9V9 TDM/DOM LOBBIES HOSTED BY SND.

So to keep it simple, Cids recently finished his mod menu called Cidshook. It’s a menu with RCE features.

To promote his paid menu, he decided to create bots that join players’ games to advertise it.

https://imgur.com/NtcAWMD


Who is affected?

I think it’s all MW2 servers.

Since the RCE menus back in 2019 (nbot for those who know), people found a way to get all the server IDs currently in use.

When you search for a game and someone joins, a server ID is created, and with that information you can do a lot of things.

Example of servers online:
https://imgur.com/NfWePTg

That’s how Cids makes his bots join using that ID.
He can also crash a server using this information.


Are our PCs infected?

Honestly, I don’t think so.

However, our IPs are being collected, which is why bots keep joining our games.



Does blocking the bots work?

Yes… but not completely.

If you block the IP, the bots won’t be able to join you.
But the problem is that bots join the host of the match.

So if the host doesn’t block the IP → bots can still join.



There’s another, more annoying issue:

Sometimes a bot (I assume) crashes the host of the game.

I don’t know if it’s:

- an automated script
- or someone doing it manually from outside the game

But clearly, some lobbies are crashing for no reason.



What can we do for now?

I found an IP you can block to stop the bots from joining. Open Command Prompt as administrator, then type:

netsh advfirewall firewall add rule name="Block 174.178.61.151 IN" dir=in action=block remoteip=174.178.61.151
netsh advfirewall firewall add rule name="Block 174.178.61.151 OUT" dir=out action=block remoteip=174.178.61.151



For crashes, it’s more complicated. First, it’s not the same IP as the bots:

https://imgur.com/h5eicxb

It is possible to protect yourself, but I won’t go into detail here.

Just in case, you can also block this IP. Open Command Prompt as administrator, then type:

netsh advfirewall firewall add rule name="Block 79.105.162.247 IN" dir=in action=block remoteip=79.105.162.247

netsh advfirewall firewall add rule name="Block 79.105.162.247 OUT" dir=out action=block remoteip=79.105.162.247



Important info! Do all bots use the same IP?
👉 No.

Recently, Cids started spoofing IPs, so you’ll see multiple different IPs.



Is MW2 going to die?

Honestly, I don’t know.

But seeing an RCE mod being sold + bots actively joining games like this… it’s not very reassuring.

According to one of my sources, Cids is planning to leave the Call of Duty scene soon, which is why he’s selling his work.

- SND