ILuckyGuyI is part of an alt farm that has been cheating contests for years

[Revolution2025]

The IP evidence is strongly supportive of ILuckyGuyI, CLS63, jakdanyel, emrecemsan, Velvet78, and Distraction all being the same person. In each case there are even logs of them sharing exactly the same IPv6 address, which is very rare if it's not the same person.

thanks for your intervention in this case, we hope to see you intercede in similar case in the future

all evidence is against you

there's nothing for you to prove

let us assume that all the accounts are handled by different users

why did you chose to share same router/WiFi with your friends when you know that your IP addresses will be the same

the strongest evidence that can be used against you in the forum is wallet connection, why did you use same deposit address and transfer cryptocurrency to each other

if possibly you are not the sole owner of all the accounts mentioned in this case then the only excuse will be that you all work together in same space, share same Router/WiFi, help each other in writing posts, same posting style and pattern then the sequence continues

it is very shameful that you find yourself in this situation after spending nearly 10 years in the forum

you have to slap yourself for being stupid

[mindrust]

I am pretty surprised to see that theymos did interfere and post his own opinions and backed them with data... as far as I know he wasnt interested any of the forum drama in the past. he was like a ghost. now he comes out of the shadows, posts backend logs, shapes the public opinion.

This will act as a deterrent too. The other acc farmers now know it, if they abuse the forum too much, the admin can check the logs and identify the alts pretty easily. Surely there are ways to use multiple IP's but it will definitely make things harder for the farmers. One missclick and your IP is now connected to the every other alt you got.

It was already hard to control and post from multiple accounts. Now it became way harder.

Pretty sure IP isnt the only thing that gives away your real identity anyway. Digital finger prints and shiet, theymos is smart enough to look into those as well. Does he care enough? He did care enough to look into the IP logs... Next time he might take this one step further.

[snipie]

I am pretty surprised to see that theymos did interfere and post his own opinions and backed them with data... as far as I know he wasnt interested any of the forum drama in the past. he was like a ghost. now he comes out of the shadows, posts backend logs, shapes the public opinion.

This will act as a deterrent too. The other acc farmers now know it, if they abuse the forum too much, the admin can check the logs and identify the alts pretty easily. Surely there are ways to use multiple IP's but it will definitely make things harder for the farmers. One missclick and your IP is now connected to the every other alt you got.

It was already hard to control and post from multiple accounts. Now it became way harder.

Pretty sure IP isnt the only thing that gives away your real identity anyway. Digital finger prints and shiet, theymos is smart enough to look into those as well. Does he care enough? He did care enough to look into the IP logs... Next time he might take this one step further.

As far as my bad memory recall, I believe theymos interfered in the past on similar cases. This is not a precedent if I am not mistaken. You can try searching if you are interested.
IP logs are limited but could give a lot of information. I don't know if the forums gather more information about the device used to connect and the browser because within big and young families, you can find several members sharing the same config. Same goes for group of friends, students living together.

[xLays]

I am pretty surprised to see that theymos did interfere and post his own opinions and backed them with data... as far as I know he wasnt interested any of the forum drama in the past. he was like a ghost. now he comes out of the shadows, posts backend logs, shapes the public opinion.

This will act as a deterrent too. The other acc farmers now know it, if they abuse the forum too much, the admin can check the logs and identify the alts pretty easily. Surely there are ways to use multiple IP's but it will definitely make things harder for the farmers. One missclick and your IP is now connected to the every other alt you got.

It was already hard to control and post from multiple accounts. Now it became way harder.

Pretty sure IP isnt the only thing that gives away your real identity anyway. Digital finger prints and shiet, theymos is smart enough to look into those as well. Does he care enough? He did care enough to look into the IP logs... Next time he might take this one step further.

I think the reason theymos got involved this time is simply because someone probably asked him to look into it. I don't think he suddenly became interested in issue or the drama you talking about. If nobody had asked for his input or brought the issue to his attention, I doubt he would have stepped in and checked the backend logs.
As he recently said, he's okay with users sending suggestions, whether they are made publicly or privately. So maybe someone took that opportunity and asked him to look into this particular issue.

[dkbit98]

Good work guys on cracking another farm.
Maybe it's Sisyphus work, but it makes forum a better place.

