{ "docId": "019dd923-622c-750b-8b97-202fcba3bc0a", "docSlug": "4a1cd2416c13", "documentTitle": "Joyy Inc. (YY)", "authorId": "51_Muddy_Waters", "authorName": "Carson Block", "documentKindSlug": "research-note", "documentKindLabel": "Research note", "sourceTypeSlug": "short_seller", "sourceTypeLabel": "Short seller", "presentationDate": "2020-11-18 00:00:00", "orientation": "portrait", "aspectRatio": 0.77272725, "pageNumber": 8, "pageCount": 71, "prevPage": 7, "nextPage": 9, "slideType": "appendix_methodology", "function": "analyze_data", "density": "overcrowded", "nDataPoints": 10, "notes": "The slide details the identification of fraudulent gift revenue by linking PU IDs to YY-controlled internal network IPs and shared IMEIs.", "elementsJson": [ "paragraph", "callout_box", "footnote" ], "metadataConfidence": 0.95, "imagePath": null, "slideHref": "/slides/019dd923-622c-750b-8b97-202fcba3bc0a/8", "deckHref": "/decks/019dd923-622c-750b-8b97-202fcba3bc0a", "deckJsonHref": "/decks/019dd923-622c-750b-8b97-202fcba3bc0a.json", "deckAnchorHref": "/decks/019dd923-622c-750b-8b97-202fcba3bc0a#slide-8", "components": [ { "bbox": { "h": 0.22, "w": 0.78, "x": 0.11, "y": 0.25 }, "kind": "callout", "text": "Internal Network FUs and YY Server FUs Revealed Themselves Through Glitches\n\nInternal Network FUs are PUs that display YY's internal network IP addresses, 100.64.0.0 ~ 100.64.0.10. YY Server FUs, on the other hand, are PUs that carry the local host server IP, 127.0.0.1. The IP addresses these FUs display can only come from inside YY. However, these internal IP addresses normally get masked with normal IPs. FUs reveal these IPs only rarely: we suspect that YY typically uses a VPN or other software to disguise the transactions that are coming from within YY. We caught these FUs thanks to our continuous monitoring of PUs during our observation period. For more information on IP patterns of Internal Network FUs and YY Server FUs, see section “Time to Upgrade the FraudTech: Slip-Ups Reveal YY-Controlled Gifting”.", "attrs": null, "subkind": "primary", "toolName": null, "toolSlug": null, "confidence": null, "componentId": "bf39a405-4209-4671-8e17-27cb09d3078e", "frameworkName": null, "frameworkSlug": null }, { "bbox": null, "kind": "callout", "text": "Summing these FU groups’ gift contributions, we identified 48.0% of livestreaming gift revenue above to be fraudulent based on IMEI sharing alone.", "attrs": null, "subkind": null, "toolName": "Visual emphasis", "toolSlug": "visual-emphasis", "confidence": null, "componentId": "019dd953-0394-7243-be91-d72f96183267", "frameworkName": null, "frameworkSlug": null }, { "bbox": null, "kind": "metric", "text": "fraudulent gift revenue: 48.0%", "attrs": null, "subkind": "primary", "toolName": "Quantification", "toolSlug": "quantification", "confidence": null, "componentId": "019dd953-0394-7243-be91-db2cc0e4d6c0", "frameworkName": null, "frameworkSlug": null }, { "bbox": { "h": 0.07, "w": 0.78, "x": 0.11, "y": 0.49 }, "kind": "paragraph", "text": "20,399 PUs shared IMEIs with the YY Internal Network FUs and YY Server FUs above. Of these, the XHL gift data for 10,606 PUs recorded RMB 91.1 million in gifts, equal to 13.3% of gifts in the XHL data set. We deem these PUs to be FUs. To the extent these FUs were also performers, we classed their channel owners as YY-controlled.", "attrs": null, "subkind": "paragraph", "toolName": null, "toolSlug": null, "confidence": null, "componentId": "739a050d-7cad-4d12-9710-bd1c2eb6aee8", "frameworkName": null, "frameworkSlug": null }, { "bbox": { "h": 0.07, "w": 0.78, "x": 0.11, "y": 0.57 }, "kind": "paragraph", "text": "Another 30,323 