Warcraft II Forum
Warcraft II => Server.War2.ru => Topic started by: BusyOrc on December 30, 2015, 03:02:22 PM
-
I was watching the flood happen last night and saw all the garbage names coming in.
One thing i noticed is, of all the garbage names, none reported antihack EXCEPT this one
vSyG4a9DxE7e1Nk
It reported AH: none, Country: ""
country was null...
Hoping to help catch him
It is interesting that the flood began shortly after "kurdran" and "thaydrad" were banned by Tora for "HACK!" status
Both accounts only played 3 games so its likely to be people who are already banned under their primary AKAs
and my thought is that the flood was retaliation for banning them
Also - the first account after the flood stopped that came on was "Evil`Ryu" with AH on and country=null
The last account I noticed that came on right before the flood started was "Dizaster" with AH on/USA
-
IDK, that sounds like a stretch but it's worth checking into :D Flood bots are usually associated with Archer. It wouldnt surprise me if one of those people turned out to be him if they were indeed responsible for the bots :)
-
Lance, it wasnt me I was at home in bed watching server status from my iphone when I saw it happen right before I was going to go to sleep, I even said in the other post "Anyone else watching server get flooded right now?" last night because I watched it happen
I know that you harassed me and tried to get me fired from my work IRL because you genuinely thought I was the flooder, but I'm not and wasnt then either
I dont even know how to automate account creation like that, connecting on the raw socket 6112, you can only log in, so I dont get how to make a script create an account, seriously...
But whatever
-
Also - the first account after the flood stopped that came on was "Evil`Ryu" with AH on and country=null
Nah that was me, just another bot profile I loaded to help clean war2bne channel.
Sent from my Motorola DynaTAC 8000X using Tapatalk
-
In the end Archer's load was weak, shitty bot/proxy cycling. Guy clearly still doesn't know how to load.
Sent from my Motorola DynaTAC 8000X using Tapatalk
-
Ban log from last night:
