[2020] PSA: Waves of players being banned for use of third-party tool POE Overlay

Original Post — Direct link

As of today, 6 of my friends have been banned for use of POE Overlay. I've personally stopped using it and I have to recommend anybody else with the app installed stop using it for now, until we get an official statement from GGG on whether its use is bannable or not.

Edit: We have an official statement in the replies. From what I understand, this means the use of POE Overlay is intended to be bannable due to its auto-pricing feature. As of today I'm uninstalling POE Overlay. It was a great tool while it lasted, but from now on I'll stick to manually pricing my items one by one using the trade website's search.

External link →

almost 5 years ago - /u/Bex_GGG - Direct link

I just checked with Chris, and he says the policy is the same as it has been for the last eight or so years: You may not run programs that interact with the Path of Exile game client. It's okay to run things that are entirely external to the game (i.e. they would work if run on a second computer because they don't need the game open, for example ones that read the client log files).
Edit: I asked one of our team members about this and the account locks related to the Overlay recently have been due to it "hammering the ever-living sh*t out of our website".

almost 5 years ago - /u/Bex_GGG - Direct link

Originally posted by kingdweeb1

Which part of the overlay specifically is getting people banned? I use the overlay primarily to parse my clipboard (search what I hover over and input a command on) and to rebind scroll wheel to left and right arrow keys for stash interaction, am I fine?

It's okay for a program to read data out of the clipboard. If you had that clipboard data on a second computer and the program still worked then it's all good.

almost 5 years ago - /u/Bex_GGG - Direct link

Originally posted by Kostek667

Banning people for using a tool they have used for months without any warning sends a really wrong message to the players. Can somebody from GGG clarify if using POE Overlay is currently against ToS?

These accounts were locked not banned. If the OP is talking about accounts that were banned then it's possible it's a separate issue but I don't have the details there.

almost 5 years ago - /u/Bex_GGG - Direct link

Originally posted by MicoJive

That didn't really answer his question....

What part of PoE overlay is it that is triggering the locks so people can avoid using that part of it.

I believe it was hitting our API a few million times a day. The tool's author will need to look into it. I don't have any more information.

almost 5 years ago - /u/Novynn - Direct link

Originally posted by Versalkul

Does this mean that using the rate limit of the trade website to the fullest extent is now a bannable/lockable offence /u/Novynn ?

No, we only consider failed requests (anything in the HTTP ~400 range) when scanning for bad actors. If you're not generating millions of 429's (which is what this tool is sometimes doing) then you're fine.

almost 5 years ago - /u/Novynn - Direct link

Originally posted by Bex_GGG

I believe it was hitting our API a few million times a day. The tool's author will need to look into it. I don't have any more information.

As a follow up to this:

On the 28th we got 6.7 million requests from poe-overlay in total.

6.1 million of those returned 429 (rate-limited).

5.9 million of those rate-limited requests were from 3 unique accounts.

EDIT: It's been pointed out to me that some versions of poe-overlay obfuscates it's user agent which definitely would throw the total numbers off. Obfuscating your user agent is definitely not something we condone any third party doing.

almost 5 years ago - /u/Novynn - Direct link

Originally posted by FractalSpacer

Why don't' you guys just implement a server-side limit of X searches a minute per acct? That'd fix the problem as well as the bans, no?

We already have this. 429 is the HTTP response code returned when you have been limited.

The handful of accounts that we have locked have been making requests regardless leading to a waste of resources on both ends.

almost 5 years ago - /u/Novynn - Direct link

Originally posted by TsunkoH

I captured any HTTPS requests that overlay was doing - it includes POESESSID. The one thing I don't understand is how did GGG determine that it's specifically overlay? My best guess is the User-Agent, since its specifically stating that its Chrome running on Linux under X11... but there's no direct thing that just states "hello GGG trade site, this is PoE Overlay". Maybe the millions of requests from those specific individuals is using the same exact User-Agent (to hide botting activity and scapegoat Overlay? oh boy, conspiracies!)

As for testing the tool responding to 429, a very brief and uncontrolled test made Overlay actually just sit there and indefinietely display the "Searching..." box without any other requests after the initial POST to the API. After trying to price check multiple items, Overlay just flat out doesn't make an attempt. Again, the test was just a brief one using Fiddler's AutoResponder and an auto-respond 429 with a Retry-After of 5.

edit/update: I manually triggered 429 by just spamming price check on random items in a dump tab - Overlay correctly reports that you're being rate limited, though any previous price checks that succeeded in the /trade/search phase will still attempt to do the /trade/fetch request (and, as one would expect by now, fail at it). Though, it does not re-attempt any of these requests as far as I can tell.

edit2: Looked at Overlay's source for the User-Agent thing - it's randomly generated, just so happened that the run I tried it on I got X11/Linux/Chrome... Either way, the point still stands: How is GGG detecting that these API requests are coming from Overlay specifically?

Thanks for bringing this to our attention. We really don't condone tools obfuscating their user agent... I'm glad to see that the author of this particular tool has removed this in their most recent update.

← More from Path of Exile

Recent Path of Exile Posts

1 day ago - CommunityTeam_GGG

1 day ago - /u/Community_Team

2 days ago - Novynn

Recent Path of Exile Posts

3.25 End-of-League Private League Events

ETA on patch 0.2.0g?

Ps5 trading issue. “Invalid query; Your account must be in-game to use this feature.”