How we got caught(no need for tinfoil hat)

[drogo]

Ok so im seeing a lot of theories as to how we get banned, blah blah blah,
This is how we got caught and why we don't get accs back.
They track the ip address of our d3 client and db through some sort of server side detection(18/12 ban). This had nothing to do with how much u played, how much u botted, how much u sold, what profile u used, how many games where created, ect ect ect. Im positive the issue was fixed with 295. But its all about who's bot is better, theirs or ours. Like hawker said, they have the element of suprise. They could have very well found a new server side detection system that they have been testing out for the last few weeks while conducting research and building cases against flagged accs.There will still be bans as always but it generally wont have anything to do with how u play the game, sometime u just get unlucky.

Im wondering if its possible to log into db from a diff ip/pc id and then onto d3 from a diff ip/pc, This way no db or d3 would ever be linked-----smart

Quote from hawker (We said at the time there might have been a packet that was used to track Demonbuddy users but didn't understand why it didn't get all Demonbuddy users)
yep i was right. nothing to do with how u played the game

 

[chinajade]

Im wondering if its possible to log into db from a diff ip and then onto d3 from a diff ip, Now that would be a sweet app and im sure it would confuse blizz staff, lol

Hi, Drogo,

Try it and see. You will find that Bliz detects a "change and behavior", and locks your account. You will then have to go to the website and reset your password to unlock it again.

This will happen the first few times you use a new IP address, until a 'new behavior pattern' is established.

And no, what IP, or how many IPs, you use makes no difference whatsoever in their bot-detection scheme, imho.

cheers,
chinajade

 

[drogo]

srry. what i meant was an app that could log into db from diff ip adress while still retaining your original d3 ip. So that the 2 dont correlate. this way for all intensive purposes db is in fact running from a totaly diff ip. Also i really do believe that blizz is using very superior detection sytem based more on Ips. They are a multi million $ company with leading edge tec that compares to the fbi (authenticator service for example) they can and do track ip, i know this as a fact, dont ask me how. They can track u to your house and tell u what adress and ph no u have if they wanted to.

 

[ezpwnd]

Lol, thanks for the amusement.

Why would running both DB and D3 from different IPs change anything?

 

[packetloss]

So..... what your saying is they are cross referencing ip addresses that are logged into the DB authentication server and banning any D3 accounts that are logged in on the same IP?

If this is so, what about universities or other situations where large groups of folks have the same IP?

 

[PainfulDeath]

My DB and D3 are always using different IPs (for another reason, not because I thought htey are doing something like this), yet I've lost 63 accounts so far. Don't bother with this theory.

 

[drogo]

My DB and D3 are always using different IPs (for another reason, not because I thought htey are doing something like this), yet I've lost 63 accounts so far. Don't bother with this theory.

Ok so u are saying that u run the db attatched to your d3 from diff ip and pc id?

 

[ezpwnd]

Ok so u are saying that u run the db attatched to your d3 from diff ip and pc id?

No. He said that he is using different IPs (and only that).

 

[aaron913]

i doubt they use IP in connection with detecting bots - imo

pretty sure its 99% used to determine if the account was compromised and to deter it with the lockout system

 

[drogo]

i doubt they use IP in connection with detecting bots - imo

pretty sure its 99% used to determine if the account was compromised and to deter it with the lockout system

Mkay. So i dun wanna be one of those nubs who claims he knows some Gm or someone high up ect ect. But i wanna tell yas about a friend of mine who created his own business, This business dealt with lowering ping for us aussie users for better raiding. He did very well from this venture and moved on to other things. One of these things was getting ppl glad mounts and arena rating that he charged them for. After an investigation all of his customers that he had lvld in arena got banned because they his tracked his ip adress. This is a fact. Srry to dishearten yas.

There was also a post from someone who fought tooth and nail to get his acc back from blizz. i for the life of me cant find the post but imo blizz released too much about thier detection to him. the post from them clearlytstated that they had correlated 3rd party software ip to his d3 client, ill try to find it and post link.

