- Details
- Written by: Webmaster
- Category: Game Server Setup
- Hits: 166
This article is a collection of what I found when investigating how to block Fake Servers in Counter-Strike Source only.
That guide got so big as I added more games and why Fake Servers are used that I had to split up the topics.
I made a video for those that like that format... basically a review of what is below...
Fun fact: In the video I made a comment about one of the groups using Steam Authentication ID and that a real players name on the live server is sometimes a steam account that does not even own the game.... the server operator is "stealing" steam ID account names and applying to bots. @ about 33:01 I talk of the players names can be traced in Steam IO and you find in the more unique player names only one Steam account has that name. The player name "Squarix" in the video is likely one of those, that account does not have HL2:DM in their games list...so how are they on that server playing that game? They are not... the steam ID authentication has been stolen and applied to a bot.
What are "fake servers" in steam? Read on I found quite a lot more than that.
INDEX
Basic topics on Fake servers |
|
| A quick look at what they look like and how they work (Video) | |
| That is something that goes way back, valid and bad usage. | |
| They can deliver Trojans and other malicious files | |
| The Con - how do they do this? | It helps to spot a con if you know how they work. |
| Who to avoid | A list of the (ratbag) groups. It's smaller than you think. |
| Should you be concerned? | Should you do nothing and put up with it? |
| How to stop them (description) | Links to methods to keep yourself safe |
| Web Game Server lists | Easy - just join a game from a web page list - Links to Website lists. |
| IP Blocking | Various methods using game server IP's - including Tag filtering for some games |
Appendix |
Topics split up in to various games and issues with Fake servers and the security risks to gamers. |
| All about ports and why some servers use strange port numbers. | |
| A list of links on fake server complaints to valve | |
| Counter-Strike 1.6 - many fake servers found. | A look at the (ridiculous) issue in CS 1.6 |
| Team Fortress 2 - Out of control! | TF2 a mess is what that is. |
What is a "Fake Server" in a Game Server Browser?
Basically it is a listing on a Steam in-game server browser that... isn't a real server.
Think of a "Fake Server" as a scam link you should NOT click on.
You click on it expecting to go to a game server with real people playing as...that is what you see in the browser.
I think the best way to visualize this is to watch a video from yahiamice on "x.com" (twitter) as he plays TF2....
|
As if the state of TF2 couldn't get any worse, now they've got FAKE servers with randomly generated names, playercounts, maps, fake players playing that all redirect you to [the same exact Gravel pit server] and pollute the server browser list with their fake entries. |
In that example we see how the server looks like a real server in the list but it is essentially it's a scam link generated (in the hundreds of fake links) to get you to the target scam server.
As you can see, it's a very annoying.
The fake/scam server listings bloating out the server list, it is beyond absurd and around 9,000 + servers are actually...not real.
The redirect function.
The real reason this function is there is it's part of a handy feature on game servers, a popular server is full, the server operator may have a new server and his old one is now set up but has a different IP Address.
So rather than confuse everyone that may have that bookmarked and engage into endless forum posts that inform players the IP Address has changed.
That got abused and Valve removed the capabilities early on, and fixes were made to make it work.
Point is it still works and unfortunately as we saw in the video is used like FastPath.fr did in the video, saturate the server browser, confuse you with differently named servers that all lead back to... their server where they can then apply other tactics and software with the ultimate goal of, getting you to pay them... Money.
That is why these annoying servers are there... scamming.
Not all "Fake Servers" are just a redirect server
Some can deliver a payload of files that are not real game files.
When Spoof Infra Pretends to Be Security... or is it someone who wants to give you a link to a Trojan.
What’s the Trick?
Some fake servers don’t just redirect you — they pretend to be your antivirus and send you fake popups or links to bad IP's.
Seriously. They send you files that look like maps (.bsp), but inside?
It’s a full-on Malwarebytes block page to confuse you while it is trying to connect elsewhere.
You think your AV is working. You think the threat is blocked.
But the truth? That “map” file is a Trojan trigger in disguise.
What Actually Happens
You click a server (like 5.101.218.188:10006)
It sends you a custom map .bsp file — looks normal, right?
Inside that file: HTML code "mimicking" Malwarebytes in this case...
 |
| Fake AV Alert |
Your system tries to contact 91.219.23.142:8080 https://www.abuseipdb.com/check/91.219.23.142 A German IP that looks OK.
