How to identify a CHEATER?

17 replies [Last post]
Anabolic 007
Vladimir Putin's picture
Offline
Joined: Oct 2024
Posts:
RU Russian Federation

Suspicions of Cheating by Player MAESTRO (NOOB_2)

Hi everyone.
I'd like to bring up an important topic that doesn't seem to fit the format of the thread "Report Cheaters Here!" — that thread appears to be for final verdicts only, not for discussion.
But for me (and hopefully not just me), it's important to understand why someone is suspected of cheating, and what the actual signs are.

Summary
This is about a player known under several nicknames: MAESTRO, NOOB_2, Player (RU).
He regularly plays on DM17ELITE'Z, CARNAGE, RAIL+HOOK, often under a different name each day.
Demos can be found here: Download demos

Why I Became Suspicious

1. Suspicious frag balance
He consistently wins with a margin of 1–2 frags, regardless of the opponent’s level. This could suggest he's trying not to raise suspicion while using subtle aim assist.

2. Odd shooting pattern
His gameplay includes frequent shots into empty space, followed by sudden impossible hits — often in angles and timings where even top players would usually miss.
This may point to AutoShot or a trigger-based AIMbot.

3. Huge contrast when MVD recording is active
When I turn on MVD recording (a small blinking icon appears next to the flag), his performance drops sharply.
Without recording, he wins by 1–2 frags. With recording on, I win with scores like 100:30 or 100:35. This is consistent and repeatable.

My Investigation

At one point, I insulted him emotionally (later apologized). After that, someone started joining the server under my name and saying offensive things.

I started checking /clientinfo and other player metadata. Despite changing names, flags, and even possibly using VPNs, this player keeps certain technical identifiers.
Those who know how to read them will understand.

Later I joined under a different nickname and stayed in spectator mode.
When a fake ANABOLIC 007 appeared, I checked his data — it matched NOOB_2 exactly.

Behavior and Psychology

He used to be afraid of MVD recording. Now he's more relaxed and may even win 3x or 4x, if he wants to.
But if he likes you, he’ll just beat you by 1–2 frags and write “Good Game” at the end.

That alone tells me he adjusts his behavior depending on who's watching, and how closely.

Why I'm Posting This

I'm not pretending to hold the ultimate truth. I'm inviting others to discuss how we — regular players — can spot subtle cheating.

Nowadays, cheats like AIMbot or AutoShot can be configured with very soft settings (e.g., 10–20% help), and they are hard to detect — especially if you rely on demos alone.

I’d like to know:
- Has anyone else felt something is “off” about this player?
- Do you think that cheating — even subtle — should be addressed and exposed?
- Is anyone willing to discuss it rationally, based on experience or technical observation?

Thanks to anyone who read all the way through.
I’ll appreciate honest thoughts or technical input.

ANABOLIC 007

rUnThEoN?!
Site administrator
Skullheadq3's picture
Offline
Joined: Dec 2005
Posts:
DE Germany
Re: How to identify a CHEATER?

Hi there, will answer you longer tomorrow.

do you have a non mvd demo? MVD demos are kinda fishy considering cheat busting since they technically are not accurate.

hurrenson: "This idiot is apparently not familiar with a rail/sniper style."

Anabolic 007
Vladimir Putin's picture
Offline
Joined: Oct 2024
Posts:
RU Russian Federation
Re: How to identify a CHEATER?

I somehow didn't record regular Demos, because it can easily get lost if the opponent reconnects. And what's the problem with MVD? I thought MVD was convenient because you can watch from any perspective, and that's an advantage. Of course, if I knew that there was some problem with MVD for evaluation, I would have recorded a regular Demo. If it's a critical issue, I'll do it.

And if you want to check by feel, this guy plays Rail+HOOK every day. Go in, press him, he will panic and turn on AIMbot. You will feel how it gets you from any distance, at any speed.

I found old recordings, unfortunately, in MVD format. There are currently 10 demos on Google Drive in total. The Demo name is the name of this very player on this demo.

rUnThEoN?!
Site administrator
Skullheadq3's picture
Offline
Joined: Dec 2005
Posts:
DE Germany
Re: How to identify a CHEATER?

its 2 things - MVD technically stick a camera on the player position instead of recording the player. so its like 99% accurate for most purposes but for cheating you can have a very slight desyncronisation. Also MVD demos dont work in every tool I use. I especially call out that MVDs are useless for wallhack evaluation in the other thread.

I will look into the demo slightly later. something else popped up.

hurrenson: "This idiot is apparently not familiar with a rail/sniper style."

Anabolic 007
Vladimir Putin's picture
Offline
Joined: Oct 2024
Posts:
RU Russian Federation
Re: How to identify a CHEATER?

I just can't even imagine the principle by which something can be verified. If it makes sense to parse the data from the files (coordinates and time tied to names or other important data) and add it to the table for easy viewing, let me know.

rUnThEoN?!
Site administrator
Skullheadq3's picture
Offline
Joined: Dec 2005
Posts:
DE Germany
Re: How to identify a CHEATER?

