Private Game Servers: The Games Change, the Operators Don’t

Four findings that change how to respond

That private game servers run on a supply chain and lure players with deep discounts is old news in game security. What this data adds is a view of which parts of that chain change and which do not: games and entry points turn over fast, while operators, agent back-ends, and support accounts are reused again and again.

The enforcement problem When operators receive a complaint, they switch domains, installer package names, and group names. The same promotion group pushes game A this week and game B the next. A publisher gets one download link taken down, and the same crew reappears under a new name. Acting game by game, or link by link, ties enforcement cost to the operators’ release pace.

• Many new entry points, few new operators (2–12 vs 62–111): Each week of the monitoring period added 62–111 entry points but only 2–12 operators. 1,003 entry points and 106 games trace back to 48 operators.
• One operator runs dozens of games (43 games): The largest operator’s catalog reaches 43 games, and a single support or recruitment account appears in promotions for dozens of titles.
• Most domains are back-ends, not downloads (51.86% > 44.42%): Of 833 candidate root domains, 432 serve agent back-ends and channel admin; 370 serve installers and landing pages. Removing download links targets the smaller half.
• The response window is about two weeks (13 days): Across 31 projects with identifiable beta milestones, the median gap from closed beta to open launch was 13 days. Acting before monetization starts means watching from the closed beta.

Method Notes

• Scope: private-game-server messages observed by Threat Hunter on Telegram channels, lookback through October 29, 2026. The source data does not give a start date; “per week” refers to the range across weeks in the monitoring period.
• “Server operator” is the party that stands up and runs a private server. “Entry point” is one publicly promoted private-server project.
• Two game counts are kept apart: 106 is the total number of games observed; 95 is the high-confidence list used for the lifecycle analysis.
• Discount shares use promotions stating an explicit discount as the base; revenue-share figures use identifiable agent quotes. The Top 20 is a sample, not a ranking of harm.

1. Supply: growth does not come from new entrants

Each week of the monitoring period added 62–111 new entry points but only 2–12 new server operators. New entrants alone cannot explain that release rate. The operator side fits the same picture: one operator’s catalog reaches 43 games. Established operators can take on many games at once and keep launching new projects, so supply does not depend mainly on new groups arriving.

Enlarge

48

Server operators

1,003

Entry points

106

Games observed

43

Largest single-operator catalog

1.1 Closed beta to open launch: a 13-day median

Across the 31 projects where both closed-beta and open-launch milestones could be identified, the median gap between them was 13 days. For a publisher, that means roughly two weeks between the first “closed beta” message and a full launch with active recruiting and paid top-ups.

Fig. 2 shows the menu of one promotion bot. A single licensed game has spawned more than ten private-server projects, each tagged “in closed beta”, “closed beta soon”, “just launched”, or “stable”. Projects queue up like a production line; acting only once the open-launch promotion starts usually misses the earliest window.

Note: the 31 projects are the subset with identifiable milestones, not all 1,003 entry points.

Enlarge

2. Targets: RPG and card games make up 70%

2.1 The pitch: borrowed popularity, promised “source code” and “synced updates”

Private-server promoters wrap their projects in the popularity, player base, and paid content of licensed games to attract agents, studios, and promotion channels. The panel below groups high-frequency keywords from candidate messages by theme (dark chips are the most prominent group; theme grouping only, not exact frequency).

Licensed games’ popularity is used to recruit channels. Copy mentions short-video ads, “paid-install hits”, “trending mini-games”, and “turnover”, and some posts cite download counts, chart positions, and ad spend as selling points. The licensed game’s visibility is used to sell the private project’s reach. These install and turnover figures are self-reported by promoters; they are not the licensed games’ real business data and do not on their own explain why a game is targeted.

“Source code” and “synced updates” are sold as supply capability. Terms such as “source code”, “official source”, “synced with live”, and “continuous updates” recur alongside “closed beta”, “open launch”, “build package”, and “server launch” to show that a project can be deployed and kept running. They show only what promoters claim, not that they hold official source code or can keep pace with licensed updates.