Malwarebytes pops up with a warning — again and again and one of the IP's coming in after that are... bad IP's.
It’s not a map. It’s a redirect vector to cover what IP they are trying to connect you to. And the warning isn’t proof of safety — it’s proof you’re under attack.
Gamer Translation
Imagine downloading a new skin for your weapon — but instead of textures, it’s a fake antivirus popup that secretly pings a sketchy server. That’s what’s happening here.
What You Should Do
- Don’t trust tiny .bsp files (under 1MB? Be suspicious) Typically even just 5KB.
- Scan your ...steamapps\common\Counter-Strike Source\cstrike\download\maps folder, see any small files?
- Look for HTML inside map files. Use notepad to open the file, see HTML? Its fake.
 |
| Contents of a .bsp file after downloading off 5.101.218.188:10006 its...a fake. |
Action on that server are obvious, BLOCK THESE RUSSIAN SCAMMERS....
Block CIDRs (IP Range) like 5.101.218.0/24 in your firewall and you may notice your Antivirus has already blocked the attempted "hidden" BAD IP anyway.... that is if you have a antivirus and it's on their block list.
Log every click — track which server gave you what if you have a IP logger.
Why They Do It
- To confuse you
- To delay suppression
- To make you think your AV is handling it — while they keep redirecting to other bad IP's.
- You many get sick of your antivirus warning and allow that IP?
It’s psychological misdirection wrapped in technical spoofing. And now you know how to spot it.
The actual file $2000$.bsp was uploaded to VirusTotal.com basic info was that it was OK. Oh hell no...
File Name: $2000$.bsp
Size: 4.86 KB
Last Analysis Date: 2 months ago
Type: html - contains-embedded-js
This "file" with similar contents has other names....
- $2000$.bsp
- cupdb.exe
- en_US[1].txt
- People-Playground-SteamRIP.com.rar
- sf_init.luac
- AP.exe.... and so on.
So some legit download names there... but the contents of the file is... not a .bsp format and those other files names have the same HTML.
Other custom maps are also the same... 5KB in size so... go check your "download\maps" folder CSS players. mapname.bsp files that are very small (5KB)... delete them, in fact... delete all the files in the download folders.
So how did I get that file... I stupidly clicked on the Join button while talking to someone and recording the IP. The .bsp is the first thing the server downloads and right after that the popup message comes up.
Me not dumb, was just not looking OK.
The Con - how do they do this?
In the video at the start of this article, this is a redirect issue and the group responsible in the TF2 video is actually a French scam group, well known and spam the Steam forums often denying they are doing anything wrong. They are and have been doing this for years as this article outlines.
The Fake server is just the first step in the scam, the scammer is using software like tiny-csgo-server the author describes this as...
“Basically it’s a fake server, not for real server purpose.”
That is used to fake all the items a real server displays, along with further software these scam group have links to their scam website.
One way they get you to go to their site is ban you.
They often pretend that this is a Steam ban (VAC ban) that affects all servers when it's only a server ban, on their scam server only and they will even say it's for "past violations" when you actually did nothing wrong.
They then say you can make a donation... to get un-banned and also offer "Premium VIP membership" that includes damage mods where (you as a scam site "admin" or donator) have more health, or special items like more start money and access to restricted weapons.
The other activity you saw in the video is putting bots on the scam server (yes that same server in the video also fakes the bot count in the browser... but you can spot them here)
In the video yahiamice shows the bots have a real steam ID name, that is a old trick... again a server plugin and other software to fool you into thinking you are on a real server.
We can look at a server IP you get redirected to and see, is it a good or bad IP address? Well no, its not. https://www.abuseipdb.com/check/164.132.201.109 Look at the reports at the bottom. Port Scan, Hacking, Exploited Host.
The report latest was 1 month ago at the time of writing. They will change server IP's when it gets a really bad name.
Is that normal for a game server? No, unless the game server happened to pick up a new IP that had previously been used for attacking other IP's.
- Most well known good servers have no reports
- Most Fake Server IP's have bad reports, some in the hundreds
As you load these servers your antivirus may even notify you and disallow the connection as that IP the game server is on is really rotten complete and utter excrement you should wipe from your PC and flush it.
