{
  "docId": "019dd923-622c-750b-8b97-202fcba3bc0a",
  "docSlug": "4a1cd2416c13",
  "documentTitle": "Joyy Inc. (YY)",
  "authorId": "51_Muddy_Waters",
  "authorName": "Carson Block",
  "documentKindSlug": "research-note",
  "documentKindLabel": "Research note",
  "sourceTypeSlug": "short_seller",
  "sourceTypeLabel": "Short seller",
  "presentationDate": "2020-11-18 00:00:00",
  "orientation": "portrait",
  "aspectRatio": 0.77272725,
  "pageNumber": 35,
  "pageCount": 71,
  "prevPage": 34,
  "nextPage": 36,
  "slideType": "expose_contradiction",
  "function": "expose_contradiction",
  "density": "balanced",
  "nDataPoints": 3,
  "notes": "Includes a screenshot of a dashboard and a data table highlighting local host IP usage.",
  "elementsJson": [
    "screenshot",
    "data_table",
    "paragraph",
    "footnote"
  ],
  "metadataConfidence": 1,
  "imagePath": null,
  "slideHref": "/slides/019dd923-622c-750b-8b97-202fcba3bc0a/35",
  "deckHref": "/decks/019dd923-622c-750b-8b97-202fcba3bc0a",
  "deckJsonHref": "/decks/019dd923-622c-750b-8b97-202fcba3bc0a.json",
  "deckAnchorHref": "/decks/019dd923-622c-750b-8b97-202fcba3bc0a#slide-35",
  "components": [
    {
      "bbox": null,
      "kind": "callout",
      "text": "This pattern is indicative of a VPN or other IP disguising software being used to hide the address of the real origin of the gifts, which was YY's own local server.",
      "attrs": null,
      "subkind": null,
      "toolName": "Visual emphasis",
      "toolSlug": "visual-emphasis",
      "confidence": null,
      "componentId": "019dd953-0394-7243-be94-e37d362792a3",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.13,
        "w": 0.78,
        "x": 0.11,
        "y": 0.09
      },
      "kind": "image",
      "text": "Dashboard showing gifting metrics",
      "attrs": null,
      "subkind": "screenshot",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "442b41d2-4090-4df9-b75e-003f932a8d2c",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.08,
        "w": 0.78,
        "x": 0.11,
        "y": 0.64
      },
      "kind": "paragraph",
      "text": "When an abnormal IP address, such as a local host IP or an internal network-connected IP are logged, there is usually no IMEI recorded by YY, as seen from the blanks that appear in the “detailInfo_imei” column above.",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "18a176e4-55d0-4c1b-973d-bf1a006d63a1",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.11,
        "w": 0.78,
        "x": 0.11,
        "y": 0.26
      },
      "kind": "paragraph",
      "text": "We also found suspicious IP address skips in Orange Juice's gifting activity on Jan 28, 2020. Orange Juice started sending gifts on one IP address, 112.17.241.1 in Ningbo, and then in the midst of a barrage of gifts, he exposed the local host IP, 127.0.0.1.",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "8105e1ca-d9d4-4637-a743-41f6c3185dd9",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.07,
        "w": 0.78,
        "x": 0.11,
        "y": 0.83
      },
      "kind": "source-note",
      "text": "Footnotes 49, 50, 51 regarding IP addresses, VPN usage, and IMEI glitches.",
      "attrs": null,
      "subkind": null,
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "315531ce-3bce-4e60-bd80-ded056f21890",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.21,
        "w": 0.78,
        "x": 0.11,
        "y": 0.4
      },
      "kind": "table",
      "text": "Table showing timestamps, IP addresses, and missing IMEI data",
      "attrs": null,
      "subkind": "data",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "3714a318-ad1a-4c0a-95bd-5ad33e0f45b1",
      "frameworkName": null,
      "frameworkSlug": null
    }
  ],
  "metrics": [],
  "tools": [],
  "frameworks": [],
  "arcBeats": [
    {
      "to": 71,
      "from": 4,
      "beatId": "a6d172fd-e615-4921-ab5f-acf82f61ca10",
      "arcName": "Overcoming the Monster",
      "arcSlug": "overcoming-monster",
      "beatName": "Expose Contradiction",
      "beatSlug": null,
      "evidence": "The report is filled with expose contradiction beats, revealing discrepancies in YY's reporting",
      "position": 0,
      "confidence": 0.8,
      "parentBeatName": null,
      "parentBeatSlug": null
    },
    {
      "to": 68,
      "from": 33,
      "beatId": "3c6771a1-f1c8-4750-b7e3-071b79a82bbf",
      "arcName": "Overcoming the Monster",
      "arcSlug": "overcoming-monster",
      "beatName": "Appendix Data",
      "beatSlug": null,
      "evidence": "The report includes extensive data and examples to support its claims",
      "position": 2,
      "confidence": 0.8,
      "parentBeatName": null,
      "parentBeatSlug": null
    }
  ],
  "loops": [],
  "imagePathAlt": null,
  "thumbSrc": null,
  "thumbSrcAlt": null,
  "locked": true
}