that actually botted.

I have never lost an account that wasn't a bot, despite the fact that every single account I make and bot with is created with the same IP, same HWID. I have a main (that I'm quite fond of), a banker that deals directly with my bot accounts handling hundreds of millions of GP/day, and a couple other accounts that are used from time to time as mules or bots. None of these accounts have ever even flinched when my farming bots get banned. I can say with as much certainty as is possible that Jagex absolutely does not ban based on IP. That's not to say that they can't, only that they don't.

That is also not to say that they won't start doing it tomorrow, or next week, or whenever. They have done it in the past, and as recently as the Nuke in '11 they admitted to IP banning goldfarmers, which ironically is the category I fall into. However in that statement they were referring to major goldfarming companies, not solo operations like myself and the other small scale guys here at SRL.

Hopefully this fulfills your expectation of proof. As I said, there will likely never be concrete evidence on way or the other, but I feel that my experiences alone are enough to say I'm 99% certain that IP bans are no longer a thing with Jagex.

From: The Mayor
Well I haven't been banned since 2013, and I've been running scripts quite a bit recently. Sometimes 2-3 days straight. I'd say they are not detecting Simba/SMART, they are detecting your script. Scripts that were once undetectable might now be detectable.

People always blame the client yet overlook the most obvious answer.

I recently lost 3 out of 3 bot accounts using your VEB Miner script. None of the bots were running at the same time nor did they run any other script, ever. I think your script is pretty perfect so I don't know what it was. Also don't worry I don't blame you or your script at all.

I've been constantly running a private script for around 17 days straight now. No bans or anything, and yeah it's a bad habit for botting, but I'm still not caught. It's something to do with our scripts or dlls. I highly doubt it's SMART. Jagex CAN detect the altered dlls. If I find anything more on this, I'll let you know.

Best of luck & Cheers,

Blytez

From: Olly
I dont think there's any other way to input mouse/keyboard so i'm not sure how a re-work would work. :p

I was told at one point by someone that there is a detectable difference between mouse movement input coming from an actual mouse and mouse movement being controlled by a program i.e. Simba? Ignore me if this is incorrect.

From: Clarity
I was told at one point by someone that there is a detectable difference between mouse movement input coming from an actual mouse and mouse movement being controlled by a program i.e. Simba? Ignore me if this is incorrect.

Yeah, but that doesn't mean we have other options.

From: BMWxi
Yeah, but that doesn't mean we have other options.

No way to spoof USB hardware input? I have no clue really, just throwing out ideas.

From: Clarity
No way to spoof USB hardware input? I have no clue really, just throwing out ideas.

I'm researching it online and I've found multiple pages where people talk about using a fake driver.
All this stuff is way out of my depth but maybe someone here will know if it's possible for our situation
https://github.com/jasonpang/Interceptor
http://www.alessandropira.org/virt_mouse/virt_mouse.html

This one is also interesting. If an operating system can't tell that it's not a real mouse then neither can Jagex:
http://arstechnica.com/security/2011/01/fake-keyboard-pcs-hacked-with-custom-android-usb-drivers/

For this last one the difficulty wouldn't be controlling the computer with a fake mouse but telling the physical USB device what to do with the mouse.

The IP of banned accounts could be stored as a "hint" for the Anti-Bot system (for a certain amount of time), like: "Keep an extra eye on users with this IP", so the anti-bot system can set higher priority (more in depth check) on other accounts under the same IP where bots previously has been detected.

I've not seen anything saying they don't do this.. And considering there seems to be _some_ hints towards "multi-ban" of accounts under the same IP I would not exclude as a possibility.

From: Mr. Roboto
I recently lost 3 out of 3 bot accounts using your VEB Miner script. None of the bots were running at the same time nor did they run any other script, ever. I think your script is pretty perfect so I don't know what it was. Also don't worry I don't blame you or your script at all.

That script is a very long way from perfect. It hovers ground ore, doesn't hover the next free rock, and most importantly, like all my public scripts (and just about all other public scripts on the forums), repeats the same linear loop over and over again :p

From: slacky
The IP of banned accounts could be stored as a "hint" for the Anti-Bot system (for a certain amount of time), like: "Keep an extra eye on users with this IP", so the anti-bot system can set higher priority (more in depth check) on other accounts under the same IP where bots previously has been detected.