[03:51:34 AM] Info: Banned users: qPxM3f6VeK8h jCkZ4i3JnG7p7Or sWoY2k2TkP9f yFqW5v2LwX4 cQqK8a9PoQ3 aSoT8p7BpT1 qAxW7e1VlR7n rGwG4m0PrA fPcS8f3GtF cPvD8f6AlC tKmQ4y5LwR4i2 rQlO3j2CnQ2 dUsU9k6PbB eQxN3i4FfV1a8U pMkX5y1GvB1 xEvE7y7VoY8 xWzE4n3YtN fNeK6a3OmN7r
[03:51:34 AM] Info: aFhB5b9UcO4 bKkL7t3GoH2h eRbI0d6PlH sRnJ8b4XnR4v4 bEoS1r6WuO7 nFkB3r6DmO oLtM7y6QeO7g8 cWqA8o1ZfD8b qDdN8n3AjE eBtT2e1LuP8 jVyE9q5RpC6b eJrI2x9UmD5m1K oViU2m2ArR8h bZaY1d2KcT6a uDtM3b5BlS bCxN6m7ZwF1a sQuT8a6ImU rVaF2i1GtV oKdA2y3DaO gObE2z6CpQ
[03:51:34 AM] Info: fIdA5d0MqC4 mDfO6w2AtS rYhC7r9JyX5g4Y nHcB7v7NpP jThC4n2HqW lAoS3c8AbG7g5 mBuV4e8RjF8k6 yGuE1z6OlU eZiH8y6EnA sXeT6m3BiV4j9Hw lIvL8j4AnK7 nAtC5g3LoW1 qZaU6c5TiH7g jLoD9y0BmN3 wOaM5a8DuS2q1 lDsN3a1VjK9b9 nVxC7f5BrS4f eCwG7y2QcR wVxP8e2AsT3a7X tCsW2t2YaX7
[03:51:34 AM] Info: zQgM9w5IuX4n8 mLcV1m4ZuM7u bOlJ3c4MhM cTkJ2a7XtT lBhM3b7YjN4o jZaP8b5PrP bKdU2u5AhX2l8D sJnB7g4LwY7e5U mMhP4k5OiF nAqT7p3EtC5s5Ip oWsK5s6QvL7z5J pShB5v5UgG6 qLxP8g6VgQ6t1Xw rTrY8e7YvT4 sUrW4k1EbU jNsU2t4HvY8 jSbT5u5GyB3 wVoW4o0HvP1 rWpH5e2SuG
[03:51:34 AM] Info: eIiO4o6RiF3y tFyT9s3DiO3n2Qn xVqJ3g3NsG7 qChA4i2TuS2a kBhD4e4VjK9 fEpV5b4LhO jSvU2u2AhR5 iXbP1n9AqB6c5 zOrN4k3CtQ7s tQkD9e1VkY1a tOsW6f0YsA2p2E cRmP5z2LwW9p rCmW8x1LwA2y7Rb gRnE6m7ZcK6 xWxM5a4NtZ7h8W hYlC7o6LyE mDyA7h1PyH6x8 fPcF5r8JvR1g0B
[03:51:35 AM] Info: lYaM2f7RaL0s3P cAxH8o3XuN7q nRfM3a1VaT2u5 oUmY7m0OkX8g8 qNnF3p7TvS1y vMhW4e5DjD2k eNbB3l5GoU oCzH1j1NnR1k1O kHaL2k8YdN7b dNvG5m1LfJ6 aMyU9v7XsY4a8 jSyV7s0PkQ4r2 rMnJ1l1MwX0o fCvY2c4KsR4 oVuU4j7FsZ9l5N rKaL6r9AlS7 vLkV7v1GmL3c uQrI3f1WhI1h2 zAuX4z6XqX9b
[03:51:35 AM] Info: oZpQ3a6YnT dQnY6l6UnH2i6 gLeF4o2PfD8r7V zLyH9i8BcK hGjQ2a9YuF3d5T dUjF5b3PnK2j jAuH3b3NhX hDhT1n3BrP5i rFbC8b7MjB zItW1w2LwT8 aAcH2a5CdO1g7 mClE5s5YqW8 kAzL1t1XqB bIbI4s5NuR8u8J wHpP2q8DlE4 uAdE3n8MjU4e yTpP4t5DdM tIzK5k5JcO6 hTjI8r4AwG8w pSqB4l9VlV9r8
[03:51:35 AM] Info: zIqJ4y1TjV8 sIqV5u5VdD0 gNqB4b6CwS8 qRjJ1w1AnV8a1 sXxX4o8VtA8i5 iGeV4i2NdA4a zAmI4i2KnE5u sLjA3e6CrP8f iUwI6c1RlG1 aYzA1y5EsV1m aVrL2r9FjF cAgE8c4GzH zSyL4g5MpA tClM9i6LkV kPwJ4b8PpL dCbU3a6XxT6p nMbX1d4EfF3m3 wJwL4l1GwZ4 uDdB1e5CdA3 sKtG3j5GpW3h