Because the VPN also changes the addresses, and those addresses are not Turkish. Examine it in detail and you'll definitely find something that sets me apart from the others.

You can explain VPN for sure, but I didn't hear any good explanation for the same writing patterns, and for address connections.
It's very obvious to everyone that you were using several alt accounts basically for cheating.

[nutildah]

I wanted to address some persisting misconceptions. Mainly, this isn't a witch hunt. This was me acting on something strange I saw because I thought it was worth bringing up. Only with the help of the community was the whole thing put together -- I certainly didn't imagine it would be this big in scope when I first opened this topic.

I've been here for a long time and have seen a lot of things. I can keep a secret about somebody's alt account. Sometimes - more often than not, actually - it turns out it was the wrong thing to do. I knew jakdanyel was the alt account of ILuckyGuyI almost immediately after the sigban, but decided not to act on it until I discovered the two accounts had been entering the same contests together for years.

IMO, this type of thing is not something that should be kept a secret. Multi-accounting in contests, pools & tournaments is an inherently unfair practice that punishes honest participants.

As far as "proof" of the contest cheating is concerned, I looked through at least 100 contests participated in by both CLS63 and ILuckyGuyI and didn't find a single identical entry. No prediction they made is exactly the same for the same contest. Rather, they look like they are covering different probable outcomes, especially when a 3rd account from the farm has entered.

Here is the closest example I found of 2 accounts making the same prediction:

1. No
2. No
3. Over
4. Dallas
5. Dallas
6. Boston
7. Boston

1. Yes
2. No
3. Over
4. Dallas
5. Dallas
6. Boston
7. Boston

These 2 accounts have 1640 posts in the Games & Rounds section. This represents several hundred shared contests. Feel free to inspect the posts yourselves and come to your own conclusions:

https://bitlist.co/search?author=ILuckyGuyI,CLS63&board_id=71&limit=20&sort_by=date_asc

Finally, this is connected to sigban work only because its hard to write quality posts if you're running 5-6 accounts at the same time. In addition to ILuckyGuyI, I sigbanned jakdanyel and Distraction and will stop at that.

Thanks to everybody who contributed evidence and connected the dots.

[Rikafip]

As far as "proof" of the contest cheating is concerned, I looked through at least 100 contests participated in by both CLS63 and ILuckyGuyI and didn't find a single identical entry. No prediction they made is exactly the same for the same contest. Rather, they look like they are covering different probable outcomes, especially when a 3rd account from the farm has entered.

I found one case of the same prediction. I haven't checked thoroughly though, just the first few pages of results (I started with the newest ones). 

27 goals

27 goals

[cryptofrka]

The IP evidence is strongly supportive of ILuckyGuyI, CLS63, jakdanyel, emrecemsan, Velvet78, and Distraction all being the same person. In each case there are even logs of them sharing exactly the same IPv6 address, which is very rare if it's not the same person.

theymos, can we please focus a little bit more on this?
Sorry it took me a while, I knew nothing about these things a few days ago - and still don't know much. What I did gather is that you shaped the public opinion based on something that is usually considered only as supporting evidence.
Can you, with certainty, connect CLS63 with the other accounts?

Basic Chatgpt search gives me this (and for this tech stuff AI is usually on point):

In particular, saying identical IPv6 addresses are “very rare if it's not the same person” can be misleading if the address could be an Opera VPN exit address.

Also:

Even if two accounts have an exact 128-bit match, the match establishes that the service logging them observed the same source IPv6 address. It does not inherently tell you whether there was one device, two devices, one LAN, a VPN/proxy exit, or another intermediary.

I'm just trying to understand all of this. Is it 100% or not, and if not - why make such a statement at all?
Also, can we now expect such involvement from you in similar cases in the future?

IMO, this type of thing is not something that should be kept a secret. Multi-accounting in contests, pools & tournaments is an inherently unfair practice that punishes honest participants.

Finally something we agree on. This is exactly why I want the CLS63 case explained to me.

[eaLiTy]

~
What are the chances of any other member of this forum using the Opera browser and the exact location (city with the same IP address) to hide their true location?

I am also using the Opera browser with the VPN active by default, and I highly doubt the IPv6 addresses would be the same, unless someone from my city is also accessing the site using the same browser defaults.