 

[drogo]

I also wanna point out that on the 18/12 banwave some ppl had only been botting for mere minutes/hours. No way for a movement/profile detection system to have goten them banned, Once again it falls to server side ip/ pc id detection sytem, U guys seriously think they dont have the tec to track ip add from multiple points back to its original pc/ip.

 

[skmoonlight]

I also wanna point out that on the 18/12 banwave some ppl had only been botting for mere minutes/hours. No way for a movement/profile detection system to have goten them banned, Once again it falls to server side ip/ pc id detection sytem, U guys seriously think they dont have the tec to track ip add from multiple points back to its original pc/ip.

I am not sure u are correct.
I have bought demonbuddy, but i use a other version where no auth server is needed (since the massive auth fail a long time back)
so i never logd on with my own ip, i got hit 2/2 during the big banwave

 

[tufani]

btw, any reason the demonbuddy ban reports forum is not viewable anymore? Can only view this since its the last topic.
I simply get directed here: http://www.thebuddyforum.com/forum.php
Is it because of the massive doom and gloom threads popping up all the time lately? If so, i totally understand

Honestly, i doubt blizz are all that you give them credit for Drogo.

 

[aaron913]

...One of these things was getting ppl glad mounts and arena rating that he charged them for. After an investigation all of his customers that he had lvld in arena got banned because they his tracked his ip adress....

There was also a post from someone who fought tooth and nail to get his acc back from blizz. i for the life of me cant find the post but imo blizz released too much about thier detection to him. the post from them clearlytstated that they had correlated 3rd party software ip to his d3 client, ill try to find it and post link.

Yea, assuming he played them, he logged into accounts that weren't his and/or they were 'sharing' their account (same level as botting - against ToS)

To the IP thing I think you were thinking of this http://www.thebuddyforum.com/demonb...-ban-reports/101804-my-time-bbb-blizzard.html . Separate statements about ip and software...

Personally I haven't/won't take any precautions regarding IP while botting/gold selling, even my legit accounts on the same (wow and d3, 1 legit of each, multiple bots on each, all same computer/ip for at least a year now) I even post here with same IP

btw, any reason the demonbuddy ban reports forum is not viewable anymore?

Demonbuddy Ban Reports works for me

 

[drogo]

Yea, assuming he played them, he logged into accounts that weren't his and/or they were 'sharing' their account (same level as botting - against ToS)

To the IP thing I think you were thinking of this http://www.thebuddyforum.com/demonb...-ban-reports/101804-my-time-bbb-blizzard.html . Separate statements about ip and software...

Personally I haven't/won't take any precautions regarding IP while botting/gold selling, even my legit accounts on the same (wow and d3, 1 legit of each, multiple bots on each, all same computer/ip for at least a year now) I even post here with same IP




Demonbuddy Ban Reports works for me

cheers mate

 

[drogo]

I am not sure u are correct.
I have bought demonbuddy, but i use a other version where no auth server is needed (since the massive auth fail a long time back)
so i never logd on with my own ip, i got hit 2/2 during the big banwave

wondering if u still get this happening even without auth

this is what i get when botting while blocking my ip

 

[drogo]

quote from hawker(We said at the time there might have been a packet that was used to track Demonbuddy users but didn't understand why it didn't get all Demonbuddy users). I am wondering if by blocking my ip so that the signal isnt intercepted i could perchance avoid future bans.
Program i used is called peer block if anyone is interested. i used it mainly for torrenting but i noticed many blocks while using the bot as shown in previous post

 

[Hawker]

Your heart is in the right place but the theory is wrong. Locking this as we have a thread for ban theories stickied.

Its worth saying; only a small minority of our users were banned on 18/12. We remain unsure what happened - the unexpected packet theory is credible but it doesn't explain why the majority of users had no bans.