[Steam] Fake server population

[ratpits]

Hi guys,

I'm sure some of you are aware of the servers that have fake population counters in the browser. The server will say 7/8 players, you join, and it turns out you are the only one on the server. This is really annoying and cheapens the experience for everyone involved. Are there any ways you guys can mitigate this?

I just made my server and I get low traffic in comparison to these servers because they are always at the top of the list. The only way to compete would be to lie as well but I don't want to engage in that sort of behaviour.

I got irritated because the server has announcements about how many new players they get per month and it was in the 1000s, whilst I get a few people per day. Feels really unfair.

Let me know if you think it's also a problem

rat

p.s
new to github + the issues system so if I did stuff wrong it wasn't intentional

[sys-arch]

Was reported on Discord some weeks ago without any answer from devs. This kind of activity is made by some russian servers called The Last of Us (TLOU) and have the same behaviour than other community called Fastpath

https://steamcommunity.com/sharedfiles/filedetails/?id=2502626384

https://steamcommunity.com/app/320/discussions/0/685239996035106809/

ValveSoftware/Source-1-Games#3857

[felis-catus]

This issue can't be resolved by NMRiH Team due to a fault with Steam's server browser protocol.
Introducing a new tag "Third-party" for issues that we can't fix ourselves, if Valve resolves it, we will update this accordingly.

As for potential workarounds in our code, we can't override the player count because it's incremented by successful authentications within the closed source engine, there's no available workaround other than users blacklisting the servers. Unfortunately we can't ship our own list due to server browser being closed source as well, it would override user's configuration.

For admins spoofing the servers: please reconsider. In NMRiH this won't improve your server reputation. With 9 maximum clients, having players join fake servers will congest the actual servers you're redirecting to. This is only detrimental to you as a host, and frustrating for players looking to find a server for their preferences.

[sys-arch]

I'd like to make a suggestion, @felis-catus : add those servers to the blocked list by default. I know that list is a file, and instead of submitting it empty, upload it with those servers blocked by default and with a name that warns players not to unblock them because they're dangerous.

You don't need Valve to do that and other games did it like HL2:DM or Fistful of Frags

[ratpits]

Yeah, I would happily join some sort of group of trusted fake server spotters that sends an updated list of IPs to block each week or at your convenience. Hell, I'm doing it already https://steamcommunity.com/sharedfiles/filedetails/?id=3730683704

If we keep regularly hitting them they will have to give up because they'll lose their momentum.

My issue is that all the good servers and admins sit at 0/8 players and give up because they aren't having fun whilst these fake servers draw all the new players. The lack of impressions for quality servers is detrimental to the sustainability of the game.

[felis-catus]

I'd like to make a suggestion, @felis-catus : add those servers to the blocked list by default. I know that list is a file, and instead of submitting it empty, upload it with those servers blocked by default and with a name that warns players not to unblock them because they're dangerous.

You don't need Valve to do that and other games did it like HL2:DM or Fistful of Frags

It would write over the existing file, replacing user configuration. In addition, the engine would still connect to the actual server via redirect despite its address being blocked.

Regardless, it is extra maintenance burden since changing the IP address and port is trivial for the host, we can't update the game each time it happens because we have limited access to the publishing tools. One workaround is a remote list, but we'll have to deal with hosting it, integrating a library like curl to fetch data for it, write code for it, then someone would have to be on call to update it, and for volunteers with limited time it's endless game of cat and mouse with the fake server hosts until one of them gets tired.

Personally, as a code maintainer, I am frustrated as you are. I have no control over the server list, Steam, or the publishing. If this goes out of control we can only raise awareness and attempt a kludge fix. As I mentioned in the initial post, spoofing is less effective due to our max. client limit, maybe the trend will die down, as it did before when we had similar fake client incidents...

