{
  "docId": "019dd923-622c-750b-8b97-202fcba3bc0a",
  "docSlug": "4a1cd2416c13",
  "documentTitle": "Joyy Inc. (YY)",
  "authorId": "51_Muddy_Waters",
  "authorName": "Carson Block",
  "documentKindSlug": "research-note",
  "documentKindLabel": "Research note",
  "sourceTypeSlug": "short_seller",
  "sourceTypeLabel": "Short seller",
  "presentationDate": "2020-11-18 00:00:00",
  "orientation": "portrait",
  "aspectRatio": 0.77272725,
  "pageNumber": 31,
  "pageCount": 71,
  "prevPage": 30,
  "nextPage": 32,
  "slideType": "other",
  "function": "expose_contradiction",
  "density": "dense",
  "nDataPoints": 8,
  "notes": "The slide uses screenshots of internal data dashboards to contrast normal gifting patterns with those originating from a localhost IP, suggesting bot activity.",
  "elementsJson": [
    "paragraph",
    "screenshot",
    "footnote"
  ],
  "metadataConfidence": 0.9,
  "imagePath": null,
  "slideHref": "/slides/019dd923-622c-750b-8b97-202fcba3bc0a/31",
  "deckHref": "/decks/019dd923-622c-750b-8b97-202fcba3bc0a",
  "deckJsonHref": "/decks/019dd923-622c-750b-8b97-202fcba3bc0a.json",
  "deckAnchorHref": "/decks/019dd923-622c-750b-8b97-202fcba3bc0a#slide-31",
  "components": [
    {
      "bbox": null,
      "kind": "callout",
      "text": "The local host IP, 127.0.0.1, suddenly emerged in Killing Time’s gifting pattern, which we believe indicates an accidental leak, perhaps caused by a temporary glitch in the software used to mask the user’s real origin.",
      "attrs": null,
      "subkind": null,
      "toolName": "Visual emphasis",
      "toolSlug": "visual-emphasis",
      "confidence": null,
      "componentId": "019dd953-0394-7243-be94-c7157f2b0b8a",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.15,
        "w": 0.78,
        "x": 0.11,
        "y": 0.17
      },
      "kind": "image",
      "text": "Dashboard showing Killing Time's normal gifting activity.",
      "attrs": null,
      "subkind": "screenshot",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "6550ba03-c68b-4d8f-ac5c-ef884e94120b",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.15,
        "w": 0.78,
        "x": 0.11,
        "y": 0.37
      },
      "kind": "image",
      "text": "Dashboard showing Killing Time's gifting activity with IP 127.0.0.1.",
      "attrs": null,
      "subkind": "screenshot",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "96e1425f-e429-4619-95da-e8fd6b7287ff",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.06,
        "w": 0.78,
        "x": 0.11,
        "y": 0.09
      },
      "kind": "paragraph",
      "text": "The local host IP, 127.0.0.1, suddenly emerged in Killing Time’s gifting pattern, which we believe indicates an accidental leak, perhaps caused by a temporary glitch in the software used to mask the user’s real origin.",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "033db2e6-ae7a-4eb7-984e-0c29b83e6246",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.08,
        "w": 0.78,
        "x": 0.11,
        "y": 0.68
      },
      "kind": "paragraph",
      "text": "We found 19,391 PUs’ IDs were connected to “Thin Noodle” through various shared IMEIs. In other words, while a viewer would observe 19,392 individual users, our data collection showed that all of these PUs were in fact FUs.",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "c813552b-daf3-48b4-bd90-34c1a2650871",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.12,
        "w": 0.78,
        "x": 0.11,
        "y": 0.55
      },
      "kind": "paragraph",
      "text": "Case Study: Thin Noodle. We found that Thin Noodle, the #91 Top PU during our monitoring period, sits in a network of FU Bots. Thin Noodle exhibited near-impossible geographic IP skips between Chile and China while also revealing the local host IP.",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "ecfa832f-1977-4a20-8e3a-938c82053641",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": null,
      "kind": "quote",
      "text": "A 127.0.0.1 is an IP created by a “localhost” indicating that the activity is being conducted within the server itself, totally separate from the external internet. — Footnote 43",
      "attrs": null,
      "subkind": null,
      "toolName": "Authority citation",
      "toolSlug": "authority-citation",
      "confidence": null,
      "componentId": "019dd953-0394-7243-be94-c8c49ffda203",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.03,
        "w": 0.78,
        "x": 0.11,
        "y": 0.88
      },
      "kind": "source-note",
      "text": "A 127.0.0.1 is an IP created by a “localhost” indicating that the activity is being conducted within the server itself, totally separate from the external internet.",
      "attrs": {
        "numbered": true
      },
      "subkind": null,
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "db3ef19c-fc56-41f3-993f-c1627c3f5cef",
      "frameworkName": null,
      "frameworkSlug": null
    }
  ],
  "metrics": [],
  "tools": [],
  "frameworks": [
    {
      "name": "fraud-exposure",
      "slug": null,
      "matchId": "13c09411-2fe2-4e9a-ae92-602df23a1849",
      "evidence": "The slide uses data patterns to expose bot networks and fake user activity.",
      "confidence": 0.9
    }
  ],
  "arcBeats": [
    {
      "to": 71,
      "from": 4,
      "beatId": "a6d172fd-e615-4921-ab5f-acf82f61ca10",
      "arcName": "Overcoming the Monster",
      "arcSlug": "overcoming-monster",
      "beatName": "Expose Contradiction",
      "beatSlug": null,
      "evidence": "The report is filled with expose contradiction beats, revealing discrepancies in YY's reporting",
      "position": 0,
      "confidence": 0.8,
      "parentBeatName": null,
      "parentBeatSlug": null
    }
  ],
  "loops": [],
  "imagePathAlt": null,
  "thumbSrc": null,
  "thumbSrcAlt": null,
  "locked": true
}