Ideas For Filtering Fake/Redirect Servers

[gamemann]

This issue is to track ideas on automatically filtering fake and redirect servers.

[gamemann]

I've already implemented some basic filtering logic. Most servers also require an A2S_PLAYER response to be considered online which helps eliminate many fake/redirect servers off the bat. However, I would like to not require the A2S_PLAYER response in the future (will go into detail in another issue).

Other things we do include:

• Ensure server user count and max user count doesn't go below or above app-specific boundaries.
• Ensure A2S_PLAYER user list length has an acceptable differential with the user count in the A2S_INFO response.
• Enforce max servers per IP (current threshold hasn't been an issue with shared hosting so far from what I've seen).

Now that we track historical server data including user counts and lists, we could query the data and try to detect unusual user counts and such.

Lastly, I've added some useful moderation actions for flagging servers (support for by IP/range) along with other things.

[gamemann]

One big thing I'd like to implement going forward is an internal server rating setting. The higher the server's rating is, the more likely the server is fake/redirecting. We'll have a threshold for when a server should be flagged and/or perhaps put under review.

Factors that would influence the server's rating include the following:

• How many servers share the same or very similar hostnames and user stats.
• How many servers are running on the same IP along with what type of ports are used (e.g. many redirect servers use random port ranges that isn't known in the game at all).
  • Technically any port can be used for a game server, but if there are 40 servers on the same IP with similar user counts, changes are they're fake.
• The server's IP reputation (from an external service).
• Anomaly detection from historical data (e.g. user counts, etc.).
  • For example, many fake servers have odd historical user counts or user lists (e.g. same players on 24/7, weird play times, etc.).

If we really want to get desperate, depending on the game, there may be some minimal game clients that we could have attempt to connect to servers in the background and compare the IP and user counts of the server in-game and the server that was scanned (for redirect/fake servers).