Who to avoid
In this section we will explore the groups of IP's that you can connect to a group, a website.
Its a... "Who are these morons anyway using Fake Servers" guide.
Now this must be read with caution, it's not the focus of the issue, I am looking for a solution to block the IP's.
It is possible persons or groups I found have been hijacked so the fake server blame goes to them.
But it is also possible these groups are responsible... especially if you test a fake server IP and it does in fact go back to a server of a group... (Fastpath.fr looking at you) .
When you find an IP that does that... note the IP of where you got directed to, block it especially, its the whole reason 200-1000 Fake server IP's are there.
Past or BAD RU IP Range -
In this group I found Fake server IP's (different names) that are not always on, however there was enough on those many IP ranges to blacklist, some come up in Abuse IP as a risky IP, some just reported players in the "Players" column and in the Game Info panels there were none.
Will there be any good servers blocked in this group? Maybe but all will be Russian anyway. Who cares? Russian players might, you may not.
ATMMIX.RU - Fake servers -
Now before we go nuts here, read this topic in the Appendix first. The below could be true, then again the fake server group could be... a rival server operator?
This obnoxious pack of potential scammers were the most prolific and reports on Abuse IP were many and concerning. Avoid them, they have their own Steam Group if you want to know who they are, that is what they want you to believe they are. https://steamcommunity.com/groups/atmmix Here is the translation on that group page...
ATM-MIX is more than just a tournament project with mixed servers. It is a community of players united by their love for the classic version of Counter-Strike: Source. Here you will find friends, like-minded people and the opportunity to immerse yourself in the atmosphere of the good old days.
The ATM-MIX platform regularly hosts various tournaments and competitions, where participants can demonstrate their mastery and team play skills.
If you want to join the ATMMIX community and try your hand at classic Counter-Strike: Source mixes, be sure to visit the project website, register for tournaments or just enjoy our high-quality servers.
A "tournament project with mixed servers" oh really? This got me... "... just enjoy our high-quality servers."
Do not go to their website.
No thanks Fake server morons.
On that page they list their main server IP 37.230.137.126. A look at that IP in Abuse IP and... its complete shit. Port Scan, Hacking, Exploited Host.
Need to know any more why all their IP Ranges they use made the blacklist? Think of this as well, they claim to have 390 "members" how many of them do you think are real or Steam accounts with bots on them?
[SERVERIGR] -
They triggered for a few fake servers and not sure who they are, they are Russians and didn't look good. Avoid those. Update... 19th September 2025 they put up a new IP and many servers IP range 213.226.112.0 was used. Its located in Russian Federation, City Kazan, Tatarstan Republic.
Again... you should consider avoiding all Russian servers as it's easy to spot the Russian language in a name....and if you don't speak Russian...block them anyway, you will likely not go there because of the language barrier and secondly, it could be the scammers "legitimate" or main server (full of VIP, "pay to get un-banned" scams, and other paid "services") and is... the fake redirect server's final destination, the whole reason they put up the fake server in the first place.
This goes to show that the groups (Russian scammers at least from what experienced) "sit" on IP's and have automated releases at different times, time of the day, week or if they are smart the month, likely to avoid detection and blacklists.
That is the "cat and mouse" game I spoke of earlier, when YOU block via IP ranges that takes out a lot of alternative IP's for THEM that could be sitting on ready to release the next day.
Easy for you to do, harder for them.
MЯСОРУБКА (Meat Grinder) - Fake server -
Another small group and the Players column didn't check out with Game Info panels so... their servers are Russian anyway obviously they are on the list.
c400.ru - Fake servers -
Quite a few IP's triggered in this group, who are they? http://cssbans.c400.ru/index.php?p=home They have a Sourcebans page and other things. Not sure why a valid gaming group needs to run Fake servers but they sure do. Russian servers/IP's... they have a stink around them.
c400.ru is a valid website... you will get warned in your browser not to go there... so don't. However I did... they are what you think, a group to avoid.
Many (bad) RU sever names -
In this (stinky) fake server group when I checked on Abuse IP the servers in this IP range came up in Moscow, Russia and some hits of bad activity. Avoid.
SGaming.RU (Source Gaming.ru) - Fake server - Dangerous file downloads... if you have not got a decent Antivirus
This was one of the larger amount of fake servers along with ATMMIX.RU.
