I've had a player contact me complaining that every time he joins one of my servers, he gets kicked for command spamming. I took a look and sure enough he is. From my SMAC.log file:
Spoiler
Code:
Line 10059: L 01/24/2017 - 14:25:34: [smac_client.smx] Wizard Magizard (ID: STEAM_0:0:59552330 | IP: 80.7.85.177) was temporarily banned for connection spam.
Line 54634: L 12/21/2017 - 17:44:40: [smac_commands.smx | 0.8.6.0] Wizard Magizard (ID: STEAM_0:0:59552330 | IP: 80.7.85.177) was kicked for spamming: explode
Line 63952: L 03/31/2018 - 00:36:49: [smac_commands.smx | 0.8.6.0] Wizard Magizard (ID: STEAM_0:0:59552330 | IP: 80.7.85.177) was kicked for spamming: ffc500 ͡
Line 63954: L 03/31/2018 - 00:36:56: [smac_client.smx] Wizard Magizard (ID: STEAM_0:0:59552330 | IP: 80.7.85.177) was temporarily banned for connection spam.
Line 63960: L 03/31/2018 - 01:14:43: [smac_commands.smx | 0.8.6.0] Wizard Magizard (ID: STEAM_0:0:59552330 | IP: 80.7.85.177) was kicked for spamming: joinclass random
Line 64036: L 03/31/2018 - 18:04:51: [smac_commands.smx | 0.8.6.0] Wizard Magizard (ID: STEAM_0:0:59552330 | IP: 80.7.85.177) was kicked for spamming: ffc500 ͡
Line 64038: L 03/31/2018 - 18:04:58: [smac_client.smx] Wizard Magizard (ID: STEAM_0:0:59552330 | IP: 80.7.85.177) was temporarily banned for connection spam.
Line 65652: L 04/17/2018 - 11:03:10: [smac_commands.smx | 0.8.6.0] Wizard Magizard (ID: STEAM_0:0:59552330 | IP: 80.7.85.177) was kicked for spamming: ff0000 (
Line 65806: L 04/19/2018 - 14:15:23: [smac_commands.smx | 0.8.6.0] Wizard Magizard (ID: STEAM_0:0:59552330 | IP: 80.7.85.177) was kicked for spamming: ffc500 ͡
Line 67494: L 05/06/2018 - 16:47:39: [smac_commands.smx | 0.8.6.0] Wizard Magizard (ID: STEAM_0:0:59552330 | IP: 80.7.85.177) was kicked for spamming: joinclass random
Line 67496: L 05/06/2018 - 16:47:55: [smac_commands.smx | 0.8.6.0] Wizard Magizard (ID: STEAM_0:0:59552330 | IP: 80.7.85.177) was kicked for spamming: 11ff00 ͜
Line 67498: L 05/06/2018 - 16:48:01: [smac_client.smx] Wizard Magizard (ID: STEAM_0:0:59552330 | IP: 80.7.85.177) was temporarily banned for connection spam.
Line 67499: L 05/06/2018 - 16:50:37: [smac_commands.smx | 0.8.6.0] Wizard Magizard (ID: STEAM_0:0:59552330 | IP: 80.7.85.177) was kicked for spamming: ffc500 ͡
Line 68913: L 05/22/2018 - 20:51:32: [smac_commands.smx | 0.8.6.0] Wizard Magizard (ID: STEAM_0:0:59552330 | IP: 80.7.85.177) was kicked for spamming: ffc500 ͡
Line 68915: L 05/22/2018 - 20:51:39: [smac_client.smx] Wizard Magizard (ID: STEAM_0:0:59552330 | IP: 80.7.85.177) was temporarily banned for connection spam.
Line 68916: L 05/22/2018 - 20:53:26: [smac_commands.smx | 0.8.6.0] Wizard Magizard (ID: STEAM_0:0:59552330 | IP: 80.7.85.177) was kicked for spamming: ff0000 (
Line 69138: L 05/25/2018 - 21:05:49: [smac_commands.smx | 0.8.6.0] Wizard Magizard (ID: STEAM_0:0:59552330 | IP: 80.7.85.177) was kicked for spamming: ff0000 (
Line 69140: L 05/25/2018 - 21:05:54: [smac_client.smx] Wizard Magizard (ID: STEAM_0:0:59552330 | IP: 80.7.85.177) was temporarily banned for connection spam.
