How rust admins detect scripts
How rust admins detect scripts
In the past, I have made recoil scripts for rust. Those scripts earned me a game ban, so I did what most caught cheaters do and get a new copy of the game only to slowly be banned from servers by server admins for having a game banned account. However, I am curious by nature, so I embarked on a journey to discover how the world works on the other side of the rust scripting fence. I was due for a gaming rig upgrade, which meant I had a new hardware ID. I also bought a reasonably convincing steam profile with rust on it.
This was just over a year ago now, and since then, I have moved from smaller servers to what I would call tier 1 community and modded servers where I hold senior admin positions. So I am well placed to explain how server admins detect cheating players and, more importantly, players who have cheated in the past. Anecdotally, the admin world is filled with people who have something to prove. The ego and power trips run rampant. I have personally witnessed server owners DDOS other server owners on force wipe to take their pop. All these servers say they work together, but they will knife each other when it comes down to it. This is humorous because if we jump to the cheater side of the fence for a moment, you will find the complete opposite and far more cohesion and unity. I was given a rare insight into an exclusive ******* call RSO (Rust Server Owners) actively withholding information on fixing specific issues with the game from other owners and admins but bragging about fixing it on their servers. This ******* has facepunch employees in it and the owners of virtually every major server worth talking about.
Anyway, on to how it all works, the first important thing to know about is hardware ids. Server admins do not have them. There could be some examples with the larger server groups like Rustified that could access HIDs, but the overwhelming majority do not have access to this information. There are two major ways server admins detect previous cheaters; IP address and in-game names.
The biggest one here is the IP address. Every server worth talking about uses a system called battlemetrics, which will track every player that joins the server. It will save the IP address you connect on and show the admin all the other players that have joined that server on the same IP address. They can see how long ago each player used the IP address and a proxy IP. If you're sitting there thinking that you can just play on a new server you have never played on before to bypass this, then you're mistaken as most senior admins and server owners share read access to each other's servers. This means that if you play on a server with one account, then log into a separate account and join a different server and those two servers share data. Then the accounts will be permanently linked within battlemetrics for those admins to see.
Personally, I have read access to over 30 different servers, but I have seen other admins with read access to over 100. This is where certain tools come into play with ******* bots that are connected to admins accounts that allow other admins to see if a steam ID is attached to any other accounts. There is one big player here, and that is the R.A.I.D ******* bot which has come about after the recent merger of two bots, bomb's alts and metzey's admin tools. Admins who have access to this private ******* and bot can instantaneously query a giant pool of servers and databases and return all known matched accounts.
Battlemetrics also keeps a record of every name you use on a connected rust server. Even if you clear your aliases in steam, their records are not deleted. This allows admins to compare your previous names and look to see if both accounts have used the same name or variants of the same name. Jump back to the R.A.I.D *******, and the bot will do this for you automatically. Just give it two steam IDs, and it will show you names that match.
Admins will also look at steam accounts for other similarities such as avatars, steam groups and friends to help figure out if two accounts are owned by the same person.
Using this knowledge, you are able to play rust after a game ban and not be detected by admins by simply:
Use an IP address that is frequently circulated. The more people that use the IP address, the more likely you will go undetected. The best IP's for this are either mobile IPs when you tether your cell phone or VPN IPs.
Never use the same name or even anything similar. Make them as different as possible.
Make the steam profiles look as different as possible. Avoid using the same avatar, having the same friends and in the same steam groups.
More experienced admins will also be able to tell if you have bought your account. They do this by looking at the servers you have played on in the past. So if an account has spent 3 months playing Russian servers, then suddenly playing here on US servers, then it's a great indication that the account was bought, so try and purchase accounts from the same region as you.
The final point I want to touch on is how admins determine if a player is using scripts in the first place. The short answer is they don't, and it's all opinion based. There are a few tools out there like arkan, which will notify admins of players who have tight sprays but then it's up to the admins to ban or not. If you are writing scripts and coding your recoil pattern to be exactly the same every time, then you are going to be banned as arkan will detect that. To bypass arkan, all you need to do is incorporate a large amount of movement in the recoil once every 5 shots as the plugin only alert on shot groups that have low recoil and are over 5 shots.
One final word of warning to people joining ******* servers associated with scripts, these servers are being actively monitored by the admin community. They have "scripter" accounts in all of these *******s that regularly document who is in these *******s and at what rank. Admins can then use tools like R.A.I.D to search for players ******* IDs to see if they are in any of the *******s. So if you are going to join these *******s do it on an alt account and if you own one of these *******s, stop promoting players to ranks showing that they have bought your scripts. It is getting them banned. Also, try and figure out which of the users in your ******* is the R.A.I.D bot and ban it so it can't scrape your user list anymore.