In this case its a group called Source Gaming.RU
https://vk.com/sourcegaming_ru
Do not log into that website, it's all Russian anyway.
Some IP's say they are from Ukraine, some say Russia, the language on the website is in Russian.
5.101.218.188 - 91.243.84.28 - 91.230.211.62 ...and so on as they change IP's... like underpants (All in Russia)
Some are in other countries but that does not matter... Russians are behind this in CSS and CS2.
The same IP's also have the ATMMIX.RU name in them.
Non-Russian server IP's or not... there were too many IP's that came up suspect, other language gamers... best to avoid.
I didn't see anything on Abuse IP like many of the Russian servers had but...avoid because they fill your game browser with...shit.
Also... some custom map servers you should NOT connect to those servers
Look at this in the Appendix area on the custom map $2000$.bsp. That was from this group.
Update: 9 Sept 2025. This SGaming.ru group added two new IP's, they are both holding the same fake $2000$.bsp file. The new IP's are...
- 188.212.121.141 an in-game IP Range block 188.212.121.0 is recommended. In the windows firewall... 188.212.121.0/24
- 212.192.214.244 an in-game IP Range block 212.192.214.0 is recommended. In the windows firewall... 212.192.214.0/24
Note1: This is interesting, the ISP is RCS Technologies FZE LLC. They are in Ajman in the United Arab Emirates. Specifically, at Flamingo Villas — (prices are just under USD$1M) and also a known business registration zone for small tech firms and shell entities.
Just the kind of place a Russian would like to set up shop.
Note2: The IP's step away from their normal Fake servers in that they are in Iceland and Portugal. This expansion into non-russian named IP's isn't common for this group.
There is a IP block you may also what to add for that ISP group... 176.126.174.0 that's up to you but I already saw enough to block that ISP entire range as well.
Another final point. The "quick fix" of putting certain words in the tags area with do not include... does block these two new IP's. So that proves, just a IP block alone in CS:S you need to update your IP's about a week apart.
However, the tags method will predict new ones and at least stop them appearing on the servers list... but really you really should block these in a Windows firewall rule as...they are known to deliver malicious files.
[GO-MEAT.RU] and others
A small group with common IP's and different names. Russian, Saint Petersburg.
They triggered on Fake Servers so...on the list.
I think it is this group... https://cs-meat.com/ They could be OK, server IP's in this IP group were bad and they got bundled in with them, same IP. They run the similar VIP purchase membership others do so... if you are not Russian, how are you going to pay anyway...and do you really care?
There are others, but that is the best I could do on grouping the ones I found who had multiple suspect server and looking at who...was behind those IP's.
bc18go.ru
This small Russian group comes up for CS2 and CSS servers, their servers when looked at in the browser is hiding the bot icon/bot amounts. They made the list as they are manipulating the info' to players. Their website https://bc18go.ru/ you can see the same old "VIP" pay for services to get better at the game. Some of their IP's are in the same as ATMMIX.RU above.
They are obviously falsifying the sever list... they stink because of that.
cs-ds.ru (Darkside)
A small group and the server IP's are related to other bad IP's like ATMMIX.RU above.
Looks like a small outfit https://cs-ds.ru/ or just a copy/paste website with the same stink as others... VIP "services".
Primarily they are a CS2 group, their data in the CSS server looked altered in player numbers so... they are blocked.
BATTLE-STRIKE.ru NoSteam Bad IP
Looks like a small no-steam group. Same VIP / un-ban garbage.
This is a Russian group with a Netherlands, Amsterdam. No problem blacklisting as it looks like a place Russian speaking persons (just look at their website) use that you may not.
The IP has a bad past history but 4 years ago...
103.90.75.65 = old past Bad IP https://www.abuseipdb.com/check/103.90.75.65 Port Scan, Hacking, Brute-Force, Web App Attack.
They have a Steam group... https://steamcommunity.com/groups/battle-strike
On the list, no-steam and old bad IP and Russian speakers are enough if related to an .RU group you may never visit. Didn't block the entire IP range only 103.90.75.65 and that had three IP's different ports, that is a Netherlands IP and valid servers may use that in the future.