In this case, the only way that's even possible is that Opera VPN uses a small, fixed pool of public IP addresses for each region. In that specific instance, multiple devices connecting from the same city or building will almost always be assigned to the exact same Opera proxy server—making identical IPv4 and IPv6 addresses possible.

@nutildah did a good job identifying the patterns. I am only sharing the possibility of how using the Opera browser with the VPN enabled by default could produce the same IPv4 and IPv6 addresses.

~
It's not normal for IPv6 addresses to be the same with a VPN, typically. And you shift ISPs in the same patterns as ILuckyGuyI.

Like I mentioned above, Opera VPN is not actually a true virtual network tunnel, but rather a proxy server.

Source: https://www.helpnetsecurity.com/2016/04/22/opera-browser-vpn-proxy/

[JollyGood]

Finally, this is connected to sigban work only because its hard to write quality posts if you're running 5-6 accounts at the same time. In addition to ILuckyGuyI, I sigbanned jakdanyel and Distraction and will stop at that.

It seems to be sending a signal to account farmers that just one or a select few of their accounts will receive signature bans if they have conducted in nefarious conduct. I believe it is a bad idea as it sends out the wrong messages and is not an appropriate deterrent.

Just for clarity, are you not giving a signature ban to CLS63 on the basis that the posts made using that account were not substandard in quality but the ILuckyGuyI, jakdanyel and Distraction accounts were making substandard quality posts?

I am also using the Opera browser with the VPN active by default, and I highly doubt the IPv6 addresses would be the same, unless someone from my city is also accessing the site using the same browser defaults.

In this case, the only way that's even possible is that Opera VPN uses a small, fixed pool of public IP addresses for each region. In that specific instance, multiple devices connecting from the same city or building will almost always be assigned to the exact same Opera proxy server—making identical IPv4 and IPv6 addresses possible.

The chances that those six accounts used the same IP address at the exact same times on multiple occasions are almost zero whether they used Opera VPN or not. The IP addresses matching on multiple occasions is not a coincidence. Also when the accounts woke up over a period three days in 2020, that also was no coincidence. Then when another two accounts woke up together, that too was no coincidence.

I know some members here (including myself) find it hard to believe the CLS63 account was involved in this but the evidence is extremely strong and his explanations to distract from the facts are hard to believe.

[joker_josue]

I'm just trying to understand all of this. Is it 100% or not, and if not - why make such a statement at all?
Also, can we now expect such involvement from you in similar cases in the future?

IMO, this type of thing is not something that should be kept a secret. Multi-accounting in contests, pools & tournaments is an inherently unfair practice that punishes honest participants.

Finally something we agree on. This is exactly why I want the CLS63 case explained to me.

I have somewhat limited access to the forum, at this moment, I can't present many details.

The situation is not limited to the same IP. It involves a more careful analysis of the logs.
There are connection details, patterns and other points, which helps to identify.

To help you understand better, take a look at this example I gave:
https://bitcointalk.org/index.php?topic=5592644.msg67104107#msg67104107

Then, when I have the opportunity, I can try to explain it better.

[el che]

Like I mentioned above, Opera VPN is not actually a true virtual network tunnel, but rather a proxy server.

Exactly!

Opera's VPN is a browser level proxy and it reportedly used to only handle IPv4 traffic. IPv6 traffic wasn't proxied at all, it just goes out directly through the real connection, leaking the user's actual ISP assigned address. As a cybersecurity professional, I can confirm this has been the case until recently. I ran some tests with Opera VPN using two separate devices on two separate networks (same city), connecting almost simultaneously to the same Opera server (Americas). Both devices ended up with the exact same /64 prefix but a different full /128.

Many casinos ban players for sharing the same /64 prefix, thinking it proves they're on the same network, but that's flawed reasoning, since two completely unrelated people using Opera VPN would also end up sharing that same /64 prefix. If the full /128 matches, though, that's a different story entirely, multi-accounting becomes almost certain. That's exactly why this needs clarifying by theymos.

So the "shared IPv6" in question probably wasn't a VPN exit address at all, it was the real address, unaffected by the VPN. Real IPv6 addresses aren't shared across strangers the way IPv4 is through CGNAT. People on the same household network usually share a /64 prefix, but not the exact same 128-bit address, unless something specific is going on (a static IPv6, a proxy on the router, etc).