Ok so I watched into the maestro-2 demo and at 1:50 he adjust his cheats to hit better. this is known regular cheat behaviour. If you proof that this happens everytime he is kinda loosing, takes 10-20 seconds and plays better afterwards it would be enough for me, especially since the aim looks super dubios. Note that this only works once per session, if you are lucky you find more examples.
also this mean his cheat is loaded 24/7 since he only adjust, not reconnects.

btw, due to the nature of smoothed aimbots the E+ anticheat mostly will not detect them.

I have a tool to make "look at demos" -> look at data. it just doesnt work in E+ mvd.

also I don't go to elitez anymore, the antiwallhack is just set way to aggressive. Fubar fucked his own server and I told him 10 years ago.

hurrenson: "This idiot is apparently not familiar with a rail/sniper style."

FUBAR*ELITE'Z
Fubar's picture
Offline
Joined: Feb 2009
Posts:
FR France
Re: How to identify a CHEATER?

seta xp_anticheatlevel "4"
seta xp_antiWallhackLevel "1"

This has been the case for the last 10 years or so, I don't think I have ever changed these settings

Anabolic 007
Vladimir Putin's picture
Offline
Joined: Oct 2024
Posts:
RU Russian Federation
Re: How to identify a CHEATER?

Well, I'll play under other names to give the person a chance to properly set up his AIMbot for my post, and not prepare for a game with me in advance. The guy is simply beside himself with anger that I'm trying to figure him out publicly. Sometimes he goes by my name, sometimes he calls himself an insult + my name) I think I'll collect more evidence on him.
Thanks!

rUnThEoN?!
Site administrator
Skullheadq3's picture
Offline
Joined: Dec 2005
Posts:
DE Germany
Re: How to identify a CHEATER?
FUBAR*ELITE'Z wrote:

seta xp_anticheatlevel "4"
seta xp_antiWallhackLevel "1"

This has been the case for the last 10 years or so, I don't think I have ever changed these settings

yes and I told you 10 years ago when I explained the anticheat to you to not use antiwallhack since it ruins the game. your server setting combination of sv_fps 20 and g_speed 350 worsens the problem.
https://www.youtube.com/watch?v=WyhB0FDZyvs
I am not interested in visting elitez servers anymore after 10 years of this bullcrap.

hurrenson: "This idiot is apparently not familiar with a rail/sniper style."

FUBAR*ELITE'Z
Fubar's picture
Offline
Joined: Feb 2009
Posts:
FR France
Re: How to identify a CHEATER?

"the antiwallhack is just set way to aggressive"
"to not use antiwallhack"

Which is it?

"your server setting combination of sv_fps 20" no it's set at 30
Yes g_speed is set at 350, as far as I can remember it's always been this way
Conversations 10 years ago is long forgotten on my part, lucky to remember 10 days ago lol

It's your prerogative where you want to play or not, I'm sure there's at least 1 server in the world that meets your high standards

Anabolic 007
Vladimir Putin's picture
Offline
Joined: Oct 2024
Posts:
RU Russian Federation
Re: How to identify a CHEATER?
rUnThEoN?! wrote:

your server setting combination of sv_fps 20 and g_speed 350 worsens the problem.
https://www.youtube.com/watch?v=WyhB0FDZyvs
I am not interested in visting elitez servers anymore after 10 years of this bullcrap.

Packets can get lost in many places between your home router and the final destination. To at least get a rough idea of where the issue might be, it's better to use a tool like PingPlotter.

And if you want to go deep and analyze actual packet behavior, then Wireshark is the better choice.

By the way, since we're talking about server lag — I wanted to ask about xp_delagWeapons.
So, cl_timeNudge predicts player movement up to 30ms ahead, but that can cause stuttering if the prediction doesn't match the actual coordinates.
On the other hand, xp_delagWeapons rewinds the server state based on the player's ping, making hitscan weapons register exactly when the crosshair is over the enemy on the client's screen.

There’s this player Lagy from Chile who plays with an average ping of 250ms (which makes sense — Southern Hemisphere, around 11,400 km away). Very good player. My palms sweat when he joins DM17ELITE'Z Happy

Speed of light in fiber optics is around 200,000 km/s, or 200 km/ms,
so:
Ping = 2 * 11,400 / 200 = 114ms
(This assumes a direct fiber optic cable between the player and the server. But in reality, there are many nodes along the way, which leads to additional delay and packet loss.)

So yeah, the actual ping ends up being about twice the theoretical minimum — but it doesn't seem to stop him from playing well.
I assume he plays with xp_delagWeapons enabled.

But in your config — the one you recommend to players (z-settings.pk3 > general.cfg) — you have:

seta xp_delagWeapons "0"

Could I ask why it’s set to 0?
Is that based on subjective experience, or is there any data about bugs or problems with this command?
I’ve been playing with it set to 15 (bitmask for 4 weapons) for over a year, and I like it.
Some people say they can't hit anything with it enabled.
Is there any objective answer?