FastPath.fr - redirect servers donation scams
Well known scammers that operate in a lot of games, well known and blocking 164.132.201.109 (they could change that over time) blocks all their games and if put in the windows firewall also their website fastpath.fr.
Lots of posts about them this article starts with a video of them in TF2, also present in CSS Reddit , Steam CSS Forums
As you can see in the (many) steam forum posts, their admins monitor the posts and post drivel to try and combat any complaints.
They are a steam group headed by this french identity who seems to go way back (2010) who always shown a keen interest in fake servers and hiding Fake players. Augments in the steam forums on their tactics are there for all to see.
They claim to be always full and no bots. That is a lie and comparing the in game browser that shows a full server and no bots, a check on a web based list where the bots can be detected, there are more bots than humans. On top of that the names of the bots are from real or bot steam accounts, with fake chat.
The whole scam here is to get you to their servers, that are full of bots with stolen Steam Authentication ID's, and the users chat history. They advertise "admin" access for a donation that comes with damage mods... giving the "pay to win" "admins" an advantage on the server.Then when called out the admins will attack you on-line to defend their brand. (Page 2 of this link Fastpath admin Salamander used doxing to revel the persons real name (post removed now via complaint but the authors post reply on page 2 remains) and also tried to say the author was a cheater... with absurd "evidence" from Fastpath chat....lol what a noob.
Sometimes they will ban you, pretend its a VAC ban and get you to pay a donation to a server.
The layers of deception start with their server list in the game browser and cross into basic fraud, gaining funds via deception.
Their mistake is trying to pretend to be legitimate and behind the main servers they use a con mans playbook and a lot of software scamming to deceive you, then attack complaints with moronic attacks.
Should you be concerned?
Well, if you are not convinced connecting YOUR PC to a known scammers IP... I don't know what to say :/
If you are running a decent Antivirus and have your firewall on you should be OK. Do nothing.
However, do be careful on what you click on, you may end up having to clean out your game files.
Blocking them in the first place might save you a lot of work later on.
That is how I got interested in this topic, I clicked on a fake server just below the actual server I wanted, in a few seconds I had downloaded a fake .bsp file and was getting redirected to a known bad IP address that my Antivirus blocked. Had I not had a antivirus, the Trojan on that IP would have taken control of my PC.
Think of blocking Fake Servers like a Antivirus for your favorite games, cleaning your browser.
If you are concerned below we can explore various methods from quick and easy to very comprehensive using the links below.
How to stop them
- Web Game server lists would be the easy option but don't alter your in game browser.
- IP blocking (and Tag blocking) for your in-game server browser has a few methods, from Tag filters and server IP block in a few games to a more advanced filter list you can download and insert to the game folder files to a firewall IP block list that will block bad IP's on your entire PC.
Each of the two methods have different choices and each has its pros and cons. Read on.
Web Game Server lists -
For some the replacement for the in-game and main (very broken) Steam "Game Servers" browser.
These services all have different methods to weed out servers that are not acceptable to join... but are in the Steam game server browsers.
CS2 only
CS2 Server Browser: This web list is a must have for CS2 players. On checking they seem to have robust filtering in the background, also they have many other custom filters to find a game based on filtering.
Pros
- One of my favorites is the "Regions" and even better "Country" filter. Don't want the (cough Russian) servers at all? Select the country of your choice or tick more than one and select from that.
- Again... Filters that reduce based on game type and other categories makes this list #1 for CS2.
- The ability to add favorites.
- The general look and feel, the country flags and the map images are a good touch, it has a blend of a comprehensive amount of information but in a simplistic format.
Cons
- None yet but I suppose adding more CS games like CSS and CS 1.6 would be helpful.
TF2 only
TEAMWORK.TF: Nice site and again you can filter a lot more than the Steam browsers. I am not sure if
Pros
- Bot-heavy servers are flagged and shown separately in their Quickplay GPS and Map Statistics.
- Empty servers with bots (a mark of Fake server spam) are often listed under “Community” but not prioritized in Quickplay.
- Redirect traps and fake ping servers don’t appear prominently — suggesting backend filtering or manual curation.
- Community based and driven.
- Reddit threads and GitHub issues confirm that fake ping servers flood the Steam browser, but don’t show up on teamwork.tf unless manually searched.
- Players report that teamwork.tf is more reliable for finding legit EU/NA servers, especially when spoof infra dominates the browser.