2.2 New and veteran titles alike, each repackaged many times

About 30%

Licensed release under one year old (base: 95 high-confidence games)

Nearly 20%

Licensed release live for over four years (base: 95 high-confidence games)

Targets span recent releases and long-running titles. On the new side, promoters follow recently launched, highly visible games; on the veteran side, games with long-established player bases keep appearing. Some licensed games surface under several private-server project names: one strategy title, for example, was promoted under at least two spin-off names, and another game has several derivative versions in circulation. The same licensed game can be repackaged by different private projects and reach the market through different entry points.

2.3 Top 20 sample games

The table lists 20 sampled games, sorted by message-mention index from high to low, to show what private servers target and how those products are built.

Game and brand names in this section come from promotions Threat Hunter observed in third-party private-server channels and are used only to describe what those promotions target. They do not indicate that any publisher or brand owner participates in, authorizes, or operates private servers, nor that any listed game has suffered a confirmed source-code leak or intrusion. This table is not an industry-wide ranking of harm.

Table 1 Top 20 sample games (n=20), sorted by message-mention index, descending. Titles shown in romanization or official English title.

1) Genre is concentrated: RPG and card games account for 70%. Of the 20 games, 13 are RPGs and 1 is a card game, together 14 (70%); 4 are strategy games (20%) and 2 are simulation games (10%). Most feature character progression, gear, team building, or resource accumulation, which lines up with private-server copy about in-game top-ups, discounts, rebates, and perks.

2) Every title has a mobile version, and veteran PC franchises are included. All 20 involve a mobile product; 9 have a mini-program version (45%), and 5 span both PC and mobile (25%), several of them long-running franchises with PC roots. Private servers are not limited to one genre or platform.

3. The chain: which links change and which stay

Private servers now run as a continuous business from game builds to player top-ups. Upstream suppliers provide game builds and porting; server operators deploy servers, build download entry points, and configure operations back-ends; downstream master agents, sub-agents, and channels recruit and drive traffic; players enter and generate top-up turnover. The right-hand column of the diagram matters most: revenue-share rules, domain and reskin capability, and promotion groups all carry over intact when the game changes.

Enlarge

3.1 Upstream: source code, client builds, porting, and update promises

Upstream suppliers analyze, organize, and port game programs and client assets, then deliver deployable builds to operators. In the monitored messages, “official source”, “source code”, and “first-hand builds” are promoted as products in their own right; many messages stress Android and iOS support, and “synced with live” is often used to describe ongoing version service. What upstream sells is not just files: it packages delivery, porting, and continued updates as a service that feeds operators’ demand for fast launches.

An observation on AI. We observed two promotions marketed as an “AI reverse-engineered offline build” and an “AI-revived offline build” (Fig. 4). AI’s ability to read code and handle repetitive porting work could lower the technical bar upstream, but the evidence so far is these two advertisements, with no counts and no way to verify the claims. We treat this as a signal to keep watching, not as a finding of this report.

Enlarge

3.2 Operators: one crew, many games

A “server launch” turns upstream builds into a private server that players can download, log in to, play, and pay into. Operators handle server deployment, installer configuration, game admin back-ends, top-up services, and agent permissions, then open entry points to downstream promoters. Linking support and recruitment accounts showed single accounts appearing in promotions for dozens of games; in the screenshot below, one support account’s name lists several games at once. Operators no longer build a separate setup for each game; they reuse existing servers, back-ends, support accounts, and agent channels to take on one project after another.

Enlarge

3.3 Player acquisition: steep discounts are the front door

In player-facing promotions, “1% of list price” is the most common top-up offer, at 38.3% of promotions stating an explicit discount; “10% of list” and “0.5% of list” are also common. Discounts are bundled with items, progression resources, and launch perks to make the entry cost look negligible and pull players into downloading and registering. Unlike agent revenue share, which targets channels, this is the front door for paying players. Discount figures are advertised claims, not prices players actually receive.

