I saw the "Experienced Developer" role, but I've also heard that he's reselling the product, so I'm a bit confused, is he actually the developer of the product he sells, or is he a reseller?
@
edit:
MaxiCheats / Sheintan is realiable ?
First of all, this post was made for members who don't know much about coding or reversing, so I tried to use common language that normal users can understand
I also left out many of the things I found to avoid exposing sensitive information and to stay within the forum rules, I will not release the broken auth version, so don't DM me asking for it.
After getting no answer from him directly, while seeing him tell other people that he's the developer, I decided to do my own research, and these are the results.
TL;DR
There's really not much to prove here. Sheintan / MaxiCheats is literally reselling ez-val.com, a known product provider for resellers. He did try to hide it by registering a second domain, 666auth.pro, but it's 1:1 with ez-val.com. The loader he ships with both his public and private versions points at ez-val.com. A key sold by MaxiCheats works on both 666auth.pro and ez-val.com, They are also using a publicly available vulnerable driver and Discord overlay, which makes them risky rather than "UD" as they claim.
same backend as 666auth.pro 1:1 loader, 1:1 protocol, 1:1 keys
Public & Private Are the Same Product
Both the Public and Private versions are the same product
It's not only the core and features that are the same, as he previously said, both versions also appear to use the same vulnerable driver and even have a traceable loader signature.
Considering I was able to find this amount of information, potential detection vectors, and things that I know are detected in around an hour and a half, I personally wouldn't consider either version safe
If I could identify this much in such a short period of time, imagine what Vanguard's own security team could find with considerably more time and resources
Proof of other sellers listing ez-val
The CSP giveaway
Weirdly enough, 666auth.pro's Content-Security-Policy response header includes a reference to keyauth.win:
Anyone can verify this in their own browser:
Visit
Open DevTools -> Network
Search the response headers for keyauth.win
Error mapping 1:1 with ez-val's loader
The MaxiCheats loader recognises exactly the same JSON error fragments and maps them to exactly the same E-3xxx codes and user strings as ez-val:
1. DNS ez-val.com (A, IPv4)
2. POST https://ez-val.com/handshake
{ clientPubKeyBase64 }
→ sessionId, serverPubKeyBase64, challenge{iv,data,tag}
3. POST https://ez-val.com/loader/create-session
{ hwid, productId:"valorant-public" }
→ sessionId, token, url
4. Loader opens in browser https://ez-val.com/<url>
5. GET https://ez-val.com/loader/session-status/<sessionId>?token=<token>
polled 1×/s, sign-in phase
6. GET https://ez-val.com/loader/session-status/<sessionId>?token=<token>
polled 1×/s, license-pick phase → returns licenseKey
From here on: POST https://ez-val.com/secure
body encrypted, action in plaintext inside envelope
7. action="login" { key, hwid, ver, product, metadata }
8. action="getvar" { name:"package_type", product }
9. action="getoffsets" { product }
10. action="downloadfile" { filename:"config.json", product }
11. action="geticons" { }
12. action="downloadfile" { filename:"public-driver.sys", product } skipped if \\.\PGRHostControl exists
13. action="downloadfile" { filename:"overlay_public.dll", product }
14. action="create-claim" { productId } → claimToken
Even though a few modules are named "public", these are the exact same modules as the private version. Both operate using the same vulnerable driver and the same public Discord overlay method.
The vulnerable driver
The vulnerable driver is P*********.sys, from P** **** *****. It's literally known/public and I'm surprised it's not blacklisted yet by Vanguard.
The loader first checks if \\.\P******** exists, if the handle opens, the device is already loaded and the download request to the server is skipped.
