Thread: Account Links and Suspensions

Basics

Accounts can be linked in many ways, lets get the instant links out of the way:
- Same payment method
- Same name and address
- Same battle.net

More vague:
- Hot IP (one that has received a lot of suspensions)
- Username/password similarities
- Exchange of gold between characters
- MAC address

Now a lot of suspicion has always circulated about WoW or Warden attaching/reading your MAC address, SUID, Hard Drive ID, and other hardware ID's thus being able to monitor which game accounts are connected from which PC. This means that even using a clean proxy IP that may be shared by other players such as a tunneling service like WTFast or GamePath does not make you safe. By eula terms, only the MAC address could be obtained by Blizzard servers, unless of course it is being breached.

Whenever you interact with a server, the server has access to your IP address and your MAC address. Because it needs to know which computer on the network to return the packet to, and your MAC address is the unique ID of your computer on your network. Tunnels and VPN's will not change your MAC address, the packet will pass through all of these with your computers network card MAC.

Lets show an example using a computer with 6 bots running

When an investigation is conducted on an account Blizzard might see how many accounts are running on the same MAC address. perhaps hardware ID's. This means that your investigated account will show that there are 5 more accounts connected from the same PC. They can instantly suspended all 6, even if not all of them are using bots, because Blizzard determined that if a computer is being used by someone, right now, that means all the accounts belong to that 1 person.

Now this gets fuzzy when you wonder if Blizzard has a history log of MAC or hardware ID's, or if it's done in real time. Lets say I am hacking from a netcafe today, but yesterday a legit player gamed off the same computer. Does he get banned too? From much speculation, the answer is no. Blizzard can only link your accounts by hardware ID if they are connected to WoW. This means that the Ban GM has to catch you in the act. Otherwise they can only link your accounts by the basic methods. We all know Blizzard GM's have a work schedule 9-5, and sometimes work overtime for ban-waves.

How to increase security

If you can avoid botting during the working day, you should be much safer. Also, you need to do something to warrant an investigation. Some of the big ones are constant player reports and automatic flags. If a server GM sees players complaining about a bot, he just might pass that on to the Ban GM, and pend the account for investigation. Now lets say you don't afk bot, yet you still get suspended. This means your account triggered too many automatic flags. Give yourself a pat on the back if you made it this far, these can take 1 month or more. When you have been killing the same thing over and over, been online 24/7, not doing any instances or PVP, you are definitely acting suspicious.

After getting suspended or banned

After every suspension necessary precautions need to be taken, or you might notice your accounts getting banned at a very rapid rate. Some even skipping the 3 day suspension stage and going straight to banned.

- Refresh or change your IP. If you are using a popular tunnel service then no need.
- Change your MAC address.
(I noticed that you cannot copy+paste a WoW folder to a different PC. You get a connection error, but resetting the MAC address makes it work)
- If Blizzard scans for other hardware ID's beyond MAC's, such as the SUID, you will need to format and reinstall windows.

Yes, reinstalling your operating system is important to gaining a new identity in World of Warcraft. freewowguide.org

- With the recent lawsuit against warden people are not sure if WoW records your SUID and other hardware ID's.

Warden now scans Warcraft game memory space only, with exception of a few tools (rootkits). Warden

Blizzard may check for more than one d2 per cpu id connected concurrently, but i would think this would be an invasion of privacy in spite of the eula.
D2 Warden

Further speculation

- Warden works poorly on Macintosh, and works slightly differently on WINE.
- With Sandboxie you can designate a specific space on your hard drive for wow, and block all interaction with everything outside this space. It allows users to run multiple copies of Diablo 2. http://www.sandboxie.com/


Tools to change your Hardware ID's http://www.mmorpguides.com/forum/MAC...ed-t25554.html

To determine if you are behind a VPN or not use http://2ip.ru/whois/
Ex: office IP 121.234.110.37. I see the Resolve Host: 121.234.110.37. Match
StrongVPN San Fransico 68.68.45.157. Resolve Host: 157.45.68.68.client.static.strong12.reliablehosting.com. VPN
home VPN 174.152.130.133. I see CPE001b115d6552-CM00111a59c17c.cpe.net.cable.rogers.com. This VPN is hidden.
home IP 174.152.130.1. Resolve Host: 174.152.130.1. Match

Everything posted is currently in testing. Things will be kept updated as best they can.
- April 07, 2010
- April 08, 2010