[Discussion] Bans and what we know

[Sychotix]

I wanted to open up a topic here now that they seem to be stepping up their anti-cheat a bit with the most recent ban wave. This is meant to be a place where people can discuss the bans that they receive so that the community can look for patterns and better understand the triggers. Keep in mind, this is a public forum that GGG may be monitoring. When including ban information, do not include ANY identifiable information.

If we as a community notice any patterns in the bans, I will try to keep this thread updated to warn others not to make the same mistakes.

When reporting a ban, please include...
1) What programs were you using and how long were you using them?
2) Did you or anyone you frequently play with do any RMT?
3) GGG's listed reason for ban and if your appeal was denied/approved.


What we believe causes bans:
Real Money Trading (RMT)
This is the #1 reason for bans when we get reports. They also have been known to chain ban users like if you are in a guild with someone who RMTs.

Area Instance Resetting
This was used in conjunction with the preloads when they were more useful (like with beast farming). They ban for this, don't do it.

Sending too many bot-like inputs
This one is more of a nebulous topic, but there was a recent string of bans for users of macro tools and bots like AdvancedStashHelper, DreamPoeBot, and other custom macros. We don't know exactly how sensitive it is or how "humanlike" your scripts must be... but be cautious using ANY macro/ExileAPI plugin that may send inputs to the game (such as Stashie, Pick-it... etc)

Botting
Obviously, they do ban for botting. The community knows way more about avoiding this than I do but my general advice is to not bot 24/7 or in places where people can report you (like towns).


What can you do to prevent bans?
Use the Limited User Method. While we don't have any proof that the infamous Anti-Cheat v3 is real (or at least still real), this will prevent PathOfExile from doing a decent chunk of client sided detection. Note that if you are modifying the game at all (like a GGPK edit or a memory edit), this becomes nealy useless as they obviously have access to their own files and memory. This also doesn't prevent any analysis of inputs that you've sent to the game/server.

[DumbBrain]

1)PoeHelper - FollowBot/Dpb - FollowBot
2)A lot of rmt.
3)All appeal is denied

Im get a lot of bans since the league start. First bans get for leveling my bots with follow bot in first week, then my machines was flagged and i got a lot of bans after. But after 2nd week all my followbots with new vm work correctly and i dont get any bans since 28 october. All my followbots was with my main character in one guild, all of them got ban with reason "3rd party software". My main character got "breaching term of use". 2 week before ban i change poehelper to dpb.

Running maps 6-10 hours 5/7 week, do some trades by followbots to buy maps and etc. Upgrading their items and builds.

[wayto911]

I have two accounts, one main account with many packs purchased and one secondary account with only a first blood purchase.
- There's a lot of RMT (real money trading) on the main account, using various tools and HUDs (not using limited user).
- The secondary account only uses an agent trade bot to buy items for the main account.
Both accounts interact frequently with each other through the guild stash.
=> The secondary account got banned.

[Whatever18]

I got banned aproximately 2 weeks ago

1) ExileAPI with mutliple plugins, a lot of auto crafting with ASH, sextant rolling (got banned next day after rolling like 3k sextants, I think that this was cause of BAN because I was using all the other tools long before). Always used limited user
2) No RMT
3) Reason for ban was breaking ToS, no reason was given as to why they rejected the appeal.

[cout00]

Full trade bot farm around 300 accounts
1) ExileApi + custom not public trade farm with protected inputs using ddxoft drivers (undetected i tested in Valorant)
2) hwid spoofer + proxy at rus territory
3) alot rmt
farm worked successfully around 1.5 years. workers have no bans never, only got bans a rmt accounts

first those who work during the day session were banned
I moved the extra ones who work during the day to the night session, they were banned 2 days later at 6 o’clock in the morning. those who worked during the day continued to work successfully for another week; I no longer started it at night.
On November 11 at 6 am, all accounts were blocked, about 16 accounts.
On November 12 at night I sold the remaining currency and received a chain ban on my main account, although I never had contact with working machines
I filed an appeal and the appeal was accepted, my account was unblocked on November 21
On November 22, I again received a ban from my main account, and they simply cut out all my old accounts - about 250 of them that had accumulated over 7 leagues. it just seemed impossible, how could they find them? even I forgot about them

