Cheat Detected: thesnake, Cipa-nie-dziala, NoName

[jitspoe]

Name used: Cipa-nie-dziala

IP: 85.14.84.6 = mirasoft-r.3s.pl

Cheat: ZGH

ID's matching IP:
72940   Tomcio
61159   [ETP]KLOMAR
59198   [ePL]WEZYK
12607   baty

Looks like it might be a shared IP, so I'm not sure which, if any, of these players was actually cheating.

[Okles]

Dammit, I hope Wezyk wasn't cheating, it's my clanmate and if he was cheating, he'll be deleted from the clan.

[iced]

Name used: Cipa-nie-dziala

IP: 85.14.84.6 = mirasoft-r.3s.pl

Cheat: ZGH

ID's matching IP:
72940   Tomcio
61159   [ETP]KLOMAR
59198   [ePL]WEZYK
12607   baty

Looks like it might be a shared IP, so I'm not sure which, if any, of these players was actually cheating.

if your not sure why ban them?

[jitspoe]

I simply listed all of the login ID's that were associated with that IP address.

[theSYNDIKATE]

Wow I thought he was good.

[Okles]

So what about this Wezyk?? U don't have any evidences, continue investigation when u have evidences.

[Laged]

Uh, ZGH is detected when used, proof enough?

[theSYNDIKATE]

So what about this Wezyk?? U don't have any evidences, continue investigation when u have evidences.

The evidence is the trace of the ZGH hack being used.

[jitspoe]

Name used: NoName

IPs:
5.83.19.110 = 5.83.19.110
172.16.2.85 = 172.16.2.85
85.14.95.36 = host85149536.mirasoft.3s.pl

Cheats:
ZGH
Modified client executable

ID matching IP: 59198   thesnake

[KnacK]

Very interesting...

Code: [Select]

IP address:                     5.83.19.110
Reverse DNS:                    [No reverse DNS entry per a.root-servers.net.]
Reverse DNS authenticity:       [Unknown]
ASN:                            0
ASN Name:                       IANA-RSVD-0
IP range connectivity:          0
Registrar (per ASN):            Unknown
Country (per IP registrar):     *R [[IANA Reserved]]
Country Currency:               Unknown
Country IP Range:               5.0.0.0 to 5.255.255.255
Country fraud profile:          Normal
City (per outside source):      Unknown
Country (per outside source):   -- []
Private (internal) IP?          Yes
IP address registrar:           whois.arin.net
Known Proxy?                    No

It appears to be a reserved ip address block.

[jitspoe]

Reserved for cheaters?

What about this one? 172.16.2.85

[KnacK]

172.16.x.x is reserved for private networks and is not used n the public domain. See my "other" post

[y00tz]

My "other" post said it first

[KnacK]

[DrRickDaglessMD]

5.x.x.x is commonly used by LogMeIn's Hamachi zero-config VPN software.

https://secure.logmein.com/products/hamachi/vpn.asp?lang=en

great product.

- Dag

[jitspoe]

Yeah, I've used Hamachi, and while sometimes the cheat detection does pick up cheats used on a LAN (if the LAN server is public), it doesn't make sense that those IP's would also be in the DPLogin system, which is only accessible via the Internet.

[jitspoe]

I must have misread something.  The server was actually running on 85.14.95.36, and somebody was connected to the server via LAN (or Hamachi).  When he connected to another server, it showed the 85.14.95.36.  He didn't actually log directly in using the 5. or 172. ip.

[wolfshadow]

Maybe i can talk more about TheSnake.
TheSnake = wezyk
Look on this: http://dplogin.com/forums/index.php?topic=14502.0

Next on this google cache (source thread deleted):
http://74.125.77.132/search?q=cache:of-GWViSnXMJ:cs-hacked.socjum.pl/fora/cs-hacked/viewtopic.php%3Fp%3D168557+thesnake+cs+quake&hl=en&ct=clnk&cd=3&client=opera

Translation:

TheSnake (7.11.2008)
Hello. I have the code of the game, Quake 2 - Digital Paintball 2 (C + +  ) And looking for someone who change it per x money and compile to have acted Wall-hack. Now I say that none ZGH HACK-old can not be because it is made on build 16, and servers can be connect from 20 +. I tried to change in the XVI32 this build in exe but not work. We ask you to help.

tinmar0 (9.11.2008)
Give me the code on PM i look on this

sorry for my poor english

[jitspoe]

Thanks for the information.  I've merged these threads and increased the ban time.