{
  "docId": "019dd923-622c-750b-8b97-202fcba3bc0a",
  "docSlug": "4a1cd2416c13",
  "documentTitle": "Joyy Inc. (YY)",
  "authorId": "51_Muddy_Waters",
  "authorName": "Carson Block",
  "documentKindSlug": "research-note",
  "documentKindLabel": "Research note",
  "sourceTypeSlug": "short_seller",
  "sourceTypeLabel": "Short seller",
  "presentationDate": "2020-11-18 00:00:00",
  "orientation": "portrait",
  "aspectRatio": 0.77272725,
  "pageNumber": 71,
  "pageCount": 71,
  "prevPage": 70,
  "nextPage": null,
  "slideType": "other",
  "function": "illustrate_case",
  "density": "balanced",
  "nDataPoints": 0,
  "notes": "The slide explains how internal IP addresses are exposed when a VPN connection fails, revealing the bot's origin.",
  "elementsJson": [
    "process_diagram",
    "numbered_list"
  ],
  "metadataConfidence": 0.9,
  "imagePath": null,
  "slideHref": "/slides/019dd923-622c-750b-8b97-202fcba3bc0a/71",
  "deckHref": "/decks/019dd923-622c-750b-8b97-202fcba3bc0a",
  "deckJsonHref": "/decks/019dd923-622c-750b-8b97-202fcba3bc0a.json",
  "deckAnchorHref": "/decks/019dd923-622c-750b-8b97-202fcba3bc0a#slide-71",
  "components": [
    {
      "bbox": null,
      "kind": "callout",
      "text": "The transaction will show the gift originating from the VPN provider even though in reality it is originating from inside the LUSH cloud.",
      "attrs": null,
      "subkind": null,
      "toolName": "Visual emphasis",
      "toolSlug": "visual-emphasis",
      "confidence": null,
      "componentId": "019dd953-0394-7243-be98-43b4529509f9",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "x": 0.47,
        "y": 0.35
      },
      "kind": "diagram",
      "text": "Network flow diagram with VPN active",
      "attrs": null,
      "subkind": "process",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "2fe57fab-5bc3-4cd7-b700-8c97fe4565e3",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "x": 0.47,
        "y": 0.65
      },
      "kind": "diagram",
      "text": "Network flow diagram with VPN disconnected",
      "attrs": null,
      "subkind": "process",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "3259bd73-d445-47f0-9bee-b588d6c98e93",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "x": 0.88,
        "y": 0.65
      },
      "kind": "list",
      "text": "1. The bot has an internal IP address of 100.64.1.2. 2. The main YY.com server has an internal IP address of 100.64.1.1 and a public IP address of 103.227.121.100. 3. When the bot goes to send a transaction, when the VPN is down, the internal cloud network still knows how to get to YY.com. 4. It knows to send the traffic internally to YY.com on 100.64.1.1. 5. In the transaction details we then see the internal network address 100.64.1.2 that the bot sent the transaction from. 6. The VPN and public IP address of YY.com are not hit. NOTE: The YY.com server straddles the public internet (103.227.121.100) and the internal cloud network (100.64.1.1).",
      "attrs": null,
      "subkind": "numbered",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "1c703623-f119-4ff2-b2d2-f65c2b6f0596",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "x": 0.88,
        "y": 0.35
      },
      "kind": "list",
      "text": "1. The bot has an internal IP address of 100.64.1.2. 2. The main YY.com server has an internal IP address of 100.64.1.1 and a public IP address of 103.227.121.100. 3. When the bot sends a gift, the gift flows out of the LUSH cloud to the VPN provider. 4. The connection is then made from the VPN provider (112.28.160.118) to YY.com through the public IP address (103.227.121.100). 5. The transaction will show the gift originating from the VPN provider even though in reality it is originating from inside the LUSH cloud. NOTE: The YY.com server straddles the public internet (103.227.121.100) and the internal cloud network (100.64.1.1).",
      "attrs": null,
      "subkind": "numbered",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "4d3537d6-52c4-49e8-af7d-17dec22b9109",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "x": 0.45,
        "y": 0.38
      },
      "kind": "paragraph",
      "text": "A diagram showing when the VPN is down:",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "c1bfd7f6-c036-4567-9951-2fb43344b3c0",
      "frameworkName": null,
      "frameworkSlug": null
    }
  ],
  "metrics": [],
  "tools": [],
  "frameworks": [],
  "arcBeats": [
    {
      "to": 71,
      "from": 4,
      "beatId": "a6d172fd-e615-4921-ab5f-acf82f61ca10",
      "arcName": "Overcoming the Monster",
      "arcSlug": "overcoming-monster",
      "beatName": "Expose Contradiction",
      "beatSlug": null,
      "evidence": "The report is filled with expose contradiction beats, revealing discrepancies in YY's reporting",
      "position": 0,
      "confidence": 0.8,
      "parentBeatName": null,
      "parentBeatSlug": null
    }
  ],
  "loops": [],
  "imagePathAlt": null,
  "thumbSrc": null,
  "thumbSrcAlt": null,
  "locked": true
}