I've not seen anything saying they don't do this.. And considering there seems to be _some_ hints towards "multi-ban" of accounts under the same IP I would not exclude as a possibility.

Hmm.. well I didn't think the way you're thinking about it. As a "hint". But still.. I wonder why one would use a hint to ban the bots if they had to detect it in the first place. If they have the capability to detect it, they might as well ban it right off the bat rather than storing the IP which they later use to check if another account on the same IP is botting..

It doesn't make much sense storing the IP as a hint in my own opinion for the following scenario:

1. User is caught botting.
2. Store IP of user that was already caught with the anti-cheat system.
3. Second account logged in on the same IP.
4. Check if the account on that IP is botting..
5. Ban second account ONLY if it's a bot.
6. User changes IP.


Consider those steps. Why do step 3, when step 4 requires you to check if the second account is actually botting in the first place? If such a check is done every single time, there's no point to the IP. Skip it and just do the check in the first place.

I don't know.. It just seems like a waste. They have to have the tech to catch you in the first place so I can't see why they'd need the IP to catch you the second time around when that same tech has to be ran both times to confirm that you're botting both times.

The only way I could see it working as a hint is if the client "collects data" rather than detects.


Btw.. how come when you quote me, it only shows up on my profile but not in the post :S Only happens to your quotes.

Are you buying membership using bonds? Everytime I get membership using bonds the account gets banned. When I pay using PayPal nothing happens.

*waits for @Brandon; to come up with a crazy idea (that i don't get) to make a bot undetectable*

From: Brandon
.. Only happens to your quotes.

Because I "sometimes" edit my posts, because I later on found that it would be better as a "general" message, rather then specific to some person :-)

From: Brandon
I don't know.. It just seems like a waste. They have to have the tech to catch you in the first place so I can't see why they'd need the IP to catch you the second time around when that same tech has to be ran both times to confirm that you're botting both times.

It could be done to save resources.

If the Anti-bot system performs two core steps (or more), second step is only done if the first step yields "probable", (simple example):

1. Perform lite-weight check for EG: basic repeating patterns, if acc on same IP as prev banned acc, high online-time, and/or whatever other "simple" stuff.
If first check yields "probable" continue to the second check..:
2. Do an in-depth check over a "longer" period of time (such a check can rather be computational expensive, considering the complexity of todays bots).

From: Olly
I dont think there's any other way to input mouse/keyboard so i'm not sure how a re-work would work. :p

Sure there is, as mentioned it's fully doable to create pseudo-drivers for both mouse and keyboard, it does however require a bit more work, and would be quite a bit harder to detect.
Tho I would not worry about it just yet, as they don't seem to be hooking WinAPI function-calls as this could (AFAIK) easily be detected.

From: slacky
Sure there is, as mentioned it's fully doable to create pseudo-drivers for both mouse and keyboard, it does however require a bit more work, and would be quite a bit harder to detect.
Tho I would not worry about it just yet, as they don't seem to be hooking WinAPI function-calls as this could (AFAIK) easily be detected.

I really, really would like to see this happen. I think the work would be well worth it.

I want to add that whenever I run a self made script without antiban or really bad antiban, after the 6 hour relog the account gets disabled. This has started on 1 september, before that I could run them selfmade scripts, scripts with poor antiban 24/7. Running a script with some decent antiban (TheMayor's VEBminer) doesn't get my accounts disabled after the 6 hour limit. Hope this helps towards reducing the bans.

From: slacky

Sure there is, as mentioned it's fully doable to create pseudo-drivers for both mouse and keyboard, it does however require a bit more work, and would be quite a bit harder to detect.
Tho I would not worry about it just yet, as they don't seem to be hooking WinAPI function-calls as this could (AFAIK) easily be detected.

I understand now what you mean. That makes a ton more sense. Never saw it that way tbh.


Btw.. they DO hook winapi calls.

