Strong reviews, shaky servers
1,886 teams registered and 1,184 of them solved the Starter challenge. Across 100 challenges in 18 categories, players landed 39,609 correct flags and earned more than 2,500 digital badges.
The 43 players who answered our survey rated the event 4.57 out of 5 on average. They singled out the storyline and the connected challenge series. Their main complaint was server stability, especially on Hostbusters.
Running the event cost $2,330.21 in cash and about 5,508 volunteer hours. Most of those hours went into building the challenges.
What players asked for
- Steadier servers
14 of 43 respondents brought up outages, lag or disconnects, most often on Hostbusters. The scoring server was the lowest-rated part of the event.
- Easier on-ramps
Several asked for a few beginner challenges in every category, an easy reverse engineering starter, and hints that cost points.
- Harder top end
Returning players asked for tougher OSINT and SQL challenges, like the year before.
- Firm AI rules
11 respondents mentioned AI use or cheating. Most backed the ban, and some asked for stricter enforcement or a separate track for AI-assisted play.
- More Ghost Town
The storyline and the Ghost Town forum drew praise. One respondent found the story hard to follow as a non-native English speaker.
100 challenges in 18 categories
Nine authors built 100 challenges worth 11,972 points in total, from a 5-point Caesar cipher to three 500-point finales. Many categories were stories in their own right: Hostbusters, Brain Scans, De Monne Breach and others ran as connected series.
Where players spent their guesses
Pick a measure to re-sort the categories. Select a category to see its challenges and point values.
Solve and submission counts are totals per category from the scoreboard. Correct rate is correct flags divided by all flag submissions. Miscellaneous holds the two onboarding challenges.
Easiest, most guessed, toughest
5,161 solves across 11 challenges, and 82% of submissions were correct.
7,355 wrong submissions, about 2.6 for every correct flag.
Two 350-point challenges, 231 solves, and only 24% of submissions correct.
43 players rated the event 4.57 out of 5
We asked for feedback at the end of the competition and received 43 responses between Oct 18 and Oct 20. Eight questions used a scale from 1 (worst) to 5 (best), most with an optional comment box. Questions about favorites and three open-ended questions closed out the survey.
Every question averaged above 4
Select a question to see the full wording, the score breakdown and a sample of comments.
- 1 worst
- 2
- 3
- 4
- 5 best
What came up in written answers
We read every written answer and tagged the topics each respondent raised. One respondent can raise several topics.
Brain Scans and Hostbusters led the favorites
Respondents could pick as many categories and series as they liked. Hostbusters ranked second among series and also drew the most complaints about outages.
- Bad Guys Be Bad Traffic Analysis×2
- Ghost of Squares Past OSINT×2
- Alice and Bob Would Like a Word OSINT
- Cereal Killer 03 Reverse Engineering
- Cereal Killer 04 Reverse Engineering
- DOOM Bonus
- Exposing Myself Through Bad OPSEC OSINT
- Heavy Hand Database
- I Want to be a Real Boy Web
- Infrequent Emojis Cryptography
- Lilith Hostbusters
- The Mark The Long Road
- Two Places at Once Database
- You Wouldn't Git It OSINT
The other answers named a whole series or category, most often Hostbusters and Brain Scans.
In their words
Quotes are verbatim, trimmed where marked with an ellipsis. Comments that named players or staff are left out.
$2,330.21 to run the event
Hosting and domains made up just over half the cash cost. The rest went to cash prizes for the top three teams and to AI services used in development.
Infrastructure
$1,230.21 · 52.8%Prizes
$600.00 · 25.7%Development
$500.00 · 21.5%5,508 volunteer hours
Building challenges took 3,600 hours, about 36 per challenge. Post-game analysis, including the tooling behind the integrity review, took 1,536 hours, more than five times as long as game day itself.
Design
3,700 h · 67.2%Production
1,808 h · 32.8%- Cash
- Volunteer time
Drag to set an hourly rate. This is an illustration of the time involved, not a record of anything paid.
What the integrity review found
During and after the event, we ran flag submissions and web traffic through our monitoring pipeline, looking for AI use, flag sharing, automated attacks and other rule breaks. This section shares what the review turned up, as totals. It names no players, teams or IP addresses.
Also published as a standalone page: integrity report.
Most signals never led anywhere
Our checks cast a wide net. A shared campus network, a fast solver or a helper script can each trip one. A signal only marks something for an organizer to look at, and a team was removed only when the evidence held up on review.