[03:51:35 AM] Info: yMiC2s1FyR7i lPxQ2a0SsJ vErA2y3BqV kNqA8k0SuD6 aQcQ7l7NtE qRyK3k2MdR kPjK8a1AyA2 oWwC7f6RpY7v tUyF2g6TdW8k jMnP6l3RgW bXtO1i1TtH iEaB8n7AmH2 aCzV3x6JaR2 qXvL5l6QuL5p6 mFwT7t3WfK5q6 oSrX9q8VfG yRwQ1y9LtV5k xDwK8s9YjR3 oAbT9i3AfV gVrZ1x0DtF vSmH2y3GeN6w
[03:51:35 AM] Info: fBgO7l1XsU6y tCoK7f1IdB4 ePbG7b5XhU uJhX4n8AoV4 lKmS7o7VcR4 mVeY3a1IaG4 fSyB0p4FyZ5 uWzB5q9HcS uOoV7j5OfM uPjI0x6FzU7e dDlC6n0OhM9 hSsH9s8MlG9 jLnQ4q3JlB6 kStK7u1LeU qQkK8a3NrI8p1 wDdQ4b3TlU6 xBkO8g6KnY rAwK2d1RkA kReA9c2XuX7i7 aYwJ1a2KcM0 yHfJ7d4NvB
[03:51:35 AM] Info: wEjJ2f2DlJ eChC4s7FrI5 bVhI8f5JmD8m yJeV5k4KxJ oCbH0e2FjW1a5B dJaK1r8AfB2v mKwQ0r4QmI9 mAdG4m0JuI6l sJrQ8p1VqD tUsA5s2OaP4h5V xVtM2i5OyD8p aXkG6k4EkK4 kMdB1i3ZdC2 mMaX1v5VeN8y gFwW2e4VwJ2h kNkA9v0OiZ xXcH4f8IcA cLpA2k4LkX2p zScS0t4TwK4 mAxK6v3CmH
[03:51:35 AM] Info: kBbA2u5EoL eVnK8u3EwT5a fSeH8w4HoB4r sKsH7o7DhW nElQ5h2EnR3 mDzT3t8AlV1 dPrT6k6QfT xFnE8w1DvL1f8 sAnK2w5TfD3 wQzO3b5QlE3 gPpE0v2TwN6 xXqK5o6YaJ0g kKkS4q6KqW bKyR1j7BhK qToX3s2CjK2t gGsI3w4WtC8 mYpO0q9ViN9 mBoA1n8EeQ1e rKmT5p4WgN3 oBwR8c7LkM4m bLcB6f5GgM
[03:51:35 AM] Info: hQuT7k4ByV kYcG7p3EbT2 zPuQ2m1XxU1v rVaF5r6NgD6o8 zOcV8i0CyN4b6Uu tCyV8v2LsQ7m zHcK0v0XhV1p eLhT2e6PhQ1q aBlJ7o8BaL1 rWuR9y4LoE2l5 cHzU3h1TeZ1j2S mNvX6q5BaQ6b3T aJrJ4m1XwV1e cXoL3n4UjB2h2 qLeO8v2QqO2y3Y cObB6f1UpH2b0W mRqN2l4IlF7 kGvI6e5OrB7i3Tm
[03:51:35 AM] Info: cLfO5v3XcP3 oGmF6d6GyA5 kTaG4g4UaK2x eAqX3a5EsI6d nSaW4a6EiL dOkT1t2FnR2 bMwD0t3OpP1m7Dx iIeF7s2RkA5x5D xVxD4v1JeD7 kUdH0f2JdJ1o4J mEwU5q4EkX9p0J kWvU7e1FlI zJoF4n0JvG lQrH6r9JeI2w6 oTeO2c6CpD4 dUbZ7k6CnO9 uKgO4b6HvP oDpN6x7SuR8q1M sKqT6o5XgC3
Sent from my Motorola DynaTAC 8000X using Tapatalk
-
In the end Archer's load was weak, shitty bot/proxy cycling. Guy clearly still doesn't know how to load.
Sent from my Motorola DynaTAC 8000X using Tapatalk
I didnt do it, I started this thread to try to figure out who it is and clear my name.
Some more info about the attack from my login tracking database
It occurred between 2015-12-30 05:21:02 - 2015-12-30 05:40:03 UTC
Lasted about 20minutes, (thanks to ryu's bot anti-flood protection? Dont you have to be an admin to ip ban?? How does that work?)
