Another hitbot network uncovered

[PowerCum]

During the routine beta test and scrubing of bot traffic we found that there is a large bot network running on cloud server providers. That specific bot network traffic seems to emulate browser behavior considerably good to fool most of the anticheat protections. It's traffic is being traded around and also sold to and from some traffic brokers without their knowledge.

For the next major CjOverkill version there is planned an automatic update of this list, but for now you should just ban these IP ranges.
Just click on your IP Filter into your cjadmin and add these ranges to make sure you are not being cheated by that hitbot network.

All these IP ranges belong to hosting companies, so there is absolutely no chance that you will filter human traffic even if you wanted to.

23.20.0.0 - 23.23.255.255
50.16.0.0 - 50.19.255.255
54.242.0.0 - 54.243.255.255
54.247.0.0 - 54.247.255.255
54.248.0.0 - 54.249.255.255
54.251.0.0 - 54.251.255.255
54.252.0.0 - 54.252.255.255
67.202.0.0 - 67.202.63.255
72.44.32.0 - 72.44.63.255
75.101.128.0 - 75.101.255.255
107.20.0.0 - 107.23.255.255
174.129.0.0 - 174.129.255.255
184.72.0.0 - 184.73.255.255
204.236.128.0 - 204.236.255.255
216.182.224.0 - 216.182.239.255

During the next days there will be more updates to this list while we are mapping all the hosting providers giving server support to this hitbot network.

For more information feel free to hit ICEFIRE on ICQ 171216535

The updated list will be hosted on http://www.cjoverkill.com/banthins.html

[JFK]

Thanks for the post

[woj]

how many ips do they have?

[KillerK]

Is this a feature you "borrowed" from Choker?

[fatfoo]

Congratulations with uncovering the hitbot traffic network. This specific hitbot traffic can fool most of the anticheat protections - that is not good. These kinds of things happen often with traded traffic. These kinds of things could happen with bought traffic from traffic brokers. Good luck with filtering human traffic.

[redwhiteandblue]

You've missed a few:

50.17.0.0 - 50.17.255.255
50.19.0.0 - 50.19.255.255
107.21.0.0 - 107.21.255.255
107.22.0.0 - 107.22.255.255
184.73.0.0 - 184.73.255.255

I think they're all Amazon AWS, but didn't check them all.

[candyflip]

Is this a feature you "borrowed" from Choker?

CJOverkill has been in constant development since it's inception. Choker hasn't updated TTT in 5, almost 6 years.

[PowerCum]

You've missed a few:

50.17.0.0 - 50.17.255.255
50.19.0.0 - 50.19.255.255
107.21.0.0 - 107.21.255.255
107.22.0.0 - 107.22.255.255
184.73.0.0 - 184.73.255.255

I think they're all Amazon AWS, but didn't check them all.

Yes, they use mainly amazon AWS for now, but there are also some minor providers. As you may see the minor ranges you have pointed are already included in my list. Some of the ranges include several class B.

[redwhiteandblue]

Yes, they use mainly amazon AWS for now, but there are also some minor providers. As you may see the minor ranges you have pointed are already included in my list. Some of the ranges include several class B.

Ah yes. It is late, I am tired.

[V_RocKs]

Free money!