Otherwise, the loader proceeds to load it in this sequence:
Enables SeLoadDriverPrivilege
Generates a randomized Windows-looking service name (from a pool of ~20 plausible names like WdiCacheAgent, TpmMonHost, SysCfgHost) + 6 hex chars
Writes bytes to %SystemRoot%\drivers\<name>.sys via fopen("...","wb")
StartService, then immediately deletes the service and staged file
In-memory driver bytes are zeroed after the load attempt
Disclosure boundary
I'm not going to disclose how to bypass any of the security checks of ez-val's loaders. I was able to successfully remove every single one of them, including the VM checks. Most of the important routines were virtualized; after lifting and cleaning them up I was able to recover most of the protected strings as well.
You’ve embarrassed yourself enough already. Despite all the proof, you still keep talking. Go f*ck yourself. I’m not engaging with you anymore. When I get home, I’ll open a thread just like you did and embarrass myself too, lol.
I’m curious what your plan is now. Last time, you had your alt accounts randomly insult me and call my vouchers with payment proof scams. Now are you going to use your alts again, have them say, “No, I’m the developer, Maxi is reselling,” and try some other plan?
I don’t even care how you’re planning to “prove” it because I genuinely don’t give a f*ck anymore. But the funny part is, even your VGK account was created in 2025, yet somehow you’ve known me since 2022? Lol.
And I was nice to you again yesterday. Despite all the proof, I even said, ‘Fine, you’re the dev, you’re the best,’ just so you’d finally shut up, but you’re still asking for it. I didn’t start this war, you did two months ago. If you still refuse to stop despite all my warnings, then starting today I’ll play this the same way you have. And trust me, by the end of it, you’ll be so sick of this whole situation that you’ll wish you’d never started it.
You’ve embarrassed yourself enough already. Despite all the proof, you still keep talking. Go f*ck yourself. I’m not engaging with you anymore. When I get home, I’ll open a thread just like you did and embarrass myself too, lol.
I’m curious what your plan is now. Last time, you had your alt accounts randomly insult me and call my vouchers with payment proof scams. Now are you going to use your alts again, have them say, “No, I’m the developer, Maxi is reselling,” and try some other plan?
I don’t even care how you’re planning to “prove” it because I genuinely don’t give a f*ck anymore. But the funny part is, even your VGK account was created in 2025, yet somehow you’ve known me since 2022? Lol.
And I was nice to you again yesterday. Despite all the proof, I even said, ‘Fine, you’re the dev, you’re the best,’ just so you’d finally shut up, but you’re still asking for it. I didn’t start this war, you did two months ago. If you still refuse to stop despite all my warnings, then starting today I’ll play this the same way you have. And trust me, by the end of it, you’ll be so sick of this whole situation that you’ll wish you’d never started it.
You wrote a whole wall of text and still ignored one simple question: Are you the developer or a reseller?
I never said I’ve known you since 2022. I was required to go through an audit in the complaint section, where I provided proof of every customer’s purchase and long-term chat history to show that none of them were alt accounts. But if you’re attacking my product, obviously my customers are going to respond to you.
And I’m not sure how someone who has been attacking me the entire time with insane accusations and lies can claim they were just “being nice.”
You wrote a whole wall of text and still ignored one simple question: Are you the developer or a reseller?
I never said I’ve known you since 2022. I was required to go through an audit in the complaint section, where I provided proof of every customer’s purchase and long-term chat history to show that none of them were alt accounts. But if you’re attacking my product, obviously my customers are going to respond to you.
And I’m not sure how someone who has been attacking me the entire time with insane accusations and lies can claim they were just “being nice.”
I know this guy for like 2 years and can tell that he is a developer of what he sells, was using his software about a year ago and he was updating it based on feedback, and it actually WAS one of a few public 1pc things which didn't get me banned for like 2 months of use which is lowkey a lot of time, then he was gone for irl activities and came back about 2 months ago. All time he was gone product had no support, no idea what about his cheat now but yeah he is 100% a dev of it.
First of all, this post was made for members who don't know much about coding or reversing, so I tried to use common language that normal users can understand
I also left out many of the things I found to avoid exposing sensitive information and to stay within the forum rules, I will not release the broken auth version, so don't DM me asking for it.