[verard]

You are incredibly naive for posting this information publicly, as well as the creator of this topic, do you people realize GGG is actively monitoring this forum? What do you expect to gain from this? Someone to magically appear and give you the solution to avoid bans? If something that works gets posted on this forum, the next day it will be added to their anticheat. I also ran a big farm, I also got hit - but only trial and error will help you. Use your brain and don't let desperation lead you to bad decisions.

[Sychotix]

You are incredibly naive for posting this information publicly, as well as the creator of this topic, do you people realize GGG is actively monitoring this forum? What do you expect to gain from this? Someone to magically appear and give you the solution to avoid bans? If something that works gets posted on this forum, the next day it will be added to their anticheat. I also ran a big farm, I also got hit - but only trial and error will help you. Use your brain and don't let desperation lead you to bad decisions.

This thread is to help those learn what NOT to do... not for magical solutions. If you read the very first paragraph, you would see I included "Keep in mind, this is a public forum that GGG may be monitoring."

Trial and error as a group will get you much further than as an individual.

[verard]

You contradict yourself, by re-reading this post, what I understand for "what NOT to do" is basically not cheat at all, you can't bot, you can't RMT, you can't use bot inputs, you can't use anything that is considered a cheat- so what is the point of this whole thread? You're just desperately trying to fish for info.

I understand you have good intentions but you'll end up doing more harm than good by just feeding GGG info, people here post their whole strategy, while only 1 small part of it could be responsible for their bans. Guess what will happen? They will just add the rest of the strategy to their AC.

Limited user helped in the past, now it doesn't. Just like it happened with old accounts. Suddenly everyone and their mother started buying old accounts and they are useless now.

Be that as it may, you are obviously free to do whatever you want, but your actions have consequences that could possibly affect other people.

[Sychotix]

You contradict yourself, by re-reading this post, what I understand for "what NOT to do" is basically not cheat at all, you can't bot, you can't RMT, you can't use bot inputs, you can't use anything that is considered a cheat- so what is the point of this whole thread? You're just desperately trying to fish for info.

I understand you have good intentions but you'll end up doing more harm than good by just feeding GGG info, people here post their whole strategy, while only 1 small part of it could be responsible for their bans. Guess what will happen? They will just add the rest of the strategy to their AC.

Limited user helped in the past, now it doesn't. Just like it happened with old accounts. Suddenly everyone and their mother started buying old accounts and they are useless now.

Be that as it may, you are obviously free to do whatever you want, but your actions have consequences that could possibly affect other people.

Please keep this thread on topic. If you don't like the thread, don't contribute. These are ban reports and discussions about them, not a guide for avoiding bans.

As far as we are aware, they have not activated their client sided anti-cheat since around the time they gave out warnings to all PoEHUD users (2018 maybe?). Since around time, people began using the limited user method as it defeated nearly all of the client-sided detection. To the best of our knowledge, the recent ban wave was caused by an improvement to their server-sided detection of bot-like behavior... targeting users of macro-like programs and plugins that send frequent, repetitive inputs to the game. Without ban reports, people (including me) won't know to avoid certain programs, change behavior, recode certain things... etc. We accomplish more when we work together in this game of cat and mouse

Even though we have no proof that they have re-enabled the client-sided detection, I still highly recommend all users use the Limited User method as the last public knowledge of v3 of their anti-cheat (posted by pushedx after the closure of ExileBuddy (Path of Exile Anti-Cheat Postmortem)) was that it was delivered encrypted randomly in a packet... decrypted/loaded by the client.... run.... results sent back to the server... then unloaded. If they were to ever re-enable this, limited user should prevent detection as windows does a pretty good job of preventing programs without permissions from accessing things they shouldn't. Other games prevent methods like this from existing by running anti-cheats at the driver level... but PoE's is run at the user level. It of course will not provide ANY protection once you are interacting with the game in a way windows says is okay. For example, touching its own files like the GGPK, its own memory, or giving the game input like sending a key press or a mouse click. The game can run whatever detection it wants against these and ban accordingly.

