I found this
COD2 and COD4 dont use hitboxes, they use pixel collision detection
Anti-Lag in COD4
Its a latency-based system which uses algorithms to adjust hit registrations according to a mean average between 2 players whose latency (ping) is plus/minus 50 difference between them. It will delay the rigistration for faster connections, and speed it up for the slower one.
In practice, in speeding up the registration, this sometimes appears like you've been hit before the player has even taken a shot. But that is only an illusion created by the algorithm used.
Between players whose latency (ping) is not greater than a certain mean average between them, no noticable delay or speeding up is made.
In other words, it gives slower ping players a fighting chance against players with a much faster ping. But between players whose ping is roughly the same, no such adjustments are made.
If server admins want to reduce the amount of compensation used when anti-lag is enabled (and, it has to be said, many game industry insiders insist that anti-lag is by far and away the "fairer" system), make sure you exclude players with a ping greater than 50/60 the average player ping on your server.
So, for example, if the average player ping on your server is 50, set these settings:
set sv_minPing "20"
set sv_maxping "110"
It will have the draw back of limiting server traffic for players whose ping is outside those values, but will greatly reduce the blatant compensation illusions which can (and do) occur using anti-lag. This gives a more "pleasing" experience as you dont feel so robbed or cheated during play.
Turn off anti-lag, and you will see the old style hit registrations - the faster ping players will always win hands down against slower ping players.