between 800-900 garbage accounts were created
Anyways,
Here is a list of players who logged on DURING the attack:
NAME // LOGIN TIME (UTC) // LOGOUT TIME // DURATION // SERVER
SerJRODtheBOLD 2015-12-30 05:40:02 2015-12-30 07:14:02 94 server.war2.ru
edit 41725 B@tMan 2015-12-30 05:38:01 2015-12-30 06:11:02 33 server.war2.ru
edit 41680 EviL~Ryu 2015-12-30 05:35:01 2015-12-30 12:03:17 388 server.war2.ru
edit 41666 ~PeterGryphon 2015-12-30 05:34:02 2015-12-30 06:18:02 44 server.war2.ru
edit 41489 kade 2015-12-30 05:31:02 2015-12-30 05:34:03 3 server.war2.ru
edit 41302 00Tony 2015-12-30 05:30:02 2015-12-30 07:46:01 135 server.war2.ru
edit 41301 Teaboy 2015-12-30 05:27:01 2015-12-30 06:33:02 66 server.war2.ru
edit 41300 tk[AS] 2015-12-30 05:26:02 2015-12-30 06:20:02 54 server.war2.ru
edit 41299 851211
Here is a list of players who logged on within 1hr before/after the attack:
edit 41742 SinCityPlayer 2015-12-30 06:34:02 2015-12-30 08:51:02 137 server.war2.ru
edit 41741 Day`AM 2015-12-30 06:23:01 2015-12-30 07:54:02 91 server.war2.ru
edit 41740 tk[high] 2015-12-30 06:20:02 2015-12-30 09:04:01 163 server.war2.ru
edit 41739 Snow[iS] 2015-12-30 06:20:02 2015-12-30 08:19:01 118 server.war2.ru
edit 41738 Spleaneater 2015-12-30 06:19:02 2015-12-30 06:20:02 1 server.war2.ru
edit 41737 moregravy 2015-12-30 06:18:02 2015-12-30 06:43:01 24 server.war2.ru
edit 41736 EF_GameBot 2015-12-30 06:17:01 2015-12-30 06:43:01 26 server.war2.ru
edit 41735 ZekeKaido 2015-12-30 06:14:01 2015-12-30 06:17:01 3 server.war2.ru
edit 41734 Martin-18 2015-12-30 06:03:02 2015-12-30 07:18:02 75 server.war2.ru
edit 41733 Diablo 2015-12-30 06:03:02 2015-12-30 06:26:02 23 server.war2.ru
edit 41732 Masa 2015-12-30 05:57:02 2015-12-30 07:25:02 88 server.war2.ru
edit 41731 EviL~TuPaC 2015-12-30 05:53:02 2015-12-30 06:07:01 13 server.war2.ru
edit 41730 Evil~Korn 2015-12-30 05:52:02 2015-12-30 08:20:01 147 server.war2.ru
edit 41729 media 2015-12-30 05:46:02 2015-12-30 06:38:01 51 server.war2.ru
edit 41728 LoneTiger 2015-12-30 05:45:01 2015-12-30 07:13:01 88 server.war2.ru
edit 41727 EviL`Ryu 2015-12-30 05:41:01 2015-12-30 09:04:01 203 server.war2.ru
edit 41726 SerJRODtheBOLD 2015-12-30 05:40:02 2015-12-30 07:14:02 94 server.war2.ru
edit 41725 B@tMan 2015-12-30 05:38:01 2015-12-30 06:11:02 33 server.war2.ru
edit 41680 EviL~Ryu 2015-12-30 05:35:01 2015-12-30 12:03:17 388 server.war2.ru
edit 41666 ~PeterGryphon 2015-12-30 05:34:02 2015-12-30 06:18:02 44 server.war2.ru
edit 41489 kade 2015-12-30 05:31:02 2015-12-30 05:34:03 3 server.war2.ru
edit 41302 00Tony 2015-12-30 05:30:02 2015-12-30 07:46:01 135 server.war2.ru
edit 41301 Teaboy 2015-12-30 05:27:01 2015-12-30 06:33:02 66 server.war2.ru
edit 41300 tk[AS] 2015-12-30 05:26:02 2015-12-30 06:20:02 54 server.war2.ru
edit 41299 851211 2015-12-30 05:25:01 2015-12-30 06:48:02 83 server.war2.ru
edit 41165 ~$liCk~ 2015-12-30 05:13:02 2015-12-30 06:08:02 55 server.war2.ru
edit 41164 {Lance} 2015-12-30 05:13:02 2015-12-30 06:36:01 82 server.war2.ru
edit 41163 www.ClanEviL.tk (http://www.ClanEviL.tk) 2015-12-30 05:13:02 2015-12-30 06:48:02 95 server.war2.ru
edit 41162 thaydrad 2015-12-30 05:13:02 2015-12-30 06:17:01 63 server.war2.ru
edit 41161 ryu 2015-12-30 05:13:02 2015-12-30 12:03:18 410 server.war2.ru