After getting no answer from him directly, while seeing him tell other people that he's the developer, I decided to do my own research, and these are the results.
TL;DR
There's really not much to prove here. Sheintan / MaxiCheats is literally reselling ez-val.com, a known product provider for resellers. He did try to hide it by registering a second domain, 666auth.pro, but it's 1:1 with ez-val.com. The loader he ships with both his public and private versions points at ez-val.com. A key sold by MaxiCheats works on both 666auth.pro and ez-val.com, They are also using a publicly available vulnerable driver and Discord overlay, which makes them risky rather than "UD" as they claim.
same backend as 666auth.pro 1:1 loader, 1:1 protocol, 1:1 keys
Public & Private Are the Same Product
Both the Public and Private versions are the same product
It's not only the core and features that are the same, as he previously said, both versions also appear to use the same vulnerable driver and even have a traceable loader signature.
Considering I was able to find this amount of information, potential detection vectors, and things that I know are detected in around an hour and a half, I personally wouldn't consider either version safe
If I could identify this much in such a short period of time, imagine what Vanguard's own security team could find with considerably more time and resources
Proof of other sellers listing ez-val
The CSP giveaway
Weirdly enough, 666auth.pro's Content-Security-Policy response header includes a reference to keyauth.win:
Anyone can verify this in their own browser:
Visit
Open DevTools -> Network
Search the response headers for keyauth.win
Error mapping 1:1 with ez-val's loader
The MaxiCheats loader recognises exactly the same JSON error fragments and maps them to exactly the same E-3xxx codes and user strings as ez-val:
1. DNS ez-val.com (A, IPv4)
2. POST https://ez-val.com/handshake
{ clientPubKeyBase64 }
→ sessionId, serverPubKeyBase64, challenge{iv,data,tag}
3. POST https://ez-val.com/loader/create-session
{ hwid, productId:"valorant-public" }
→ sessionId, token, url
4. Loader opens in browser https://ez-val.com/<url>
5. GET https://ez-val.com/loader/session-status/<sessionId>?token=<token>
polled 1×/s, sign-in phase
6. GET https://ez-val.com/loader/session-status/<sessionId>?token=<token>
polled 1×/s, license-pick phase → returns licenseKey
From here on: POST https://ez-val.com/secure
body encrypted, action in plaintext inside envelope
7. action="login" { key, hwid, ver, product, metadata }
8. action="getvar" { name:"package_type", product }
9. action="getoffsets" { product }
10. action="downloadfile" { filename:"config.json", product }
11. action="geticons" { }
12. action="downloadfile" { filename:"public-driver.sys", product } skipped if \\.\PGRHostControl exists
13. action="downloadfile" { filename:"overlay_public.dll", product }
14. action="create-claim" { productId } → claimToken
Even though a few modules are named "public", these are the exact same modules as the private version. Both operate using the same vulnerable driver and the same public Discord overlay method.
The vulnerable driver
The vulnerable driver is P*********.sys, from P** **** *****. It's literally known/public and I'm surprised it's not blacklisted yet by Vanguard.
The loader first checks if \\.\P******** exists, if the handle opens, the device is already loaded and the download request to the server is skipped.
Otherwise, the loader proceeds to load it in this sequence:
Enables SeLoadDriverPrivilege
Generates a randomized Windows-looking service name (from a pool of ~20 plausible names like WdiCacheAgent, TpmMonHost, SysCfgHost) + 6 hex chars
Writes bytes to %SystemRoot%\drivers\<name>.sys via fopen("...","wb")
StartService, then immediately deletes the service and staged file
In-memory driver bytes are zeroed after the load attempt
Disclosure boundary
I'm not going to disclose how to bypass any of the security checks of ez-val's loaders. I was able to successfully remove every single one of them, including the VM checks. Most of the important routines were virtualized; after lifting and cleaning them up I was able to recover most of the protected strings as well.
Why are you copy pasting the same thing here and in other threads? You're just spamming at this point.