PUSH EBP
MOV EBP,ESP
SUB ESP,1C
PUSH EBX
MOV EBX,DWORD PTR SS:[EBP+C]
PUSH ESI
MOV ESI,DWORD PTR SS:[EBP+8]
MOV EAX,DWORD PTR DS:[ESI]
MOV ECX,DWORD PTR DS:[EAX+7C]
PUSH EDI
PUSH EBX
PUSH ESI
CALL ECX
MOV EDX,DWORD PTR DS:[ESI]
PUSH EBX
MOV EDI,EAX
MOV EAX,DWORD PTR DS:[EDX+54]
PUSH ESI
CALL EAX
MOV ECX,DWORD PTR DS:[ESI]
MOV EDX,DWORD PTR DS:[ECX+84]
PUSH jaclib.6C577440                                                           ; ASCII "(III)V"
PUSH jaclib.6C577448                                                           ; ASCII "notify"
PUSH EDI
PUSH ESI
MOV DWORD PTR DS:[6C581084],EAX
CALL EDX
MOV DWORD PTR DS:[6C581040],EAX
CALL DWORD PTR DS:[<&KERNEL32.GetCurrentThreadId>]                             ; KERNEL32.GetCurrentThreadId
PUSH 0
MOV DWORD PTR DS:[6C581088],EAX
MOV EAX,DWORD PTR DS:[6C58107C]
PUSH EAX
PUSH jaclib.6C564820
PUSH 0E
CALL DWORD PTR DS:[<&USER32.SetWindowsHookExA>]                                ; USER32.SetWindowsHookExA
MOV ECX,DWORD PTR DS:[ESI]
MOV EDX,DWORD PTR DS:[ECX+84]
PUSH jaclib.6C577230                                                           ; ASCII "(I)V"
PUSH jaclib.6C577448                                                           ; ASCII "notify"
PUSH EDI
PUSH ESI
MOV DWORD PTR DS:[6C581078],EAX
CALL EDX
PUSH 0
PUSH EAX
MOV EAX,DWORD PTR DS:[6C581084]
PUSH EAX
MOV EAX,ESI
CALL jaclib.6C564800
MOV EDI,DWORD PTR DS:[<&USER32.GetMessageA>]                                   ; USER32.GetMessageA
ADD ESP,0C
PUSH 0
PUSH 0
PUSH 0
LEA ECX,DWORD PTR SS:[EBP-1C]
PUSH ECX
CALL EDI
TEST EAX,EAX
JE SHORT jaclib.6C564970
MOV EBX,DWORD PTR DS:[<&USER32.TranslateMessage>]                              ; USER32.TranslateMessage
LEA ECX,DWORD PTR DS:[ECX]
LEA EDX,DWORD PTR SS:[EBP-1C]
PUSH EDX
CALL EBX
LEA EAX,DWORD PTR SS:[EBP-1C]
PUSH EAX
CALL DWORD PTR DS:[<&USER32.DispatchMessageA>]                                 ; USER32.DispatchMessageA
PUSH 0
PUSH 0
PUSH 0
LEA ECX,DWORD PTR SS:[EBP-1C]
PUSH ECX
CALL EDI
TEST EAX,EAX
JNZ SHORT jaclib.6C564950
MOV EDX,DWORD PTR DS:[6C581078]
PUSH EDX
CALL DWORD PTR DS:[<&USER32.UnhookWindowsHookEx>]                              ; USER32.UnhookWindowsHookEx
MOV ECX,DWORD PTR DS:[6C581084]
MOV EAX,DWORD PTR DS:[ESI]
MOV EDX,DWORD PTR DS:[EAX+58]
PUSH ECX
PUSH ESI
CALL EDX
POP EDI
XOR EAX,EAX
POP ESI
MOV DWORD PTR DS:[6C581040],EAX
MOV DWORD PTR DS:[6C581078],EAX
POP EBX
MOV ESP,EBP
POP EBP
RETN 8

It just calls java code: void notify(int, int, int); and void notify(int); Benland100 & _Echo said a long time ago that the hooks are just for fullscreen mode. I believe them, but I'd rather see for myself..

I don't know what it does (other than calling the java code) because I didn't have time to actually sift through it and follow all the addresses and jumps. But those hooks actually do exist and you can see it for yourself with OllyDbg and the Phantom plugin. They don't worry me based off of what's been said before.


Btw.. there is NO need for drivers. If Simba used mouse_event instead of SendInput, the mouse and keyboard would be undetectable because the above hooks only have the LLMHF_INJECTED and the LLMHF_LOWER_IL_INJECTED flags set if using SendInput. I never got it to trigger with keybd_event and mouse_event; only SendInput and Post/SendMessage.


I don't see what all the fuss is about.. It's a few bans and NO ONE will figure out what is actually causing them. PB has had waves for months now.. I see no need to panic but then again.. I don't bot lol.

