Pages

Friday, January 17, 2014

CCP's War On Bots And Illicit RMT: Forgot To Stop

While CCP lost another familiar face in its war on bots and illicit RMT in EVE Online, that doesn't mean the war is over.  All indications show that CCP Peligro and the rest of the gang (whoever they are) are still hard at work.  At least the folks running the Questor bot know first hand:

7 January
Echu - "12 down, no rmt, diff ip 7-8h per day, fresh chars, The reason specified was: EULA/TOS Violation"

11 January
bbday - "did you use vpn?"

14 January

Echu - "yes"
15 January

bbday - "this is the problem: maybe another people that use same vpn was banned for rmt/client modification and then ccp ban all people with same ip logged in same time.  You can also open a petion and say to ccp why you banned me... maybe they can say because some people with same ip and doing bad thing... better idea say them i used a vpn because i have network restrition on my office."
16 January
Echu - "No, I rented a server, buy IP-addresses and put own vpn server. Petition opened, but no answer."

For those with a long memory, bbday was mentioned in Eve News 24's Honey Botter botting exposé.

This little story helps demonstrate why a slow, constant ban process is better than big ban waves.  Whenever caught, botters will petition on the chance a GM will lift the ban.  Big ban waves wind up overwhelming customer service desks, affecting real customers with real problems.  Smaller numbers are more manageable for game companies to staff for.

Looking at my inbox, I received two interesting emails this week.  The first was from a German player who received a ban for something he posted in the German help channel.  Someone was asking what an ISK spammer was, so he created his own example.  A few seconds later, he was logged out of the game and when he attempted to log back in he was given a message stating he was banned for a EULA/ToS violation.  He figures that because an ISK spammer 6 weeks previously was able to spam for a half-hour that CCP has now instituted some automatic detection.  As he put it:
"As I was banned within seconds I feel like finally there is an automatic script scanning the chats and this script is allowed to make permanent bans (even an english speaking GM would have had seen that I was giving an example using a fictional price and an invalid URL to answer the question... so I guess there was no GM involved)."
He put in a petition, but he thought he'd let me know about the automatic detection.

The second email came from a diligent corps recruiter who, when handed the recruit's API, saw the recruit's transaction history.  A little digging led the recruiter to catch the recruit in a lie over some questionable transactions.  The recruit admitted to buying ISK from AvatarBank.  However, the ISK seller gave the recruit items ranging from carrier skillbooks to wormhole ribbons instead of directly giving ISK.  Was this due to trying to avoid detection by CCP or as a result of the ISK shortage back in late summer and early autumn?  A pretty good piece of anecdotal evidence since we haven't heard any official word on exactly what happened.

Speaking of ISK sellers, the project I referenced in yesterday's post involves trying to track the amount of ISK sold on PlayerAuctions.com.  Last month I did a post where I made some guesses at the amount of real world cash used to purchase virtual currency.  I'm glad to say that half-way through my effort that it looks like I wildly overestimated the amount of transactions.  While I can't definitively state how much, I'm pretty sure that the numbers aren't as bad for EVE Online ISK as I thought.  Based on the parameters I listed, I originally thought that around $50,000 worth of ISK passed through the site on a monthly basis.  But after 15 days, I've only tracked 442 billion ISK in sales for a total of $8,479.32.  Looks like I'll have to go back and update that post when I finish the study.

Did I mention that PlayerAuctions has a review system?  Apparently the site isn't entirely safe to use.


I probably need to learn how to use something like Photoshop, but Paint was good enough to put together this collection of displeased customers.  And yes, those last two were complaints about the same PLEX seller.  For some reason, he took down his PLEX sell order yesterday.

Finally, I don't have a chart showing the prices for ISK sellers, but another seller of virtual currency stopped selling ISK.  A site called MMOXE removed references to EVE Online on 7 or 8 January.   That makes 8 sites that I've monitored that have stopped selling ISK since the middle of September.  That's pretty impressive since I only have 13 sites on my list.  In contrast, I also have a list of 12 sites for Runescape and none of them have stopped selling gold over the same period of time.

That's just a quick review of what's happened in EVE's shadowy world of botting and illicit RMT over the past two weeks or so.  I hope to have some graphs and charts and stuff in another couple of weeks, so I hope this will hold everyone over until then.

8 comments:

  1. Ban first - ask laterJanuary 17, 2014 at 11:52 AM

    <- the guy who got banned after posting a fake RMT offer as an example for ISK spamming.
    23h after I opend a support ticket and asked to hand it over to a german speaking GM to read the chat log the ban was lifted.
    I'm very happy with how fast I got banned... even if I did nothing wrong. That may sound strange but I remember endless hours of RMT spam in other games (e.g. Diablo III).
    Of couse, next time someone asks what is meant by "Report ISK-Spammer" I simply give him the link to evelopedia ^^

    ReplyDelete
  2. Does it seem to anyone else that the new ESS deployable structure has some potential for being used against bots? If you think someone is botting and can't catch them you can anchor an ESS and come back a few hours later to pinch a chunk of their bounties right?

    ReplyDelete
  3. The link to Riverini's expose piece on the HBC at the end of 2012 doesn't work. EN24 returns a 404. The article is still available here:
    https://web.archive.org/web/20130115004139/http://evenews24.com/2012/12/30/the-honey-botter-coalition-an-expose-on-botting-within-eve-onlines-biggest-coalition/

    ReplyDelete
  4. Do you ever get see hints or rumors of direct items-for-cash RMT activity? For instance let's say I want a Titan. I could buy isk for RL money from an ISK seller, then use the ISK to pay for the Titan. Or I could ring up the guy(s) who manufature Titans and offer to pay RL cash for the ship directly. I wonder if that method of RMT takes place on a large scale? Going after the commercial ISK seller sites works, but if parties to a RMT transaction cut out that middleman then there is no record of the transactions to leak or tie to specific eve accounts. For large transactions such as that, either a Titan or, let's say, a bulk purchase of Dreadnaughts or Carriers, I don't see how CCP could accurately trace those transactions without access to peoples' RL bank account data, which they're never going to get.

    TL;DR putting the ISK sellers out of business is good, but by itself doesn't mean all RMT activity is getting shut down.

    ReplyDelete
    Replies
    1. Sure. PL even reported that some of their renters wanted to pay via PayPal. Also, the new site I'm monitoring also has people selling characters and items.

      You're correct about RMT will happen even without the professional ISK sellers. But right now monitoring the ISK sellers is the best way to tell if CCP is still actively engaged in fighting those engaged in illicit activity.

      Delete
  5. If you need something better than paint just use gimp. Its free and for most of the default task easy to use. Buying photoshop for getting some pictures done would be overkill.

    Would be nice to learn something about the team security gang. They all deserve a proper thank you from the community.

    ReplyDelete
    Replies
    1. Thanks for the tip on Gimp! And you're right, it would be nice to know more about the security team. Perhaps we'll learn more at Fanfest.

      Delete