So a full, identical IPv6 match is actually a stronger signal than an IPv4 match. It points to the same device, the same connection or some shared infrastructure, not a random VPN collision.

Before concluding anything, though, it's worth checking: is the "identical" address really a full /128 match, or just a shared /64 prefix being loosely described as "the same IP"? If it really is a full match outside a shared household setup, that's much harder to explain away as a fluke.

A response from theymos on this point would go a long way toward resolving this.

To be clear, I have no personal connection to OP or CLS63, I'm a member of the paid pools in gambling and all I care about is the integrity of our contests and fairness to the accused until proven guilty without a shadow of a doubt. That's the only reason I'm asking theymos for this key clarification.

[nutildah]

I found one case of the same prediction. I haven't checked thoroughly though, just the first few pages of results (I started with the newest ones).  

27 goals

27 goals

Well, that does count toward something. I started at the other end, looked through the first 5 pages, then skipped to the middle from 2022-2024, and stopped mid 2024. Thats like 25-30 pages.

Ultimately what it comes down to is whether or not you want to participate in contests with these accounts, knowing everything compiled in this thread.

I don't know enough about the IP stuff to comment on it, but I do know that if you drill down into any one particular area of evidence (timestamps, blockchain/social media connections, similar posting styles & subjects, or shared IP addresses), it is damning on its own (IMO). This is why I considered the case closed even before the IP revelations.

I feel any further attempt to explain the blockchain connections in detail wouldn't serve much value as everyone has already made up their mind one way or the other about that.

To whoever thinks the tags are unfair, there are 3 things you can do:

1) Convince me that the tags are wrong.
2) Exclude me from your trust list.

and if you actually trust them,

3) Leave a green trust as a counter.

I wouldn't recommend 3 unless you otherwise think they deserve a positive trust.

Just for clarity, are you not giving a signature ban to CLS63 on the basis that the posts made using that account were not substandard in quality but the ILuckyGuyI, jakdanyel and Distraction accounts were making substandard quality posts?

Yes, that's correct. He definitely put more time into that account than the others, although they all share several similarities.

[theymos]

Can you, with certainty, connect CLS63 with the other accounts?

It can never be certain. But in this case, I'd say that the IP-log picture alone makes me 80% confident that they're linked, and that's on top of the other stuff.

There are ways that two different people could share the same exact IPv6 address. They could use the same Tor exit node, the same web proxy, the same public WiFi, the same library computer, etc. That's why I didn't just find a matching IPv6, but manually looked through each full IP log (with geolocation data going back years), looking at the picture in its totality. It is important when identifying alts to approach it carefully and skillfully, because false positives are very common. For example, Pakistan is a very tricky region to identify alts in because it's common for tens of thousands of different people to get the same IPv4 address; so if you're identifying alts among Pakistani users, you have to know this and apply special care. (That's not to say that it's impossible to identify Pakistani alts: you just have to pay more attention to timing and shifts, rather than pure shared IPs.) The possibility of creating false initial impressions is why I generally like to only look at IP logs after there's already some sort of preexisting suspicion for a pair of users.

That said, it's not ever normal for unrelated users to repeatedly share the same 128-bit IPv6 address, even if it's not totally impossible for it to happen. CLS63 shared the exact same 128-bit IPv6 address with 7 users (in a sliding +/- 7-day window), often repeatedly. Most likely these are all alts, though I only posted the ones that I had very high confidence in. If I do the same check but matching on the /64, it'd be 270 users. Looking at all forum IP logs over the last 90 days, the specific /64s used by CLS63 have an average of 1.0247 distinct users per 128-bit IPv6: so it's not at all common for users on his networks to share complete IPv6 addresses.

Also, can we now expect such involvement from you in similar cases in the future?

I have historically published alt-check info in these sorts of investigations from time to time, and I'll continue to do so from time to time. Though like I mentioned above, IP evidence should ideally be used as a final step to confirm something that is already strongly suspected.

[Lucius]

If anyone else is wondering if there was any doubt in this case, then I can only conclude that he is not looking at the facts objectively, they are subjective due to their personal connection with the member in question. Activity patterns + blockchain data + IP logs clearly point to an alt farm. All of this cannot be one big coincidence, no matter how much some might want it to be.