Cons
- Only one niggling thing, I see the Fastpath.fr server is there, a known scammer that hides bots in the Steam browser but they cannot here proving again they purposefully lie to visitors. That server is not safe as many know and some do not... it is a risk displaying well known scam groups like this and part of the FastPath.fr scam...to look legitimate and hide the scams at all cost, it works.
Lots of games
GAMETRACKER: Well known and they go back a ways. Considering that they are one of the best places to go for older games. Its a old school listing site with game server ranking, that means if your server is returning some sort of bad behavior, your server get a rank of "NR" not rated (like Steam puts Fastpath DoD:s as #1 based on player numbers and in this list its last) and the owner... could also be banned.
Pros
- A massive amount of games especially older titles.
- Very strict rules, step out of line and your rating turns to poo...matching your server.
- Community reports help.
- Good servers have good ranks.
- Can add favorites.
- Has a forum.
Cons
- The site is a bit dated, in saying that, it is very easy to navigate and functional.
BattleMetrics: Another well known web list and has a decent amount of Steam and other game titles. CS2 isn't there but CS 1.6 and CSS, Gary's Mod, TF2 are. They have some interesting filter and search functions, you can use that as it is or make a account, further they have a paid membership that increases the statistics they gather, see the "BattleMetrics Premium Features" on the bottom of this page.
Pros
- A good spread of popular games.
- Bad Server filtering - CS 1.6 that gets 6,000 to 11,000 servers in the in-game browser typically only gets a 2,000 server total. That means they do filter servers. If click the drop-down link "Tips and Tricks" above the server list you see "The "NR" rank means that a server is suspected of botting, inflating, or otherwise distorting its real player count. These servers are hidden from the server list by default but can appear in your term-specific searches. We advise avoiding these servers for your safety."
- Find server filters and search - many ways to drill down on distance to a server from you, countries to include or not. The search bar has wild cards so make sure you click on the "?" button to see some advanced prefix's before your text
- Player search - It's comprehensive and increases with membership.
Cons
- It would be handy to see totals of servers after you filter e.g.: Country filter, select NOT and tick Russia, there is no indicator on how many servers dropped. That could change with a log in or the premium membership.
- Cost of premium membership is high @ US$ 5 per month but that may be a value for stats nerds or server operators tracking bans with the RCON feature, that does have a 7 day evaluation to try it.
GS4u.net: Game servers monitoring service. This site has a large games list, they have been around since 2008. There are paid services for game server monitoring that would mostly interest game server operators not players.
Pros
- Huge amount of games.
- Bad server filtering - Default pre Filtering is present, like others look at the "Games" page and find CS 1.6, note the number beside it at the time of writing (1972) typically the CS 1.6 in-game browser delivers 6,000 - 11,000 servers indicating bad servers are actively filtered. They don't show much to the user how they do this.
- Find servers filter and search - searching is some by selecting a game from the right side search module. Unlike BattleMetrics this does not have a include or not function in the "Countries" selection, that just allows one target country only and a option for a Map name and also a IP address. This is fine and the amount of searches while it isn't a number to see how many servers dropped off the list, there are "page numbers" at the bottom of the page. There is no "region" selection.
- Player search - None found
Cons
- Not as many filtering options as others but the pre-filtering of bad servers and country selection while basic does do a good job.
IP Blocking -
A DYI method, some easy and some harder. Best if you like using the in-game and Steam browsers and don't trust the Web Game Server Method or... there just isn't a good web based list for your favorite game.
CSS Only
Fake/Scammer-Server Blacklist: A Steam CS:S guide by "Dennis" This is a CS:S only list and works by a Blacklisted Server txt file installed in the CS:S game folder.
Pros
- Works well because it is updated and monitored by a CS:S player who does the hard work so you don't have to.
- Easy to install. Instructions are in the guide.
- Comments are allowed in the guide to ask questions.
Cons
- It is only for CS:S. That is fine if that is all you need.
- Unlike the web lists you need to install. In saying that, it will beat some of the Web lists and reduce spam further.
Other games
CS:S (with other games) dodbits guide: Block bad servers in the CSS "Find Servers" and "Blacklisted Servers" tab
A guide on some traditional and easy to do fixes for Counter-Strike:Source that (the easy method) can also be used in a small amount of other Steam titles, depending on what game it is.
