Connections to Cheat Servers: What the Network Check Sees

Most paid cheats and loaders are not just files: they log in to a license server when they start and stay connected while they run. Since version 0.0.15, AACGUARD checks for those connections in the full scan and in every AACGuard Live check. This guide explains what is checked, what is not, and how the results are weighed.

What is checked

1. AACGUARD asks Windows for the list of open network connections and which program owns each one. This is the same list netstat -ano shows.
2. It reads which website names your PC itself recently looked up, from Windows' own DNS cache, without making any network request.
3. If a connection goes to an address that belongs to a known cheat site, the program that owns it is reported.

AACGUARD does not read the content of any connection, does not capture traffic and does not look up cheat sites itself. Version 0.0.15 briefly did the last one, and it caused false results; the full story is in our research article When a detection polluted its own evidence.

How it is weighed

• A normal program connected to an address that only a cheat site uses counts heavily: it is very likely the cheat or its loader.
• A program connected to an address that many websites share, such as a Cloudflare address, counts as a lead, not as proof, because the same address also serves ordinary sites.
• A browser or Discord connected to a cheat site counts only a little. Visiting a website is not the same as running a cheat.

The finding names the program, the cheat site and the address, so an admin can check it.

"Cheat site looked up recently"

A separate finding lists cheat sites in Windows' DNS cache even when no program is connected right now. These findings together count at most 75 points per scan, however many there are, so a single event (for example a page that pre-loads links to many cheat sites) can never fill a scan with dozens of findings. On their own they can make a scan SUSPICIOUS at most.

Things that do not count

• Reading an article about a cheat, or a news site that mentions one: only the cheat sites on our list matter, and a visit alone never decides a verdict.
• VPNs and proxies: the check looks at which program connects where, not at your IP address.
• A DNS cache that Windows does not keep: some network setups keep no Windows DNS cache. Then the connection check has less to work with, but nothing is counted against you for it.

For admins

A non-browser program connected to a cheat-only address during the scan is one of the clearest findings AACGUARD has, because it shows something running at that moment. If the finding is for a shared address, look for other findings that support it, or ask for a pre-match check right before the match.