From: Brandon
I understand now what you mean. That makes a ton more sense. Never saw it that way tbh.


Btw.. they DO hook winapi calls.

...

It just calls java code: void notify(int, int, int); and void notify(int); Benland100 & _Echo said a long time ago that the hooks are just for fullscreen mode. I believe them, but I'd rather see for myself..

I don't know what it does (other than calling the java code) because I didn't have time to actually sift through it and follow all the addresses and jumps. But those hooks actually do exist and you can see it for yourself with OllyDbg and the Phantom plugin.


Btw.. there is NO need for drivers. If Simba used mouse_event instead of SendInput, the mouse and keyboard would be undetectable because the above hooks only have the LLMHF_INJECTED and the LLMHF_LOWER_IL_INJECTED flags set if using SendInput. I never got it to trigger with keybd_event and mouse_event; only SendInput and Post/SendMessage.

I actually recall reading that now that you mention it. Yeah, we could probably switch to keybd_event and mouse_event instead of SendInput. Isn't much work at all, but since they say the hook is only utilized in fullscreen mode, there is no need to worry just yet, unless you / or someone else falsify that "claim"/prove it to always be used.

Sorry I'm just now showing up for this discussion, there's a few posts I'd like to reply to.

From: The Mayor
Well I haven't been banned since 2013, and I've been running scripts quite a bit recently. Sometimes 2-3 days straight. I'd say they are not detecting Simba/SMART, they are detecting your script. Scripts that were once undetectable might now be detectable.

People always blame the client yet overlook the most obvious answer.

Yes it could be simply the scripts are being detected, that's always a possibility. My main account was banned recently (just a minor 14-day ban) and I had it running a private runecrafting script in OSRS. My backup account was banned the next day while running a simple pickpocketer, also custom and never publicly released. The runecrafter utilized AL with reflection-based walking, the pickpocketer was only color. That reduces my theories of detection to: A) SMART, B) Simba, C) IP, D) Script-detection. D is hard to believe as that single script carried me from 55 to 94 Runecrafting in a matter of time but the pickpocketer could have possibly been detected as it was low-quality. C is worth considering but as Brandon argues against it I would agree, he's usually right in his opinions and if he says it's not a likely cause, I believe him.

Some other info, not too long before my main account was banned I had ran the script over night as well, naturally taking breaks every X amount of hours. So another theory could be when my main account was banned, possibly for excessive gameplay, they might have flagged my IP and heavily monitored my backup account and it's low quality thieving script. I did notice on both accounts, before the bans occurred, I had more random events than normal. I noticed they became more frequent and took note of it.

From: Brotein
As far as I'm concerned a lot of bans are manual from JMods.

Both of my bans were automatic, I had never had a run-in with a JMod before.

From: slacky
The IP of banned accounts could be stored as a "hint" for the Anti-Bot system (for a certain amount of time), like: "Keep an extra eye on users with this IP", so the anti-bot system can set higher priority (more in depth check) on other accounts under the same IP where bots previously has been detected.

I've not seen anything saying they don't do this.. And considering there seems to be _some_ hints towards "multi-ban" of accounts under the same IP I would not exclude as a possibility.

This makes a lot of sense and I personally believe it's the case, given what's happened to me recently.

From: Wetish
Are you buying membership using bonds? Everytime I get membership using bonds the account gets banned. When I pay using PayPal nothing happens.

My main account is on a recurring membership but I recently bought a few months via Bonds in RS3. My backup account, who was also banned, had paid via PayPal. It's enough evidence that I doubt bans would be connected to purchasing Bonds or not, but again it's just my own theory.

From: Clarity
I really, really would like to see this happen. I think the work would be well worth it.

I agree completely and would also support this. You usually have a great state-of-mind when it comes to remaining undetected and clearly that's not changed. As always I enjoy seeing people thinking ahead like this.

From: slacky
I actually recall reading that now that you mention it. Yeah, we could probably switch to keybd_event and mouse_event instead of SendInput. Isn't much work at all, but since they say the hook is only utilized in fullscreen mode, there is no need to worry just yet, unless you / or someone else falsify that "claim"/prove it to always be used.

Is there really any reason not to do this? If there's no possible issues of making the switch then I can't see why not.