Line 69428: L 05/28/2018 - 19:51:25: [smac_commands.smx | 0.8.6.0] Wizard Magizard (ID: STEAM_0:0:59552330 | IP: 80.7.85.177) was kicked for spamming: ffc500 ͡
Line 69430: L 05/28/2018 - 19:51:32: [smac_client.smx] Wizard Magizard (ID: STEAM_0:0:59552330 | IP: 80.7.85.177) was temporarily banned for connection spam.
Line 69433: L 05/28/2018 - 19:54:29: [smac_commands.smx | 0.8.6.0] Wizard Magizard (ID: STEAM_0:0:59552330 | IP: 80.7.85.177) was kicked for spamming: ffc500 ͡
Line 69489: L 05/29/2018 - 12:59:24: [smac_commands.smx | 0.8.6.0] Wizard Magizard (ID: STEAM_0:0:59552330 | IP: 80.7.85.177) was kicked for spamming: ffc500 ͡
Line 69492: L 05/29/2018 - 13:11:48: [smac_commands.smx | 0.8.6.0] Wizard Magizard (ID: STEAM_0:0:59552330 | IP: 80.7.85.177) was kicked for spamming: ff0000 (
Line 69494: L 05/29/2018 - 13:11:53: [smac_client.smx] Wizard Magizard (ID: STEAM_0:0:59552330 | IP: 80.7.85.177) was temporarily banned for connection spam.
Line 69495: L 05/29/2018 - 13:14:28: [smac_commands.smx | 0.8.6.0] Wizard Magizard (ID: STEAM_0:0:59552330 | IP: 80.7.85.177) was kicked for spamming: ffc500 ͡
(I've included some examples of the spam we have been getting from our command logs in the spoiler below.)
For the most part what I am seeing is as soon as he joins a class, he instantly begin spamming hex color codes and letters not normally type-able in TF2. It's also happening so fast it has to be something automatic. He could not be doing so manually.
If they had the 'say' command at the front, I'd guess that he was trying to flood the chat like various aimbot programs do so that people can't complain about hackers in the chat. But as they don't they are just invalid commands. That said, valid or invalid commands, they are still being spammed.
I've searched this players SteamID and all I could find were various comms bans from one community. He has no aimbot/cheat bans and no VAC ban. My gut feeling though is telling me this guy is using (or trying to use) an aimbot/cheat program which SMAC is detecting and kicking him for command spam before it has had time to detect the actual aimbot itself. On my servers, we have the action limit set to 6.
Now this is what I need help with. I would like some confirmation that this person is in fact cheating before I actually ban him. So is this a recognised cheat? Or known counter-measure of some kind? I have said to the person in question that if they stop doing what they are doing then it will stop kicking them, but they are insisting that they aren't.
Command log examples.
Spoiler
Example 1:
Code:
Line 24588: 05/29/18 12:59:21: Wizard Magizard<7><[U:1:119104660]><> executes: closed_htmlpage
Line 24589: 05/29/18 12:59:21: Wizard Magizard<7><[U:1:119104660]><> executes: team_ui_setup
Line 24590: 05/29/18 12:59:21: Wizard Magizard<7><[U:1:119104660]><> executes: menuopen
Line 24592: 05/29/18 12:59:23: Wizard Magizard<7><[U:1:119104660]><> executes: joinclass sniper
Line 24593: 05/29/18 12:59:23: Wizard Magizard<7><[U:1:119104660]><> executes: ff0000 (
Line 24594: 05/29/18 12:59:23: Wizard Magizard<7><[U:1:119104660]><> executes: ffc500 ͡
Line 24595: 05/29/18 12:59:23: Wizard Magizard<7><[U:1:119104660]><> executes: d6ff00 °