In saying that, the advanced method will affect ANY game server IP no matter how you connect to it... it will be blocked.
Pros
- Unlike the web based lists you can personalize this yourself, deciding what you think is a bad server.
- There are levels you can do from easy to advanced, in CS:S and other Source 1 titles like TF2 Tag filtering is very powerful and easy. You can then look at the list and add any other servers via the "Blacklisted Servers" tab and reduce the list from 11,000 to 100-200, quickly.
- The easy method does work in dod:s, TF2, HL2:DM so long as the game server browser supports Tag filtering and IP black lists.
- The advanced method while more complex by using your PC firewall, filters your in game AND the general Steam "Game Servers" list including CS2 that can display 15,000 to 20,000 servers and a IP block from a list can reduce that to around 1,000 "good" servers.
Cons
- The IP block lists are generated by others or yourself and require maintenance. Either by yourself or by downloading and installing a updated list. Some early testing indicates you may have to add 1-3 new IP's every now and again after you make a list.
- The advanced method while documented and easy to do, requires you to launch a windows terminal to add bad IP's, while that works better than some of the web based lists, it does require you to spend time on it.
- Blocking IP's can also disrupt website access, it is very rare and depends on the list you use.
(More to come soon)
Appendix
Below here are "Fake Server" topics in various games and the issues concerning risks and tactics they use and you can use against them.
The ports used in Fake server IP's
If you look closely at the many consecutive ports and you know about game server ports you will see the ports on a real server are different to fake servers.
Are the Ports After the IP Address Valid?
In legitimate servers: Yes, the port (usually 27015, 27016, etc.) is critical.
It tells the client (your PC) which process to connect to on the host machine (The Game server).
Game servers use these ports to handle incoming traffic, and they must be open and correctly configured for the server to function.
In fake servers (redirect traps):
The port doesn't need to be valid for gameplay—it only needs to be valid enough to appear in the server browser and accept an initial handshake.
Here's what spoofers do:
They run a lightweight listener on a port (e.g., 27018) that mimics a real server.
When a player connects, it immediately redirects them to a different IP:port combo (the real target server).
The original port may not host a playable game at all—it’s just bait.
So yes, the port is technically “valid” in the sense that it responds to queries and appears in the browser, but it’s not hosting a real game session.
It’s part of the scam.
Reports to Valve Software GitHub issues list.
Source-1-Games (All)
[ALL SOURCE GAMES] UNPLAYABLE: Server list filled with spam #5101 (Open) July 31 2023
[All source games] Steam auth exploit/harvest by scammers #3857 (Open) Feb 27 2022 Based on HL2:DM and a known scammer group Fastpath.fr whom you should avoid. A good example on why fake redirect servers are a part of a wider revenue making scam using Steam games as the platform to rub their scams. Blacklist their main server IP's in all games.
CS2
Duplicate and Redirect server #2540 (open) Oct 19 2020
Fake communnity servers (servers browser list) #2689 Mar 5 2021
TF2
[TF2] [Exploit] Rampant FAKE SERVER PING issue; players are misled joining 400+ ping servers! #4484 (Open) Nov 6 2022 Fake server ping issue only`and in that issue the tool "compressor" is named as the program used to fake ping results in the Browser.
Goldsource games CS 1.6 mostly
[GoldSrc] Method of displaying fake players in server browser bypassing Master server #3805 (Solved) Aug 28 2024 A issue on the "displaying fake player counts" that was fixed in a May 26 2025 update. Read the first and last post.
(Halflife) Fake servers in Counter-Strike #2064 (Open) Jan 29 2013. 2013 ...and not solved yet. Shows how old the issue is. the last post at the time of writing was Jul 22 2025.
L4D2
[L4D2] Did valve know your matchmaking system in L4D2 was cracked and hijacked ? #5297 (Open) Oct 30 2023 Matchmaking system link hijack issue, video of the issue.
Counter-Strike 1.6 - many fake servers found.
This looked as bad as Counter-Strike:Source. I was surprised when looking at the in-game browser and seeing over 9,000+ servers in the list.
Now before testing I removed the Windows Firewall IP list, its easy to do, see here.
Using the same methods I used for the CS:S blacklist of...