From: Flight
My main account is on a recurring membership but I recently bought a few months via Bonds in RS3. My backup account, who was also banned, had paid via PayPal. It's enough evidence that I doubt bans would be connected to purchasing Bonds or not, but again it's just my own theory.

Every single account that I purchased membership using bonds has been banned (4 accounts). The money for the bonds has come from multiple different accounts. All of my accounts that have only used PayPal have not been banned (3 accounts). Except for one that got a 14 day ban because I forgot to clear my cache after suiciding 5 accounts with tribot. I may just be unlucky, but I should really stop using bonds.

From: Brandon
It'd roughly take up 3gb on their servers assuming it's stored as unsigned int and 6gb if it's a 64-bit unsigned long. And this assumes that all 1m players are under some suspicion to have their IP's logged. These are all assumptions btw.. but it's not that much actually. 6gb isn't too much.

I am probably doing something wrong:

64 bit = 8 byte
1 milion players * 8 byte = 8 milion byte = 8 MB?

Uhm can't they identify specific person by jagex cache stored on PC?


Anyway, I think that all those cases of chain-bans are not coincidence, so whatever method they use to identify owner and his other accounts they propably do. I can imagine how it works this way: If one of your account was banned for botting, they flag all your other accounts for a period of time. What I mean by 'flag' is putting them under "special care". So when they are online, Jagex in first priority checks if they are botting or not - either manually, semi-automatically or Jagex runs on them more complex and accurate botting detection system then usual.


In the situation when most scripters run 3 bots or more, for Jagex method of seeking for bots by accounts' owners seems to be naturally most efficient.

From: Brandon
Hmm.. well I didn't think the way you're thinking about it. As a "hint". But still.. I wonder why one would use a hint to ban the bots if they had to detect it in the first place. If they have the capability to detect it, they might as well ban it right off the bat rather than storing the IP which they later use to check if another account on the same IP is botting..

It doesn't make much sense storing the IP as a hint in my own opinion for the following scenario:

1. User is caught botting.
2. Store IP of user that was already caught with the anti-cheat system.
3. Second account logged in on the same IP.
4. Check if the account on that IP is botting..
5. Ban second account ONLY if it's a bot.
6. User changes IP.


Consider those steps. Why do step 3, when step 4 requires you to check if the second account is actually botting in the first place? If such a check is done every single time, there's no point to the IP. Skip it and just do the check in the first place.

I don't know.. It just seems like a waste. They have to have the tech to catch you in the first place so I can't see why they'd need the IP to catch you the second time around when that same tech has to be ran both times to confirm that you're botting both times.

The only way I could see it working as a hint is if the client "collects data" rather than detects.


Btw.. how come when you quote me, it only shows up on my profile but not in the post :S Only happens to your quotes.

I doubt they are regularly running one massive detection algorythm ( except some unique situation with certain outcome, like detection of bot client) . It's more efficient to have multi-level tests, starting from fast and rough methods to most advanced techniques. For example: on level 1 they analyse such data like fast expo gain, long session time… All selected 'candidates' goes to level 2, which focuses on mouse movements and keyboard input. Then all characters which suspicious mouse behavior are passed to level 3, which runs some complex analizes or maybe requests addiotional data from the client?

So this flagging procedure enables to jump over few steps, directly to most advance and also most costly (in the term of resources uses) methods.

I haven't botted all that much on all my toons recently, but haven't seen any bans. Just my little update

From: masterBB
I am probably doing something wrong:

64 bit = 8 byte
1 milion players * 8 byte = 8 milion byte = 8 MB?

You might be right… (1000000 * 4) / (1024 * 1024) and (1000000 * 8) / (1024 * 1024).

I messed up the units and the values.. great -_-

Im starting to think they are only banning scripts that are collecting something/ gold farming. Because the only script i got banned on was my log cutter and banker. And someone else said a bunch of people got banned on a miner and the honey comb script. I have been running 2 accounts simultaneously on the fighter i have made for days and still no ban. But i ran the log cutter for a few hours for 2 days and boom. insta ban.

So maybe they are looking at the players overall wealth and if it went up alot over some unrealistic amount of time collecting something. If it was just merching i dont think they would care. because thats different. You can do that all day. So i believe it is players overall wealth.

From: Flight
Is there really any reason not to do this? If there's no possible issues of making the switch then I can't see why not.

Agreed. Devs, can this be implemented? @Olly