Line 24596: 05/29/18 12:59:23: Wizard Magizard<7><[U:1:119104660]><> executes: 11ff00 ͜
Line 24597: 05/29/18 12:59:23: Wizard Magizard<7><[U:1:119104660]><> executes: 00ff51 ʖ
Line 24598: 05/29/18 12:59:23: Wizard Magizard<7><[U:1:119104660]><> executes: 00e8ff ͡
Line 24599: 05/29/18 12:59:23: Wizard Magizard<7><[U:1:119104660]><> executes: 0085ff °
Line 24600: 05/29/18 12:59:23: Wizard Magizard<7><[U:1:119104660]><> executes: 0023ff )"
Line 24601: 05/29/18 12:59:24: Wizard Magizard<7><[U:1:119104660]><> executes: demorestart
Line 24602: 05/29/18 12:59:24: Wizard Magizard<7><[U:1:119104660]><> executes: ff0000 (
Line 24603: 05/29/18 12:59:24: Wizard Magizard<7><[U:1:119104660]><> executes: ffc500 ͡
Line 24604: 05/29/18 12:59:24: Wizard Magizard<7><[U:1:119104660]><> executes: d6ff00 °
Line 24605: 05/29/18 12:59:24: Wizard Magizard<7><[U:1:119104660]><> executes: 11ff00 ͜
Line 24606: 05/29/18 12:59:24: Wizard Magizard<7><[U:1:119104660]><> executes: 00ff51 ʖ
Line 24607: 05/29/18 12:59:24: Wizard Magizard<7><[U:1:119104660]><> executes: 00e8ff ͡
Line 24608: 05/29/18 12:59:24: Wizard Magizard<7><[U:1:119104660]><> executes: 0085ff °
Line 24609: 05/29/18 12:59:24: Wizard Magizard<7><[U:1:119104660]><> executes: 0023ff )"
Example 2:
Code:
Line 24979: 05/29/18 13:11:21: Wizard Magizard<24><[U:1:119104660]><> executes: vmodenable 1
Line 24980: 05/29/18 13:11:21: Wizard Magizard<24><[U:1:119104660]><> executes: vban 0 0
Line 24990: 05/29/18 13:11:45: Wizard Magizard<24><[U:1:119104660]><> executes: closed_htmlpage
Line 24991: 05/29/18 13:11:45: Wizard Magizard<24><[U:1:119104660]><> executes: team_ui_setup
Line 24992: 05/29/18 13:11:46: Wizard Magizard<24><[U:1:119104660]><> executes: menuopen
Line 24993: 05/29/18 13:11:47: Wizard Magizard<24><[U:1:119104660]><> executes: joinclass sniper
Line 24994: 05/29/18 13:11:47: Wizard Magizard<24><[U:1:119104660]><> executes: ff0000 (
Line 24995: 05/29/18 13:11:47: Wizard Magizard<24><[U:1:119104660]><> executes: ffc500 ͡
Line 24996: 05/29/18 13:11:47: Wizard Magizard<24><[U:1:119104660]><> executes: d6ff00 °
Line 24997: 05/29/18 13:11:47: Wizard Magizard<24><[U:1:119104660]><> executes: 11ff00 ͜
Line 24998: 05/29/18 13:11:47: Wizard Magizard<24><[U:1:119104660]><> executes: 00ff51 ʖ
Line 24999: 05/29/18 13:11:47: Wizard Magizard<24><[U:1:119104660]><> executes: 00e8ff ͡
Line 25000: 05/29/18 13:11:47: Wizard Magizard<24><[U:1:119104660]><> executes: 0085ff °
Line 25001: 05/29/18 13:11:47: Wizard Magizard<24><[U:1:119104660]><> executes: 0023ff )"
Line 25002: 05/29/18 13:11:48: Wizard Magizard<24><[U:1:119104660]><> executes: demorestart
Line 25003: 05/29/18 13:11:48: Wizard Magizard<24><[U:1:119104660]><> executes: ff0000 (
Line 25004: 05/29/18 13:11:48: Wizard Magizard<24><[U:1:119104660]><> executes: ffc500 ͡
Line 25005: 05/29/18 13:11:48: Wizard Magizard<24><[U:1:119104660]><> executes: d6ff00 °
Line 25006: 05/29/18 13:11:48: Wizard Magizard<24><[U:1:119104660]><> executes: 11ff00 ͜
Line 25007: 05/29/18 13:11:48: Wizard Magizard<24><[U:1:119104660]><> executes: 00ff51 ʖ
Line 25008: 05/29/18 13:11:48: Wizard Magizard<24><[U:1:119104660]><> executes: 00e8ff ͡