I will continue to be an admin and script on my alt account and very possibly do more posts like this in the future about other parts of the admin world of rust.
This was just over a year ago now, and since then, I have moved from smaller servers to what I would call tier 1 community and modded servers where I hold senior admin positions. So I am well placed to explain how server admins detect cheating players and, more importantly, players who have cheated in the past. Anecdotally, the admin world is filled with people who have something to prove. The ego and power trips run rampant. I have personally witnessed server owners DDOS other server owners on force wipe to take their pop. All these servers say they work together, but they will knife each other when it comes down to it. This is humorous because if we jump to the cheater side of the fence for a moment, you will find the complete opposite and far more cohesion and unity. I was given a rare insight into an exclusive ******* call RSO (Rust Server Owners) actively withholding information on fixing specific issues with the game from other owners and admins but bragging about fixing it on their servers. This ******* has facepunch employees in it and the owners of virtually every major server worth talking about.
Anyway, on to how it all works, the first important thing to know about is hardware ids. Server admins do not have them. There could be some examples with the larger server groups like Rustified that could access HIDs, but the overwhelming majority do not have access to this information. There are two major ways server admins detect previous cheaters; IP address and in-game names.
The biggest one here is the IP address. Every server worth talking about uses a system called battlemetrics, which will track every player that joins the server. It will save the IP address you connect on and show the admin all the other players that have joined that server on the same IP address. They can see how long ago each player used the IP address and a proxy IP. If you're sitting there thinking that you can just play on a new server you have never played on before to bypass this, then you're mistaken as most senior admins and server owners share read access to each other's servers. This means that if you play on a server with one account, then log into a separate account and join a different server and those two servers share data. Then the accounts will be permanently linked within battlemetrics for those admins to see.
Personally, I have read access to over 30 different servers, but I have seen other admins with read access to over 100. This is where certain tools come into play with ******* bots that are connected to admins accounts that allow other admins to see if a steam ID is attached to any other accounts. There is one big player here, and that is the R.A.I.D ******* bot which has come about after the recent merger of two bots, bomb's alts and metzey's admin tools. Admins who have access to this private ******* and bot can instantaneously query a giant pool of servers and databases and return all known matched accounts.
Battlemetrics also keeps a record of every name you use on a connected rust server. Even if you clear your aliases in steam, their records are not deleted. This allows admins to compare your previous names and look to see if both accounts have used the same name or variants of the same name. Jump back to the R.A.I.D *******, and the bot will do this for you automatically. Just give it two steam IDs, and it will show you names that match.
Admins will also look at steam accounts for other similarities such as avatars, steam groups and friends to help figure out if two accounts are owned by the same person.
Using this knowledge, you are able to play rust after a game ban and not be detected by admins by simply:
Use an IP address that is frequently circulated. The more people that use the IP address, the more likely you will go undetected. The best IP's for this are either mobile IPs when you tether your cell phone or VPN IPs.
Never use the same name or even anything similar. Make them as different as possible.
Make the steam profiles look as different as possible. Avoid using the same avatar, having the same friends and in the same steam groups.
More experienced admins will also be able to tell if you have bought your account. They do this by looking at the servers you have played on in the past. So if an account has spent 3 months playing Russian servers, then suddenly playing here on US servers, then it's a great indication that the account was bought, so try and purchase accounts from the same region as you.
The final point I want to touch on is how admins determine if a player is using scripts in the first place. The short answer is they don't, and it's all opinion based. There are a few tools out there like arkan, which will notify admins of players who have tight sprays but then it's up to the admins to ban or not. If you are writing scripts and coding your recoil pattern to be exactly the same every time, then you are going to be banned as arkan will detect that. To bypass arkan, all you need to do is incorporate a large amount of movement in the recoil once every 5 shots as the plugin only alert on shot groups that have low recoil and are over 5 shots.
One final word of warning to people joining ******* servers associated with scripts, these servers are being actively monitored by the admin community. They have "scripter" accounts in all of these *******s that regularly document who is in these *******s and at what rank. Admins can then use tools like R.A.I.D to search for players ******* IDs to see if they are in any of the *******s. So if you are going to join these *******s do it on an alt account and if you own one of these *******s, stop promoting players to ranks showing that they have bought your scripts. It is getting them banned. Also, try and figure out which of the users in your ******* is the R.A.I.D bot and ban it so it can't scrape your user list anymore.
I will continue to be an admin and script on my alt account and very possibly do more posts like this in the future about other parts of the admin world of rust.
Appreciate this post
Thankyou for posting this, helped me a lot actually!
