*Possible* methods of bot detection

[Weird0]

There is noticeable lag here and there recently, with or without your CR, then I really doubt you are the only one, using CRs in raids, even in your group!

Plus, YRB2 is pretty nice CR too.

Coincidence or not, but I do not remember seen ban reports for using it and I read quite a few reports in the last week!

k then its just a weird coincidence.

yes i am fully aware of what has happened the past days/weeks with the 6 month spree but at this point if i am flagge i am flagged so whether i use it now or dont i wont make any difference there are only 2 things i can hope for.

1. this wont happen in the eu(because of different laws here that migh prohibit whatever they used to detect this which might involve scanning in a way that is simply not allowed here)
2. the flags were handed out on the day with the tripwire event to everyone that was online while it was happening because i was not online then.

i didnt got banned and i questbot and use enyo for my private routines but i do got banned quite alot 6 7 months ago.

you didnt get banned because this what is happening is currently only in the us and not in the eu

 

[Mario27]

k then its just a weird coincidence.

yes i am fully aware of what has happened the past days/weeks with the 6 month spree but at this point if i am flagge i am flagged so whether i use it now or dont i wont make any difference there are only 2 things i can hope for.

1. this wont happen in the eu(because of different laws here that migh prohibit whatever they used to detect this which might involve scanning in a way that is simply not allowed here)
2. the flags were handed out on the day with the tripwire event to everyone that was online while it was happening because i was not online then.





you didnt get banned because this what is happening is currently only in the us and not in the eu

this thing what now happening in the us was for 6 7 months back in eu i had like 6 7 8 accounts lost even when i made a trial account and quested to lvl 15 that got banned but now im fine when when my accounts where banned it was permantly i didnt even got a 3 days suspension or 6

 

[KayKay]

now that we have heard from the 60 people who were banned only using Enyo and a CR, i'd like to hear from the 19,940 people who didn't get banned.

1. Have never - and will never - use a farming/gathering/garrison/anything besides CR+enyo.
2. Chat output disabled
3. Healing, defensive, interrupts, movement, targeting, talents, burst disabled. Pretty much everything except core rotation.
4. I use Righteous for tanking, which afaik the devs hate using lua, so I'm pretty sure lua is kept to a minimum in the CR. (PS: It's only £5 on the shop and I haven't seen a single ban report using it ;P)
5. I was online during the tripwire, and I was kicked off. I logged back on after the tripwire and continued to raid by hand.
6. After HB was back up, I reopened it and continued using it for raid.
7. Since the bans started pouring in, I have not opened it since Tuesday. I even switched back to 64 bit.

I have not been banned. I used it for 9 hours a week.

 

[Lipstick]

1. Have never - and will never - use a farming/gathering/garrison/anything besides CR+enyo.
2. Chat output disabled
3. Healing, defensive, interrupts, movement, targeting, talents, burst disabled. Pretty much everything except core rotation.
4. I use Righteous for tanking, which afaik the devs hate using lua, so I'm pretty sure lua is kept to a minimum in the CR. (PS: It's only £5 on the shop and I haven't seen a single ban report using it ;P)
5. I was online during the tripwire, and I was kicked off. I logged back on after the tripwire and continued to raid by hand.
6. After HB was back up, I reopened it and continued using it for raid.
7. Since the bans started pouring in, I have not opened it since Tuesday. I even switched back to 64 bit.

I have not been banned. I used it for 9 hours a week.

EU or US? As far as I can tell almost all the 6m bans were issued in the US population. Maybe Obama passed a new law that gives big corporations rights to your computer. INB4 botting is illegal in the US and you all get hauled off to Guantanamo Bay; branded terrorists.

 

[KayKay]

EU or US? As far as I can tell almost all the 6m bans were issued in the US population. Maybe Obama passed a new law that gives big corporations rights to your computer. INB4 botting is illegal in the US and you all get hauled off to Guantanamo Bay; branded terrorists.

I am in the US.

 

[Res03]

I am in the US.

Have you used righteous since?

 

[air]

this thing what now happening in the us was for 6 7 months back in eu i had like 6 7 8 accounts lost even when i made a trial account and quested to lvl 15 that got banned but now im fine when when my accounts where banned it was permantly i didnt even got a 3 days suspension or 6

Question, as you already see in the title 6/13 account DC'D from server EXACTLY at the same time.

Than one more dc'd 10 seconds later. (7/13)

I personally logged them back in, is this just coincidence or purpose?
I immediately checked my mails, no pass change mail etc.

This got me scared quite abit. Has this happen to someone before?

Above message was written month ago (06.03.2015), and now his accounts banned. With high probability they have been marked at that time, i.e month ago. Why whey didnt banned rigth after that? Dont know.

As seen in ban section, blizz start fighting with multybot accounts on EU servers. Also, i think, even if multiple accounts dont link to 1, or run on different machines, or using VM, but whey are in one party - all of them will be spotted.

So, dont multybot - that is very risky right now.

OK, i think i got the point - they dont ban immediately to track more connected bots.