[AakZaki]

If anyone else is wondering if there was any doubt in this case, then I can only conclude that he is not looking at the facts objectively, they are subjective due to their personal connection with the member in question. Activity patterns + blockchain data + IP logs clearly point to an alt farm.

I think in the part of your writing that I have thickened you are right, as I recently revealed on the altcointalk forum. When I revealed the cheat committed by the moderator of the altcointalk forum with evidence of the connection of data on the blockchain and patterns that are not just coincidence here, there are those who defend it with various defenses.

They are dismissing facts subjectively, as you mentioned, and I think because they have the same interests, they know each other and lick each other.

And maybe it is common to do even if it is included in this forum, for the sake of interests that are in line with the person who defends it.

[AB de Royse777]

The community never stops surprising us with its incredible moments.

[Don Pedro Dinero]

If anyone else is wondering if there was any doubt in this case, then I can only conclude that he is not looking at the facts objectively, they are subjective due to their personal connection with the member in question. Activity patterns + blockchain data + IP logs clearly point to an alt farm. All of this cannot be one big coincidence, no matter how much some might want it to be.

I said something along those lines when I red tagged him. Having him 8 prior green tags I wasn't going to add a red tag of mine if there wasn't clear, strong, evidence. And as I said back then, if, with all this evidence, you can't red tag him you won't be able to red tag anyone because a tiny doubt can always be cast. Even if someone on the forum admitted to having committed fraud, you might wonder if they made it up or if it's a joke—you can always cast a doubt. But in this case, the matching IP addresses, combined with the blockchain evidence and the writing patterns, constitute the strongest evidence I've seen in all cases here.

[el che]

...

That said, it's not ever normal for unrelated users to repeatedly share the same 128-bit IPv6 address, even if it's not totally impossible for it to happen. CLS63 shared the exact same 128-bit IPv6 address with 7 users (in a sliding +/- 7-day window), often repeatedly. Most likely these are all alts, though I only posted the ones that I had very high confidence in. If I do the same check but matching on the /64, it'd be 270 users. Looking at all forum IP logs over the last 90 days, the specific /64s used by CLS63 have an average of 1.0247 distinct users per 128-bit IPv6: so it's not at all common for users on his networks to share complete IPv6 addresses.

...

If anyone else is wondering if there was any doubt in this case, then I can only conclude that he is not looking at the facts objectively, they are subjective due to their personal connection with the member in question

...

Thanks to nutildah for bringing this matter to light and to theymos for sharing the data.
Digesting the fact that five years of competition may have been compromised by unfairness is frustrating enough, but allowing a proven cheater to continue participating in these contests completely lacks integrity and is unfair to every legitimate player, because who can possibly guarantee he won't do it again? and sweeping this under the rug destroys the integrity of the contests. I value this crew, but turning a blind eye out of personal loyalty isn't a standard I share.. and yes, cheaters do suck.

[cryptofrka]

Guys, how about we try to get to the bottom of this without it being the hyenas' feeding grounds?

Yes, cheaters suck. What also sucks? Users derailing the topic with nothing to add, posting just to gloat or lick asses.
You know who you are here, your contribution is zero so far. It will remain zero, because gloating is all you're good at.

Let's start from this:

Can you, with certainty, connect CLS63 with the other accounts?

It can never be certain. But in this case, I'd say that the IP-log picture alone makes me 80% confident that they're linked, and that's on top of the other stuff.

I'm disappointed that the divided opinion we had until theymos' announcement was shaped based on 80% certainty. That's way too low.
Then again, I guess thanks because theymos could have said it's 99% and I would have accepted it and removed my positive trust.

I see this as theymos taking a step back, not confirming the connection for sure.

I'm also curious as to why theymos with all his knowledge says it's 80% and then el che says it's actually 99.99%.
Which one is it? 80% is surely not enough, 99.99% surely is.

Yes, that's correct. He definitely put more time into that account than the others, although they all share several similarities.

I also see this as a positive step from nutildah. I think CLS63 is now the only user on the account farm list that is not sigbanned.

___________________________________________

Considering that I still do not know how to act here, I asked theymos privately to recheck the logins during the period I spent some time with CLS63.
These logs should hopefully prove whether he is a part of the farm or not.