Issues from maintenance point of view: Implementing the custom filter, hosting it, keeping it up to date, its longevity, and it would be held together by a hack which modifies the engine server blacklist. 1.15 is already feature locked so it can't be done on short notice.
It's also unknown how long this will last, and we'll lose time, energy, and money (hosting fees) to implement something of this scale.
For a small volunteer team, that's a big ask. For context, while NMRiH Team is independent, it's not the publisher of the game.

Thank you for the patience and effort to list offending servers.

EDIT: Note for later, could maybe merge KeyValues using a local file as a stopgap solution for 1.15, but it's easily defeated.

[sys-arch]

I understand that you are trying to justify this as a way to “help” your community survive, but as someone running a legitimate long-term community server, I strongly disagree with both the method and the impact it has on the wider game ecosystem.

“Most new players simply do not join completely empty servers.”

That is true for every server owner in this game.

The difference is that most of us choose to deal with that reality honestly instead of manipulating the browser to artificially push ourselves to the top of the list.

Communities like ours spend years hosting servers, paying infrastructure costs, moderating players, creating events, maintaining plugins/configurations, helping newcomers and trying to slowly build an actual playerbase legitimately. Meanwhile, spoofed servers instantly absorb visibility that honest communities never even get the chance to compete for.

You are effectively punishing communities that choose to operate fairly.

“The servers I created are real and operational servers.”

That is not the issue being discussed.

The issue is that the browser information is intentionally misleading. The displayed population is fake, regardless of whether the destination server exists or not.

Players join expecting one thing and receive another. That damages trust in the browser itself.

And as @felis-catus already explained, this creates additional problems specifically in NMRiH because of the low player limits. Redirecting large amounts of players into already populated servers congests the few genuinely active servers while starving smaller communities of any visibility or chance to grow naturally.

That is exactly what many of us are experiencing right now.

“I only created around 20 servers.”

For a niche Source game with a relatively small active browser population, 20 fake entries is enormous.

A handful of spoofed servers can dominate a significant percentage of the visible browser and completely distort server discovery.

We have personally seen legitimate servers sit dead at 0/8 for hours while spoofed entries remain permanently near the top of the browser. Over time, admins lose motivation, communities shrink, and eventually people stop hosting altogether because competing honestly becomes pointless.

This is not theoretical damage. It is already happening.

“A lot of time, effort, and personal work has been invested into the server itself…”

Nobody is denying that.

But server quality does not justify deceptive acquisition methods.

A good server should succeed because players genuinely choose it after seeing accurate information — not because the browser was manipulated to funnel players into it.

If every community adopted the same logic, the entire server browser would become unusable.

“My target audience has always been the CIS community.”

Steam’s browser is global, not regional.

These servers absolutely appear for European players and affect communities outside CIS. Multiple server owners and players have already confirmed this for months.

Intent does not change the impact.

“My goal was to help keep the server populated and keep the local community alive.”

The problem is that this approach does not only help your community — it actively harms everyone else’s.

And again, @felis-catus already highlighted another important point: in NMRiH this strategy is especially destructive because of the small player caps. You are not creating new activity for the game overall. You are concentrating existing players into spoofed networks while legitimate communities are deprived of the opportunity to organically populate.

That accelerates the death of independent servers.

The long-term result is obvious:

• Honest communities become invisible.
• More admins feel forced to spoof just to survive.
• Players stop trusting the browser.
• Smaller servers shut down entirely.

At that point the browser no longer represents real server activity. It becomes an arms race of manipulation.

“Not a single player has personally contacted me with a complaint…”

Most players are not going to investigate redirect networks or message server owners directly.

They simply blacklist servers, become frustrated, or stop trusting multiplayer browsing altogether.

Silence is not proof that the practice is harmless.

At the end of the day, this is still artificial visibility manipulation in a shared ecosystem.

Regardless of intent, it damages legitimate communities that are trying to grow fairly and undermines confidence in the game’s server browser as a whole.

[felis-catus]

Redirect mitigation committed in src-r8843 which attempts to detect and block connections to fake servers. This is not a definitive fix, and won't remove server browser entries since Source mods have no access to that code.