unique, deduplicated PU IDs shared IMEIs with performers who belonged to YY-controlled channel owners. Among these were 13,145 PUs with XHL gift data. These 13,145 PUs (13.6%) users sent out RMB 221.2 million in gifts, equal to 32.2% of all gifts in the XHL data set. We deem these to be additional FUs.", "attrs": null, "subkind": "paragraph", "toolName": null, "toolSlug": null, "confidence": null, "componentId": "96fb3b07-1c36-45ac-a27b-07df66da642c", "frameworkName": null, "frameworkSlug": null }, { "bbox": { "h": 0.07, "w": 0.78, "x": 0.11, "y": 0.09 }, "kind": "paragraph", "text": "We obtained the PU information from XHL, which consists of 96,432 PUs contributing RMB 686.5 million in gifts. The PUs falling into at least one of the above categories totaled 24,051, or 24.9%. These PUs contributed gifts totaling RMB 329.8 million, which was 48% of the total.", "attrs": null, "subkind": "paragraph", "toolName": null, "toolSlug": null, "confidence": null, "componentId": "ade95d90-2ec8-4bf2-856a-730894572715", "frameworkName": null, "frameworkSlug": null }, { "bbox": { "h": 0.07, "w": 0.78, "x": 0.11, "y": 0.65 }, "kind": "paragraph", "text": "Summing these FU groups' gift contributions, we identified 48.0% of livestreaming gift revenue above to be fraudulent based on IMEI sharing alone. We establish below that the remaining half of livestreaming gift revenue is likely almost entirely fraudulent as well through additional research techniques. We relate two PU samples that show that the vast majority of PUs are bots and therefore FUs, making fraudulent gift transactions and/or displaying signs of control by YY.", "attrs": null, "subkind": "paragraph", "toolName": null, "toolSlug": null, "confidence": null, "componentId": "c45274c9-11b1-4d65-82c6-563adb2fb1a6", "frameworkName": null, "frameworkSlug": null }, { "bbox": { "h": 0.08, "w": 0.78, "x": 0.11, "y": 0.84 }, "kind": "source-note", "text": "12 For more information on the connection methodology, see Appendix C.\n13 The following information is based on the 52,104 PU IDs are based only on the PUs' info we monitored and collected, which we believe is a representative sample size. We are not suggesting YY has only 52,104 PUs. With a more complete list of PUs' gifts for December 2019, the percentage of the gifts from YY-controlled PUs would likely rise.", "attrs": { "numbered": true }, "subkind": null, "toolName": null, "toolSlug": null, "confidence": null, "componentId": "4247fb12-5d43-46b8-bf20-5882b90744fc", "frameworkName": null, "frameworkSlug": null } ], "metrics": [], "tools": [], "frameworks": [ { "name": "fraud-exposure", "slug": null, "matchId": "afdf8786-03ff-431b-ad3f-68c55959a92b", "evidence": "Methodology for identifying fraudulent gift revenue via IP and IMEI analysis.", "confidence": 0.9 } ], "arcBeats": [ { "to": 71, "from": 4, "beatId": "a6d172fd-e615-4921-ab5f-acf82f61ca10", "arcName": "Overcoming the Monster", "arcSlug": "overcoming-monster", "beatName": "Expose Contradiction", "beatSlug": null, "evidence": "The report is filled with expose contradiction beats, revealing discrepancies in YY's reporting", "position": 0, "confidence": 0.8, "parentBeatName": null, "parentBeatSlug": null }, { "to": 9, "from": 7, "beatId": "546e0867-13c1-4062-b6b5-42f8b8db7bc6", "arcName": "Overcoming the Monster", "arcSlug": "overcoming-monster", "beatName": "Appendix Methodology", "beatSlug": null, "evidence": "The report provides detailed methodology for data analysis", "position": 1, "confidence": 0.8, "parentBeatName": null, "parentBeatSlug": null } ], "loops": [], "imagePathAlt": null, "thumbSrc": null, "thumbSrcAlt": null, "locked": true }