The chart follows the field from every registered team down to the teams we acted on.
- High 18%
- Medium 41%
- Low 41%
- High 40%
- Medium at most 50%
- Low only 10%
About a third of flagged accounts (35%) tripped only one kind of signal.
Nineteen checks in seven groups
The checks drew on two sources: the scoreboard's record of every submission, and web logs from the CTF platform and the challenge servers. Each signal is rated low, medium or high. Accounts often appear in more than one group, so the group totals overlap.
AI use
381 accountsPlayers agreed not to use AI tools to solve challenges.
ai_canaryai_prompt_submissionai_agentai_referenceFlag sharing
342 accountsAnswers passed between teams.
flag_sharing_ipwrong_flag_sharedSolve timing
1,066 accountsEach challenge has a realistic minimum solve time. These fire when a solve beats it.
solve_gapsolve_velocitysolve_too_fastPre-release
239 accountsActivity on a challenge before its recorded release time.
pre_release_attemptpre_release_solveAutomation
1,091 accountsScripting a solution is normal CTF practice. These signals are low severity and mostly add context to other findings.
scripted_clientrequest_burstbotInfrastructure probing
825 accountsAttacking the platform or challenge servers instead of the challenges themselves.
scannerfuzzingerror_burstShared networks
1,461 accountsOn its own, a shared IP address proves very little.
shared_ip_cross_teamshared_ipWe switched off one check during the review. It matched any wrong flag sent by more than one team, and common wrong guesses set it off constantly. The shared rare wrong flag check replaced it.
No account was flagged for spraying flag guesses at the scoreboard. The platform's rate limit throttled 11,424 submissions.
381 accounts showed signs of AI use
Every player agreed not to use AI tools to solve challenges. The four AI checks differ a lot in strength. A canary hit or a chatbot reply pasted into the flag box is hard to explain any other way. A reference to an AI product in someone's traffic is weaker on its own.
- Canary hit or pasted AI output 157
- AI agent traffic 58
- Product references only 166
Some challenges carried text a person reading the page would never see, but an AI tool given the page would act on. It steered those tools toward decoy flags. 130 accounts submitted one. We are not publishing which challenges carried canaries or what they said.
38 submissions put an AI tool's reply directly into the flag field. Some still began with "The correct flag is:". Others were whole challenge descriptions.
An account can appear under more than one tool. 99 of the 381 accounts are not tied to a specific tool.
Most shared IPs connect exactly two teams
922 IP addresses were used by more than one team. Roommates, campus networks, company VPNs and mobile carriers all produce this, so a shared address is context. It matters when it lines up with something else, like the same challenge solved for several teams from one address.
One challenge drew every pre-release solve
135 correct flags arrived before their challenge's recorded release time. All 135 were for the same OSINT challenge, and most came in several hours before that time. Every other challenge had at most a handful of early solves.
What we did about it
-
147
Teams removed from the public scoreboard
146 were hidden and 1 was banned. Together they had 650 player accounts. 137 of the 147 had at least one high-severity signal.
-
56
Individual accounts banned
45 of them never joined a team, and 55 shared an IP address with accounts on other teams.
-
10
Teams named on the Wall of Shame
The cases where the evidence was clearest.
If you're wondering
My team tripped a signal. Are we in trouble?
Probably not. 1,011 teams tripped at least one signal, and 147 were removed. If your team is still on the scoreboard, the review did not find enough to act on.
We solved several challenges in a few minutes. Is that a problem?
Speed alone is not. Strong players, and teams who split up the work, trip timing checks all the time. Timing matters when it lines up with something else, such as the same rare wrong answer showing up from another team.
We used scripts and tools. Did that get us flagged?
Possibly, but automation signals are rated low. They carry weight when the traffic was aimed at the platform or the servers' error pages instead of a challenge, or when they show up next to stronger signals.
Why doesn't this page name anyone?
This page explains the process and the overall picture. The Wall of Shame covers the teams where the evidence was clearest.
I think we were removed by mistake.
Contact the organizers through the official DEADFACE CTF channels and include your team name. We will look at the evidence again.
What this report leaves out
- Usernames, team names, email addresses and IP addresses.
- The exact thresholds behind each integrity check, so they can't be tuned around next year.
- Which challenges carried AI canaries, and what the hidden text said.