Developers - Stop over looking softbans and thresholds

[clamchoda]

Hello.

As some of you may know I am developing a bot that does not run off the API. I would just like to point out an interesting finding that I have seen consecutive similar results in over the last few days.

Tests (Done on seperate days);
- A bot that runs through the emulator (A mobile device, Non-API bot) , default Nox walkspeed, never gets soft banned or server throttle. (50k XP/H)
- A necrobot (API BOT), set 5 KM/H, and a very low actions config, I receive soft bans / server throttles through out the night. (9k XP/H)

This is interesting to me because this means, the API bot, makes an absurd amount of calls to the server that normally would never happen from an actual mobile device. This has to be the point of detection on Niantic side against the API bot. For those of you that think the bot is not detected, you're wrong unfortunately. Niniac simply softbans instead of hardbans. I wont get into detail, but if you followed development of this game, you'll know that in ALPHA, they hard ban bots which in turn, actually hurt the game. (spawn rates, google for an explanation). That's why we're only seeing softbans in release, for now. So you can bet your butt, that once the spawn rate issues and other issues determined by the player base are addressed, than new ban systems may be implemented. It may seem early to think about this, but it's not. Niantic is.

From an overview of the XP/H and P/H, I would have expected the Non-API bot to receive the softbans, as it appears to be making more actions (higher XP/H and P/H). So my findings are, that even though the API Bots are set to do less, they are doing ALOT more in the background.

I believe Niantic has a threshold on which the client can make calls to their server. That being said, I also believe that this threshold amount is determined based on the actual API calls a true mobile device could make. So when you exceed this threshold, they know you are making the calls outside of a mobile device, and or running more than one account from the same IP.

For the next API bot, a more efficient way of finding pokemon and stops needs to be implemented. Perhaps efficient is not the right word. I mean, a less demanding API call. Either way, they API needs to be updated to match this threshold to get rid of these annoying softban issues.

tldr; Niantic knows a threshold that a mobile device can not possibly exceed via a legit client, and the API bots exceed this threshold. If anyone can provide me with a version of an API bot which either counts our outputs the API calls to the console, that would really save me some time, thank you. Although, I will not run pre-compiled exe's.

[xm@n]

For the API bot, do we really need humanized setting? From your findings, even 5 KM/H bot is still detectable because of the amount of API calls.

[clamchoda]

For the API bot, do we really need humanized setting? From your findings, even 5 KM/H bot is still detectable because of the amount of API calls.

That's what I am trying to figure out here. I honestly think that it's the way the bot makes use of the API for it's Pokemon scanning, catching moving ect. It's just too far off and excessive compared to the way the API is intended to be used.

So tldr; Niantic knows a threshold that a mobile device can not possibly exceed via a legit client, and the API bots exceed this threshold.

[xm@n]

Even without API request threshold, I think they still could detect bot by other information.

[clamchoda]

Even without API request threshold, I think they still could detect bot by other information.

Your 100% right. Where there's a will, there's a way friend.

[pokemaniac]

Nice post bro, I think you're right.