Enlarge

3.4 Distribution: agents paid on turnover, under written rules

An agent’s revenue share is the agreed percentage of top-ups from the players that agent brings in. Among identifiable quotes, a 50% share is most common (46.5%), and 45%, 55%, and 60% together cover more than 98%. After players register and pay, operators and agents settle according to player attribution and share rates recorded in the back-end; some rules also include master agents, sub-agents, and channel fees, so revenue is split further down the tiers. The key point: when the game changes, the agent relationships and payout rules still work.

Enlarge

Some operators already work from written agent rules. One sample requires master agents to post a deposit and caps how many sub-agents each may recruit; promoting a competing project or a sub-agent’s violation can lead to a forfeited deposit, suspended payouts, or a locked back-end. Another sample sets penalties for poaching players from other agents, unauthorized rebates, and switching agents in breach of the rules.

3.5 Transactions and infrastructure: more back-ends than download sites

A typical private-server transaction starts with promotion in groups or on social platforms. Players install via a package or download link, pay through whatever method the project offers, and the back-end records the player’s source and agent before splitting revenue by share. Messages repeatedly mention stablecoin transfers, channel fees, and daily or weekly settlement. Players and agents may not use the same payment method, but both depend on a collection and settlement system that keeps running. The back-end does more than take money: it records attribution, tracks agent performance, controls access, and executes payouts. It is the hub connecting game projects, agent networks, and player spend.

Enlarge

This review identified 833 candidate root domains. 432 (51.86%) serve agent back-ends and channel admin, 370 (44.42%) serve installer downloads and landing pages, and the rest cover player registration, top-up stores, key-card services, and support guides. There are more agent back-ends than download sites. Publishers’ most common response is filing takedowns against download links, but that covers the smaller half; the back-end domains that run payouts, attribution, and channel management are what carry over when the game changes.

Enlarge

The screenshot below shows one private-server promotion. A single message lists entry points for the installer, the agent back-end, the player store, game support, and operator support, and the account name lists several games. Some support accounts, promotion groups, and operating resources recur across promotions for different games, so when operators switch games they keep their existing promotion channels, agent relationships, and part of their technical resources.

Enlarge

Chapter takeaway · What changes when the game changes What changes: the licensed game, the project name, download links, installer package names, group names, and the discount pitch to players.

What stays: the operator, agent payout rules and share rates, agent back-end and channel-admin domains, support and recruitment accounts, and the audience in promotion groups. Enforcement that targets only the first list will always be a step behind.

4. Conclusions and response

The risk is no longer confined to a single game; it lies in operator capability, agent channels, and transaction infrastructure reused across projects. The data points to three changes in how to respond:

• Track operators, not games. 48 operators support 1,003 entry points and 106 games, and the largest runs 43. Identifying one operator and its linked accounts covers far more ground than taking down one version of one game.
• Extend takedowns from download links to agent back-ends. Agent back-ends make up 51.86% of 833 candidate root domains, more than the 44.42% for downloads. Back-ends hold player attribution and payouts; they are what survives a game swap.
• Move monitoring up to the closed beta. Across 31 projects with identifiable milestones, the median from closed beta to open launch is just 13 days. Detecting and preserving evidence during the closed beta is the way to act before large-scale monetization begins.

To counter the brand infringement, player churn, and illicit traffic diversion that private servers cause, Threat Hunter uses its threat-intelligence monitoring and link analysis to track private-server promotions, operator accounts, agent channels, download entry points, and transaction leads, helping game companies identify risk, preserve evidence, and take action. The aim is to cut promotional reach, shrink the active agent base, and reduce daily transaction volume, weakening private servers’ ability to acquire players, distribute, and monetize.

About this report Source: Threat Hunter threat intelligence; private-game-server messages on Telegram channels, lookback through October 29, 2026. All screenshots have accounts, links, domains, and redemption codes redacted; this report publishes no domains or contact handles.

Contact: tim@threathunter.com · threathunter.com ↗