 

[ZoneHunter]

Above message was written month ago (06.03.2015), and now his accounts banned. With high probability they have been marked at that time, i.e month ago. Why whey didnt banned rigth after that? Dont know.

As seen in ban section, blizz start fighting with multybot accounts on EU servers. Also, i think, even if multiple accounts dont link to 1, or run on different machines, or using VM, but whey are in one party - all of them will be spotted.

So, dont multybot - that is very risky right now.

OK, i think i got the point - they dont ban immediately to track more connected bots.

Speculation:
They probably track it by payment method as this would be able to be completely automated by the payment api and would be very easy to flag(Ex: User x created 3 accounts over 1 week using paypal account name "paypal user name" flag user account for inspection). Doing all the fancy VM, IP, and other evasion methods would have absolutely no effect against this method. Once a user is flagged it will flag any additional accounts they make using that payment method automatically. The reason this would be so effective is most people only have one method of payment(Paypal or a credit/debit card)

Fact:
I have 5 bots that run heroics 24/7 normally and just to test the detect ability of this bot have recently leveled 10 toons(2 toons per account) from 1-100 over the last week. They did not stop even for a second from leveling. Yes, this was reckless botting behavior but the accounts have already paid for themselves so if it happens. It won't hurt if they take a hit(get banned)

They leveled using Questing bot(Kicks leveling pack from the buddy store 1-15) the rest they did straight dungeons.

Additionally:
They were all actively running a heroic dungeon during the tripwire event a full 5 bot team
I Reside in the US

If they do get banned I will post a reply in the ban section as a informer to all. As they were strictly in a bot group leveling from 15-100 and they were monitored 100% during the 1-15 leveling. Otherwise they only grind dungeons normally and nothing else never in sight of the public. They use repair bots to do their vendoring/repairs every 4 hours within the dungeons. That has been their usage ever since glider and will remain to be their usage until the day they get banned.

 

[gamerhead]

IMO I think everything we are getting banned for it to random. If the bot was being detected everyone would be getting banned no matter what they were doing. I was online when the tripwire hit, using Enyo and king WOW and that account has not been banned. As soon as hb was updated I was back to using it. All I did was log back in and finish raid. Than my two farm accounts that were not on for the tripwire got banned while duengon farming for gold. To me it seems they are hitting accounts that are performing repetitive tasks.

 

[tia1979]

Speculation:
They probably track it by payment method as this would be able to be completely automated by the payment api and would be very easy to flag(Ex: User x created 3 accounts over 1 week using paypal account name "paypal user name" flag user account for inspection). Doing all the fancy VM, IP, and other evasion methods would have absolutely no effect against this method. Once a user is flagged it will flag any additional accounts they make using that payment method automatically. The reason this would be so effective is most people only have one method of payment(Paypal or a credit/debit card)

Fact:
I have 5 bots that run heroics 24/7 normally and just to test the detect ability of this bot have recently leveled 10 toons(2 toons per account) from 1-100 over the last week. They did not stop even for a second from leveling. Yes, this was reckless botting behavior but the accounts have already paid for themselves so if it happens. It won't hurt if they take a hit(get banned)

They leveled using Questing bot(Kicks leveling pack from the buddy store 1-15) the rest they did straight dungeons.

Additionally:
They were all actively running a heroic dungeon during the tripwire event a full 5 bot team
I Reside in the US

If they do get banned I will post a reply in the ban section as a informer to all. As they were strictly in a bot group leveling from 15-100 and they were monitored 100% during the 1-15 leveling. Otherwise they only grind dungeons normally and nothing else never in sight of the public. They use repair bots to do their vendoring/repairs every 4 hours within the dungeons. That has been their usage ever since glider and will remain to be their usage until the day they get banned.

Reckless botting don't help with this speculation. You are just going down a lane where we know you will be banned, you dont prove anything but stupidity.

 

[ZoneHunter]

Reckless botting don't help with this speculation. You are just going down a lane where we know you will be banned, you dont prove anything but stupidity.

Actually, That's their normal routine they've been doing it since glider. I simply stated reckless because i Know someone was gonna whine about that fact(like you did anyways). I Don't consider it reckless in closed context (Dungeons/Instances where no one else is at except my bots). I am aware that many of you hear 12+ Hours and think OMG ya hes gonna be toasted because that's the mentality of this place not factual based on my personal experience when done right. As of today their still happily ticking along making me gold constantly. I was simply testing the automation detection part as they never stay in the public view of anyone ever(Exempting the 1-15 part which was extremely brief with the full boa and 100% monitored). Now being stupid on the other hand and leaving a bot in a field like 24 hours every day ya your gonna get banned from player reports but thats your own stupidity. I can't defend that and I Definitely wont test that.

This simply tested the following:
Online time detect ability (if there was a filter banning people on how long they were online. as they ended up being online around 2.9 days straight a piece leveling)
CRs (The HB Core CR routines built into the bot)(If they were banning based off filtering specific CRs)
Movement Routines (To test if they had tagged certain movement habits in dungeons or questing(1-15)
And anything else dungeon buddy, questing botbase, and HB Uses as a part of the core bot.