Line 25009: 05/29/18 13:11:48: Wizard Magizard<24><[U:1:119104660]><> executes: 0085ff °
Line 25010: 05/29/18 13:11:48: Wizard Magizard<24><[U:1:119104660]><> executes: 0023ff )"
Example 3:
Code:
Line 25054: 05/29/18 13:13:04: Wizard Magizard<28><[U:1:119104660]><> executes: vmodenable 1
Line 25055: 05/29/18 13:13:04: Wizard Magizard<28><[U:1:119104660]><> executes: vban 0 0
Line 25092: 05/29/18 13:14:23: Wizard Magizard<28><[U:1:119104660]><> executes: closed_htmlpage
Line 25093: 05/29/18 13:14:23: Wizard Magizard<28><[U:1:119104660]><> executes: team_ui_setup
Line 25094: 05/29/18 13:14:24: Wizard Magizard<28><[U:1:119104660]><> executes: menuopen
Line 25102: 05/29/18 13:14:28: Wizard Magizard<28><[U:1:119104660]><> executes: joinclass random
Line 25103: 05/29/18 13:14:28: Wizard Magizard<28><[U:1:119104660]><> executes: ff0000 (
Line 25104: 05/29/18 13:14:28: Wizard Magizard<28><[U:1:119104660]><> executes: ffc500 ͡
Line 25105: 05/29/18 13:14:28: Wizard Magizard<28><[U:1:119104660]><> executes: d6ff00 °
Line 25106: 05/29/18 13:14:28: Wizard Magizard<28><[U:1:119104660]><> executes: 11ff00 ͜
Line 25107: 05/29/18 13:14:28: Wizard Magizard<28><[U:1:119104660]><> executes: 00ff51 ʖ
Line 25108: 05/29/18 13:14:28: Wizard Magizard<28><[U:1:119104660]><> executes: 00e8ff ͡
Line 25109: 05/29/18 13:14:28: Wizard Magizard<28><[U:1:119104660]><> executes: 0085ff °
Line 25110: 05/29/18 13:14:28: Wizard Magizard<28><[U:1:119104660]><> executes: 0023ff )"
Line 25111: 05/29/18 13:14:28: Wizard Magizard<28><[U:1:119104660]><> executes: demorestart
Line 25112: 05/29/18 13:14:28: Wizard Magizard<28><[U:1:119104660]><> executes: ff0000 (
Line 25113: 05/29/18 13:14:28: Wizard Magizard<28><[U:1:119104660]><> executes: ffc500 ͡
Line 25114: 05/29/18 13:14:28: Wizard Magizard<28><[U:1:119104660]><> executes: d6ff00 °
Line 25115: 05/29/18 13:14:28: Wizard Magizard<28><[U:1:119104660]><> executes: 11ff00 ͜
Line 25116: 05/29/18 13:14:28: Wizard Magizard<28><[U:1:119104660]><> executes: 00ff51 ʖ
Line 25117: 05/29/18 13:14:28: Wizard Magizard<28><[U:1:119104660]><> executes: 00e8ff ͡
Line 25118: 05/29/18 13:14:28: Wizard Magizard<28><[U:1:119104660]><> executes: 0085ff °
Line 25119: 05/29/18 13:14:28: Wizard Magizard<28><[U:1:119104660]><> executes: 0023ff )"
Example 4:
Code:
Line 25166: 05/29/18 13:15:51: Wizard Magizard<31><[U:1:119104660]><> executes: vmodenable 1
Line 25167: 05/29/18 13:15:51: Wizard Magizard<31><[U:1:119104660]><> executes: vban 0 0
Line 25186: 05/29/18 13:16:10: Wizard Magizard<31><[U:1:119104660]><> executes: closed_htmlpage
Line 25187: 05/29/18 13:16:10: Wizard Magizard<31><[U:1:119104660]><> executes: team_ui_setup
Line 25188: 05/29/18 13:16:10: Wizard Magizard<31><[U:1:119104660]><> executes: menuopen
Line 25194: 05/29/18 13:16:59: Wizard Magizard<31><[U:1:119104660]><> executes: motd
Line 25195: 05/29/18 13:17:01: Wizard Magizard<31><[U:1:119104660]><> executes: menuopen
Line 25196: 05/29/18 13:17:01: Wizard Magizard<31><[U:1:119104660]><> executes: menuopen
Line 25252: 05/29/18 13:17:59: Wizard Magizard<31><[U:1:119104660]><> executes: jointeam red
Line 25253: 05/29/18 13:17:59: Wizard Magizard<31><[U:1:119104660]><> executes: menuopen