Anyway, I already said I'm done wasting my time with you but you still keep going. I'm not a reseller, I'm the owner. My UI doesn't even look like that. Resellers can sell my public cheat, but they have a different loader. Maxi has its own loader, UI and different methods of course.
There are 42 active users in game right now and Maxi can track its own users.
Instead of trying to call me a scammer all the time, maybe stop trying to hide the fact that you scammed your own customer or that you got reversed
I'm not going to reply to you anymore. If I keep seeing you crying about this, I'll just copy paste this wherever you post and move on.
wow, what a great service, I wonder who's currently using it?
wait... this seems... familiar?...
NO VGK.RIP NOOOOO
welp, unfortunate vgk.rip, I thought you were different!!
if you still don't believe me (tbh new acc I wouldn't believe myself) you can compare the features, the esp, everything, it will all be 1:1....
honestly, it's quite sad how it is okay to up-charge $250 for an invite to a cheat you didn't even make, I'm not surprised Valar can't explain the functionality of his cheat and constantly larping "updating" it, whilst grievously spamming ignite devs dms...
$1000 VGK.RIP invite vs $750 ignite.pub valo invite
atleast you kept the same $250 monthly subscription price, thank you valar!
P.S - not leaking anything to Riot, stay safe VGK.RIP users! (stop buying shit overpriced cheats)
@Xenos
So basically just to name a few Elegante.cc, Divine are resell versions of maxicheats? if you are the dev of ez-val.com
Since those are on the reviews with a visible screenshot of different menu's but on the same product.
So basically just to name a few Elegante.cc, Divine are resell versions of maxicheats? if you are the dev of ez-val.com
Since those are on the reviews with a visible screenshot of different menu's but on the same product.
Great thing to check, they all use the same database, and you can inject the Maxi version using EZ-Val keys and the EZ-Val version using Maxi keys, this works across both the Public and Private versions
The only real differences appear to be the design and a few features, while the underlying backend is exactly the same, so if the shared components become a detection vector, every version could potentially be affected, including the $1,000 version
Quote:
Originally Posted by Sheintan
Why are you copy pasting the same thing here and in other threads? You're just spamming at this point.
Anyway, I already said I'm done wasting my time with you but you still keep going. I'm not a reseller, I'm the owner. My UI doesn't even look like that. Resellers can sell my public cheat, but they have a different loader. Maxi has its own loader, UI and different methods of course.
There are 42 active users in game right now and Maxi can track its own users.
Instead of trying to call me a scammer all the time, maybe stop trying to hide the fact that you scammed your own customer or that you got reversed
I'm not going to reply to you anymore. If I keep seeing you crying about this, I'll just copy paste this wherever you post and move on.
Scammer, refund money!!
Also youre reseller!
I don't think attacking me with lies is going to save your reputation anymore, calling me a reseller when I literally reversed your entire product and broke through its security?
That post was based on an outdated loader, and the guy found basically nothing meaningful through the reverse, I'm 90% sure most of it came from AI analysis, the only actual thing he managed to identify was a Discord bot callback
Regarding the bad review, the guy posted it just 12 minutes after the loader came back online, all of the downtime was compensated, he has a functional product, and there were only 4 days of downtime, he also never replied to me after posting the review, so there wasn't really anything else I could do
I have 49+ satisfied customers, plus previous customers who simply didn't renew, and only one guy is angry because an update took 4 days longer than expected, the usual type of customer who thinks you're their slave
Keep attacking me over minor things instead of actually defending yourself against what I posted, it only makes you look more ridiculous
So basically just to name a few Elegante.cc, Divine are resell versions of maxicheats? if you are the dev of ez-val.com
Since those are on the reviews with a visible screenshot of different menu's but on the same product.
Just to clarify something as Sheintan keeps saying VGK.RIP is my reseller.
I didn't make any rebrands of the Valorant product and vgk.rip is a different cheat than mine. Sheintan is literally trash talking spreading a lot of missinformation.
Nothing of the reversed stuff posted about my provider is true. We don't use kdmapper or any **** like that.