- Filtering the list by IP Address (Click on the column title to do that),
- Looking for the normal huge groups of the same IP and ones with 100-200 different ports
- Copy the base IP and do a Abuse IP check
- Looking at the list to see if any gaming group is mentioned in the Server name (Scammers do that)
You first notice that yes, some of the bad IP's found in CS:S are also in CS 1.6 but not many.
If you remember from above the main culprits in CS:S were Russian IP's, in CS 1.6 the issue is flipped to Chinese IP's with others in the Asian/Oceania regions like Singapore and even Perth Australia. There are Chinese speaking communities in those regions so it makes sense for the scammers to rent a server/IP there and target fresh victims.
That country of origin statistic could be a demographic preference, the basic Chinese speaking populations and some of the poorer regions prefer the older HL1 CS.
The "culture" in different games is also an interesting topic, the Fake Servers and the scams that these groups apply overlap into different games depending on what the players are seeking in a server.
The "VIP" access in all CS games of gaining a advantage by extra health, access to higher start money and other advantages over other players on the server is somewhat acceptable in the CS games. Gambling is als0o a problem.
I wondered why in my favorite game, Day of Defeat 1.3 (HL1 Goldsource like CS 1.6) why fake servers are just not a thing.
If you know that culture, it's very "conservative" and a CS player to a dod player, lets just say they are a world apart and default settings in dod and even dod:s is something you get reminded of on joining a lot of dod servers... a normal CS player "pistol rolling" will get banned very quickly. In CS binds and "scripting" is common, in dod... it's common in the competitive leagues to ensure the game is played with strict defaults.
Back to the findings...
- Yes the Chinese IP's (or IP's in Chinese speaking areas) in CS 1.6 are a huge issue.
- On adding more IP's to the list, there were some that were also in CS:S but only around 5 of them. Proving that above item, Russian based IP's were rare when in CS:S it was overwhelmingly Russian IP's the Fake servers came from.
- There are a lot of private servers due to players not un-ticking the steam networking feature and playing a *local game that everyone can see. That is an issue that is seen in all games but in CS 1.6 after the fake IP's are taken out, the steam networking group looks like half of the remaining servers in the browser.
*local game Steam networking servers are single players putting up a local sever (most include Valve bots and perhaps another player) that we can all see in the browser like "<steam player name>'s Server" will also display a special IP starting with 169.254 then the 3rd number, 4th and port differ.... e.g.:169.254.X.X:portnumber
This 164.254 IP address is a "Link Local" type.
The cycling server name issue.
The other strange behavior I saw on (some of) the CS 1.6 Chinese IP's was Right-Click and select "View Server Info" now look at the server name. Note on some the server name changes every 5, 7 or 9 seconds or so.
Also note the Score and Time remain the same but the players names are changing, go to the next server on the same IP but a different port and you see the same Score and Time with player names (same as the other server but cycling) and the server name is also changing.
Watch the image below for at least 7 seconds. The server name changes, in other servers I noticed player names also cycle but the score and time NEVER change.
 |
| A Game Info screen in CS 1.6 - the name (and not shown also players names) cycle and change |
To change a server name requires a server.cfg to be altered and a restart, but these servers are doing that in 5-9 seconds apart?
Obviously, Fake.
Team Fortress 2 - Out of control!
This is a mixed bag. The server browser is a complete mess.
TF2 being a free game you would see more IP's added.
Some Fake server IP and IP ranges from CS:S and CS2 are also in this game.
Any game with skins, trade and a micro economy attracts a lot of scams.
However, the Russian and Chinese IP's being dominate in the two CS games does not seem to be noticeable, the bad IPs can be from anywhere and not being 100% a TF2 player, harder to make a choice if a server IP group of say 50-70 should be onto the list.
I need to get into that game some more but I did see lists of past known redirect servers in CS:S and HL2:DM (like FastPath) and those IP's were active in TF2.
The list I made to block CS:S was 319 IP ranges and individual IP's.
In CS:S when I started with 30 or so, kept blocking over a period of a week and finally stopped seeing new Fake servers after around 197 IP ranges were added and blocked.
In most games tested that display 6,000 - 9,000 "real" servers in your in-game server browser, all of these drop to around 100-300 with games like TF2 and CS2 having 1000-2000 servers after the list is in the Windows firewall incoming IP block rule.