Line 25254: 05/29/18 13:17:59: Wizard Magizard<31><[U:1:119104660]><> executes: ff0000 (
Line 25255: 05/29/18 13:17:59: Wizard Magizard<31><[U:1:119104660]><> executes: ffc500 ͡
Line 25256: 05/29/18 13:17:59: Wizard Magizard<31><[U:1:119104660]><> executes: d6ff00 °
Line 25257: 05/29/18 13:17:59: Wizard Magizard<31><[U:1:119104660]><> executes: 11ff00 ͜
Line 25258: 05/29/18 13:17:59: Wizard Magizard<31><[U:1:119104660]><> executes: 00ff51 ʖ
Line 25259: 05/29/18 13:17:59: Wizard Magizard<31><[U:1:119104660]><> executes: 00e8ff ͡
Line 25260: 05/29/18 13:17:59: Wizard Magizard<31><[U:1:119104660]><> executes: 0085ff °
Line 25261: 05/29/18 13:17:59: Wizard Magizard<31><[U:1:119104660]><> executes: 0023ff )"
Line 25263: 05/29/18 13:18:00: Wizard Magizard<31><[U:1:119104660]><> executes: demorestart
Line 25264: 05/29/18 13:18:00: Wizard Magizard<31><[U:1:119104660]><> executes: ff0000 (
Line 25265: 05/29/18 13:18:00: Wizard Magizard<31><[U:1:119104660]><> executes: ffc500 ͡
Line 25266: 05/29/18 13:18:00: Wizard Magizard<31><[U:1:119104660]><> executes: d6ff00 °
Line 25267: 05/29/18 13:18:00: Wizard Magizard<31><[U:1:119104660]><> executes: 11ff00 ͜
Line 25268: 05/29/18 13:18:00: Wizard Magizard<31><[U:1:119104660]><> executes: 00ff51 ʖ
Line 25269: 05/29/18 13:18:00: Wizard Magizard<31><[U:1:119104660]><> executes: 00e8ff ͡
Line 25270: 05/29/18 13:18:00: Wizard Magizard<31><[U:1:119104660]><> executes: 0085ff °
Line 25271: 05/29/18 13:18:00: Wizard Magizard<31><[U:1:119104660]><> executes: 0023ff )"
Line 25272: 05/29/18 13:18:01: Wizard Magizard<31><[U:1:119104660]><> executes: joinclass heavyweapons
Line 25274: 05/29/18 13:18:01: Wizard Magizard<31><[U:1:119104660]><> executes: ff0000 (
Line 25275: 05/29/18 13:18:01: Wizard Magizard<31><[U:1:119104660]><> executes: ffc500 ͡
Line 25276: 05/29/18 13:18:01: Wizard Magizard<31><[U:1:119104660]><> executes: d6ff00 °
Line 25277: 05/29/18 13:18:01: Wizard Magizard<31><[U:1:119104660]><> executes: 11ff00 ͜
Line 25278: 05/29/18 13:18:01: Wizard Magizard<31><[U:1:119104660]><> executes: 00ff51 ʖ
Line 25279: 05/29/18 13:18:01: Wizard Magizard<31><[U:1:119104660]><> executes: 00e8ff ͡
Line 25280: 05/29/18 13:18:01: Wizard Magizard<31><[U:1:119104660]><> executes: 0085ff °
Line 25281: 05/29/18 13:18:01: Wizard Magizard<31><[U:1:119104660]><> executes: 0023ff )"
Line 25286: 05/29/18 13:18:06: Wizard Magizard<31><[U:1:119104660]><> executes: joinclass sniper
Line 25287: 05/29/18 13:18:06: Wizard Magizard<31><[U:1:119104660]><> executes: ff0000 (
Line 25288: 05/29/18 13:18:06: Wizard Magizard<31><[U:1:119104660]><> executes: ffc500 ͡
Line 25289: 05/29/18 13:18:06: Wizard Magizard<31><[U:1:119104660]><> executes: d6ff00 °
Line 25290: 05/29/18 13:18:06: Wizard Magizard<31><[U:1:119104660]><> executes: 11ff00 ͜
Line 25291: 05/29/18 13:18:06: Wizard Magizard<31><[U:1:119104660]><> executes: 00ff51 ʖ
Line 25292: 05/29/18 13:18:06: Wizard Magizard<31><[U:1:119104660]><> executes: 00e8ff ͡
Line 25293: 05/29/18 13:18:06: Wizard Magizard<31><[U:1:119104660]><> executes: 0085ff °
Line 25294: 05/29/18 13:18:06: Wizard Magizard<31><[U:1:119104660]><> executes: 0023ff )"