edit 41160 rogershah 2015-12-30 05:13:02 2015-12-30 05:27:03 14 server.war2.ru
edit 41159 kurdran 2015-12-30 05:13:02 2015-12-30 06:17:01 63 server.war2.ru
edit 41158 jimknight 2015-12-30 05:13:02 2015-12-30 05:35:03 22 server.war2.ru
edit 41154 boob 2015-12-30 05:13:02 2015-12-30 09:13:03 240 server.war2.ru
edit 41153 ^sfc^LunatiC^ 2015-12-30 05:13:02 2015-12-30 09:13:03 240 server.war2.ru
edit 41145 YouTube 2015-12-30 05:13:02 2015-12-30 12:03:18 410 server.war2.ru
edit 41119 Warcraft 2015-12-30 05:13:02 2015-12-30 12:03:18 410 server.war2.ru
edit 41118 WarBandit 2015-12-30 05:13:02 2015-12-30 06:46:02 93 server.war2.ru
edit 41105 ViEt^Pr() 2015-12-30 05:13:02 2015-12-30 09:13:03 240 server.war2.ru
edit 41085 Trivia 2015-12-30 05:13:02 2015-12-30 12:03:18 410 server.war2.ru
edit 41084 Tom[nA] 2015-12-30 05:13:02 2015-12-30 05:30:02 17 server.war2.ru
edit 41073 SmartPeon 2015-12-30 05:13:02 2015-12-30 07:43:01 149 server.war2.ru
edit 41072 SilentBLaZzE 2015-12-30 05:13:02 2015-12-30 09:13:02 240 server.war2.ru
edit 41052 Russian 2015-12-30 05:13:02 2015-12-30 05:29:02 16 server.war2.ru
edit 41008 Onno[iS] 2015-12-30 05:13:02 2015-12-30 07:06:01 112 server.war2.ru
edit 40991 Noise 2015-12-30 05:13:02 2015-12-30 07:27:02 134 server.war2.ru
edit 40974 MANOWAR 2015-12-30 05:13:02 2015-12-30 12:03:17 410 server.war2.ru
edit 40961 KoRe 2015-12-30 05:13:02 2015-12-30 05:31:02 18 server.war2.ru
edit 40960 Kildaroch 2015-12-30 05:13:02 2015-12-30 06:39:01 85 server.war2.ru
edit 40924 He-Man 2015-12-30 05:13:02 2015-12-30 05:22:01 8 server.war2.ru
edit 40913 False_Flag 2015-12-30 05:13:02 2015-12-30 05:35:02 22 server.war2.ru
edit 40900 Evil 2015-12-30 05:13:02 2015-12-30 12:03:17 410 server.war2.ru
edit 40899 EviL~TuPaC 2015-12-30 05:13:02 2015-12-30 05:50:02 37 server.war2.ru
edit 40898 EviL~Ryu 2015-12-30 05:13:02 2015-12-30 05:34:02 21 server.war2.ru
edit 40884 EF_Hostbot 2015-12-30 05:13:02 2015-12-30 12:03:17 410 server.war2.ru
edit 40883 EF_GameBot 2015-12-30 05:13:02 2015-12-30 06:16:02 63 server.war2.ru
edit 40878 Diablo 2015-12-30 05:13:02 2015-12-30 05:18:02 5 server.war2.ru
edit 40877 DeathKnight~ 2015-12-30 05:13:02 2015-12-30 06:35:01 81 server.war2.ru
edit 40842 Are$ 2015-12-30 05:13:01 2015-12-30 05:22:01 9 server.war2.ru
edit 40829 930429 2015-12-30 05:13:01 2015-12-30 06:48:02 95 server.war2.ru
edit 40828 851211 2015-12-30 05:13:01 2015-12-30 05:24:08 11 server.war2.ru
edit 40827 00Ryan 2015-12-30 05:13:01 2015-12-30 06:27:01 74 server.war2.ru
edit 40826 00Kyle 2015-12-30 05:13:01 2015-12-30 09:13:02 240 server.war2.ru
edit 40825 00Joe 2015-12-30 05:13:01 2015-12-30 05:22:01 9 server.war2.ru
edit 40824 -{ViR@L}- 2015-12-30 05:13:01 2015-12-30 06:59:01 106 server.war2.ru
edit 40617 AQGB5Y4GGH7P6KA 2015-12-30 05:12:02 2015-12-30 05:21:02 9 server.war2.ru
edit 40616 AMIN9O7REJ 2015-12-30 05:12:02 2015-12-30 05:21:01 8 server.war2.ru
edit 40615 spill.matt 2015-12-30 05:07:01 2015-12-30 05:08:01 1 server.war2.ru
edit 40614 DeathKnight~ 2015-12-30 05:03:01 2015-12-30 06:35:01 92 server.war2.ru
edit 40613 ViEt^Pr() 2015-12-30 04:58:02 2015-12-30 09:13:03 255 server.war2.ru
edit 40612 Onno[iS] 2015-12-30 04:58:02 2015-12-30 07:06:01 127 server.war2.ru
edit 40611 SmartPeon 2015-12-30 04:57:02 2015-12-30 07:43:01 165 server.war2.ru