I would be VERY surprised if any information included in this thread is new to GGG. That said, always post with caution as it isn't unlikey that they browse these forums.

[pimples700]

Tools used: Gamehelper and PoeSmoother
Limited user is enabled btw
RMT: No
How long have you been using the tools?: September 2023 mainly the game helper one.
Account age: 5 YEARS
Ban details: Was banned last month playing solo and my game disconnected and had the message "An administrator has banned your account" I emailed them and they replied it was because of third-party software and they rejected my appeal.
Tools that I've used in Details: I mainly used the gamehelper one I didn't rage used it I've only used it on complex maps like maze, pit basically maps that have complex layouts. I usually use it maybe 2-4 hours a day until I exhaust my bad layout maps. In the second tool that I've used is poesmoother, I disabled every nonsense effect on the map and didn't use the map layout unlock since I've already got that covered with game helper. Also, I forgot to mention I only used the radar plugin from gamehelper.
Account details: Lots of supporter packs and just bought last june 2023 worth of 60$ mtx.

[jusikapide]

1) What programs were you using, and how long were you using them?
ExileAPI, Gamehelper, PoeSmoother, speed clicker, macro recorder, own bot (written in AutoIT) in combination with ASH

2) Did you or anyone you frequently play with do any RMT?
no

3) GGG's listed reason for ban and if your appeal was denied/approved.
tos breach, didnt appeal

Details:
Used all of them for ages, did have limited user enabled

[Sychotix]

Also posting a ban report from a separate user:

1) What programs were you using and how long were you using them?
- ExileAPI + DreamPoEBot (a lot)
2) Did you or anyone you frequently play with do any RMT?
- No
3) GGG's listed reason for ban and if your appeal was denied/approved.
-Unknown, I'm guessing 3rd party. Ban appeal denied.

Also an interesting note that made me want to post it... we are 100% confident that the game never reached outside of its own binary for this ban. Whatever triggered this ban was either gathering data entirely within PoE (such as mouse clicks, mouse movement, manipulated memory detection etc) or more likely was entirely server based. This further confirms that any manipulative interactions with the game (sending input, modifying memory, etc) is the dangerous part and not necessarily pattern scanning for specific applications like has been done with past versions of the anti-cheat.

[clawface]

Responding to the discussion part of the thread, and the future of "cheating" in games, I do wonder how long it will be before AI scanning is introduced on a significant scale. For example, AI advanced statistical prediction analysis, utilizing extensive real-time datasets and algorithms could uncover patterns and variations in game usage that might suggest non-human behavior. This system would establish a baseline of typical user behavior, enabling the quick detection of outliers or anomalies that deviate from this expected norm. Through ongoing monitoring, suspicious activities by users can be instantly flagged for human moderators to review. Even something as simple as a maphack (even if undetectable in terms of app) could potentially be flagged if the user, on average, doesn't make any mistakes in map layouts.

[camapxam]

So basically using poesmoother negate the limited user method? or am i misunderstanding your words? (sry, Eng is my 3rd language)

[Sychotix]

So basically using poesmoother negate the limited user method? or am i misunderstanding your words? (sry, Eng is my 3rd language)

The limited user method is only helpful for preventing Path of Exile from reaching outside of its own files. Since the GGPK poesmoother edits is within its files, it provides no safety benefits for this. The GGPK gets loaded into the game, which means the game has full access to asses its contents if it wants to. I would be surprised if they did, but it is absolutely possible.