Security

How the bot works

The bot is written in JavaScript and imitates the user actions straight from the browser, in your normal game session. To use it a PC has to stay on and connected.

Almost every action has random, customisable timings: waits between attacks, refreshes at varying intervals, different pages visited during activity.

Usage tips

• Keep Wait between each attack / spy on in the Attacks menu.
• Do not set the auto-activity minimum below 5 minutes.
• Do not touch the Advanced configuration timings unless you know what they do: values that are too low make the bot recognisable.
• Avoid the Aggressive preset on servers where players are very active.

Code and data

• Before running the downloaded code, the loader checks its SHA-256 fingerprint against the published one: nobody can make you run code other than the released one.
• Telegram notifications leave from the oBot server: the service keys never pass through your browser.
• The bot stores on the server its configuration, the results of attacks and expeditions and, if you enable it, the action log. For automatic login it is better to use the credentials stored in the browser: that way the bot does not save your password.