I also would like to mention that Sheintan doesn't know anything about programming. He is just reselling another cheat. He even contacted me trying to resell IGNITE and do business, in an indirect way, but he did:
I have no reason to lie about it, because if it was true, the more people I have selling my product, the more money I would be winning. However, that is not true.
The dev is Russian, so I don't think that guy is the actual dev either, but this guy is just straight-up lying
Lmao? Russian?
And I’m telling you again: stop lying and stop making up things about me to cover up your scam. The driver does not belong to me, there is no cheat that you cracked, and the features of the private and public versions are not the same. The public build used by the reseller is also not the same as Maxi. Maxi Public was specifically designed to remain undetected, while the reseller build is just the standard version.
Stop living in your own fantasy and making up stories like “I asked this person” or “I asked that person.” And I’m not Russian either.
But there’s no escape for you anymore, VGK. Refund the money, or you’ll be banned soon.
Just to clarify something as Sheintan keeps saying VGK.RIP is my reseller.
I didn't make any rebrands of the Valorant product and vgk.rip is a different cheat than mine. Sheintan is literally trash talking spreading a lot of missinformation.
Nothing of the reversed stuff posted about my provider is true. We don't use kdmapper or any shit like that.
I also would like to mention that Sheintan doesn't know anything about programming. He is just reselling another cheat. He even contacted me trying to resell IGNITE and do business, in an indirect way, but he did:
I have no reason to lie about it, because if it was true, the more people I have selling my product, the more money I would be winning. However, that is not true.
Does the message I sent you somehow prove that I’m a reseller, you idiot? You received this message after you lied about using VGK’s assets just to defend him. With api request proof. And who are you? Ai developer or?
@VGK.RIP
And I’m telling you again: stop lying and stop making up things about me to cover up your scam. The driver does not belong to me, there is no cheat that you cracked, and the features of the private and public versions are not the same. The public build used by the reseller is also not the same as Maxi. Maxi Public was specifically designed to remain undetected, while the reseller build is just the standard version.
Stop living in your own fantasy and making up stories like “I asked this person” or “I asked that person.” And I’m not Russian either.
But there’s no escape for you anymore, VGK. Refund the money, or you’ll be banned soon.
wow, what a great service, I wonder who's currently using it?
wait... this seems... familiar?...
NO VGK.RIP NOOOOO
welp, unfortunate vgk.rip, I thought you were different!!
if you still don't believe me (tbh new acc I wouldn't believe myself) you can compare the features, the esp, everything, it will all be 1:1....
honestly, it's quite sad how it is okay to up-charge $250 for an invite to a cheat you didn't even make, I'm not surprised Valar can't explain the functionality of his cheat and constantly larping "updating" it, whilst grievously spamming ignite devs dms...
$1000 VGK.RIP invite vs $750 ignite.pub valo invite
atleast you kept the same $250 monthly subscription price, thank you valar!
P.S - not leaking anything to Riot, stay safe VGK.RIP users! (stop buying shit overpriced cheats)
@Xenos
Every product I’ve sold on ePvP was coded separately specifically for Maxi. The reason is to keep it undetected. Whenever I offer resellership, I also always make it clear that the reseller build will not be a copy of Maxi.
Anyway, I’ll continue ignoring you. Hopefully, while I stay silent, you won’t start crying “scam” again or insulting me from your alt accounts.
And I’m telling you again: stop lying and stop making up things about me to cover up your scam. The driver does not belong to me, there is no cheat that you cracked, and the features of the private and public versions are not the same. The public build used by the reseller is also not the same as Maxi. Maxi Public was specifically designed to remain undetected, while the reseller build is just the standard version.
Stop living in your own fantasy and making up stories like “I asked this person” or “I asked that person.” And I’m not Russian either.
But there’s no escape for you anymore, VGK. Refund the money, or you’ll be banned soon.
So you allow me to post every information i recorded ? I was talking about the dev and you are not the dev