edit 40610 EF_GameBot 2015-12-30 04:57:02 2015-12-30 06:16:02 79 server.war2.ru
edit 40609 Diablo 2015-12-30 04:50:02 2015-12-30 05:18:02 28 server.war2.ru
edit 40608 DiZaStEr 2015-12-30 04:50:02 2015-12-30 04:57:02 7 server.war2.ru
edit 40607 00Ryan 2015-12-30 04:50:02 2015-12-30 06:27:01 96 server.war2.ru
edit 40606 EF_GameBot 2015-12-30 04:47:01 2015-12-30 04:56:01 9 server.war2.ru
edit 40605 rogershah 2015-12-30 04:45:02 2015-12-30 05:27:03 42 server.war2.ru
edit 40604 Snow[iS] 2015-12-30 04:44:02 2015-12-30 04:55:02 11 server.war2.ru
edit 40603 boob 2015-12-30 04:37:02 2015-12-30 09:13:03 276 server.war2.ru
edit 40602 thaydrad 2015-12-30 04:36:01 2015-12-30 06:17:01 101 server.war2.ru
edit 40601 kurdran 2015-12-30 04:35:01 2015-12-30 06:17:01 102 server.war2.ru
edit 40600 iPEONu 2015-12-30 04:35:01 2015-12-30 05:08:01 33 server.war2.ru
edit 40599 False_Flag 2015-12-30 04:33:02 2015-12-30 05:35:02 62 server.war2.ru
edit 40598 930429 2015-12-30 04:30:01 2015-12-30 06:48:02 138 server.war2.ru
edit 40597 851211 2015-12-30 04:30:01 2015-12-30 05:24:08 54 server.war2.ru
edit 40596 SilentBLaZzE 2015-12-30 04:29:02 2015-12-30 09:13:02 284 server.war2.ru
edit 40595 -{ViR@L}- 2015-12-30 04:24:02 2015-12-30 06:59:01 154 server.war2.ru
I'm not accusing anyone on either list, but it is likely that the suspect is on one of the lists. But it is also possible that the flooder did not log in on a real name before, during, or after the flood. But i would think that is unlikely...
Not sure if this information helps narrow suspects or just fuel the witch hunt even more ...
I think after iL finishes AntiHack RU should work on its own flood protection. CloudFlare and similar services do not provide protection from an attack like this, but I think we should be able to write our own, would be simpler than writing antihack i would think
-
Already in the works. iL is more proficient in PHP than c++ so I'm in the process of adding PHP as a script language that PVPGN can use in order to code things like that. Besides, it's a non-compiled language so it could be tinkered on easily while the server is running and not need any reboots to implement new features. This is how I modified my own war2.us server, all of it's modifications were via the phpEmbed project and much easier to maintain/implement. Many of the features we want to add do not require the threading capabilities of C/C++ so a script language makes sense to have. The newer PVPGN has something similar but it uses LUA which is a crap language compared to PHP. Once it's finished, PVPGN will have what I call a "hooks" system. Such as hook_pre_login(), hook_login(), hook_post_login(), etc where PHP can intervene in the process, send data back/forth, message people, run C++ functions from within PHP, run PHP functions from within C++, etc. Making a simple flood protection in PHP is easier/quicker than C++ and far more readable. Also, there is a larger pool of PHP developers than C++ so more people could contribute than what we currently have.
Besides, I like PHP more anyway when it comes to non-threading needs.
-
He already has a check revision ready to be setup from another former member here would solve that problem with bots.