Muddy Waters’ 30,000-word short-selling report on YY is fully exposed: dramatic plot, humorous and spicy style!

　　As one of the three most well-known short-selling firms in the United States, Muddy Waters released a report on social media, stating that after more than a year of research, they concluded that 90% of YY’s live broadcasting revenue was false, 80% of Bigo Live’s overseas revenue was fraudulent, 80% of online dating revenue was fraudulent, involving amounts of tens of billions of dollars.

　　With the release of the report, YY’s stock price plummeted by 26.48%, closing at $73.66, with a market value of $21.5 billion evaporating in a day.

　　On the afternoon of the 19th, YY Inc. responded by stating that Muddy Waters’ report was full of ignorance about the live broadcasting industry and ecosystem. The report was logically unclear, data was chaotic, and it was a case of generalizing from a particular instance, containing a large number of errors. YY Inc. also stated that they would provide further detailed responses in the future, the specific time depending on the progress.

　　To facilitate investors in understanding the detailed situation, Zhitong Caishang has compiled the full short-selling report as follows. The views in the text do not represent Zhitong Caishang’s views. The translator’s ability is limited, and readers are kindly requested to forgive any omissions.

　　According to the report, Muddy Waters spent a year not only utilizing a large amount of IT technology, financial, and legal analysis but also conducting secret research in many Chinese cities. They faced headliner influencers, live broadcast guild bosses, YY Inc. executives, and employees on the front line, painting a panoramic view of the live broadcasting industry in an era where traffic is king. It not only has the rigor of a short-selling report but also possesses a literary quality of dramatic ups and downs and humor with a touch of spice.

　　Intellectual property of the translator, please indicate the source for reprinting.

　　Huajun Group is shorted by Muddy Waters: A Live Streaming Empire Built on False Data

　　Huajun Group: You Can’t Make This Stuff Up, Well…Actually You Can

　　(YY: You Can’t Make This Stuff Up. Well…Actually You Can)

　　Over the past 10 years, we have been struggling in the global capital market, and absurd things have happened from time to time. However, when Baidu announced its intention to acquire YY Live from Huajun Group (YY.US), we had no psychological preparation for this surreal event. At this time, we were preparing to disclose the results of our one-year investigation into Huajun Group – about 90% of the data of YY Live’s business is forged.

　　From the very beginning, we were very clear that almost all the revenue of YY Live’s business was exaggerated. It was a mirage-like ecosystem. The anchors who were considered to have high income actually only received a small part of the reported salary. The so-called independent guilds were largely controlled by Huajun Group to carry out continuous false transactions. A large number of fans who gave gifts were almost all from the internal network of Huajun Group (accounting for about 50% of the total amount of gifts on YY Live) and robots from the external network of the company, as well as gifts exchanged among anchors. Our conclusion is that 90% of YY Live’s revenue is fictional, and the degree of fraud in Huajun Group’s international live-streaming business Bigo seems to be on par with YY Live.

　　The question is, what will Baidu do? Will Baidu really try to achieve growth by purchasing a business that is almost entirely fraudulent? This is a cash payment of 3.6 billion US dollars, equivalent to 7% of Baidu’s market value.

　　In April this year, Baidu’s Professional Ethics Committee issued a statement in response to the arrest of the former financial vice president of the group, part of which is as follows:

　　”Baidu will resolutely crack down on all violations and illegal acts, and has zero tolerance for any behavior that touches the red line of professional ethics. At any time and for anyone, we will never relax.”

　　Now, we want to say to Baidu: ‘You announced that you will pay cash equivalent to 7% of the company’s market value to acquire a company filled with fraudulent activities. During the due diligence process, such a large-scale fraud is hard to ignore. Do you claim to respect market ethics and the law? Let’s see.’

　　Summary

　　We shorted Huajun Group because we determined that YY Live is a multi-billion-dollar scam. Our conclusion is that the scale of Huajun Group’s business is only a small part of what it publicly discloses, and the user metrics, revenue, and cash balance that the company discloses are basically forged. Our conclusion applies not only to YY Live but also to Bigo, the international live-streaming business under Huajun Group.

　　About 84% of the consolidated revenue announced by Huajun Group is false. If we make more favorable or conservative assumptions about the company, the estimated percentage of false consolidated revenue is about 73%.

　　We have observed that Joyy Group mainly engages in fraud through three methods:

　　1. Paid user (PU) robots from Joyy Group’s internal servers. In our data sample, robots from Joyy Group’s internal servers were disguised as paid users, and the gifts related to them accounted for about half of the total value of all gifts.

　　2. Anchors return gifts to the system by changing paid user accounts. According to our understanding, those so-called top anchors with annual incomes of tens of millions of yuan actually often receive a fixed salary of no more than 2.5 million yuan (about 350,000 US dollars) per year.

　　3. The guilds managing the anchors are also part of this plan. The owners of the major guilds are mainly former employees of Joyy Group, who clearly ‘understand’ this scam. The financial statements of the five major guilds published by the China Credit Bureau (PRC credit bureau) show that the total revenue in 2018 was only 15% of what Joyy Group claimed.

　　Our conclusion is that YY Live, Bigo, and Joyy Group’s online dating business are essentially fake.

　　About 90% of YY Live’s live streaming revenue is fictional. Live streaming revenue accounted for 95.8% of YY Live’s revenue in the third quarter of 2020.

　　About 80% of YY Live’s online dating revenue is fictional. Online dating accounts for about 20% of YY Live’s revenue.

　　We estimate that 80% of Bigo’s revenue is fictional. Even with more favorable assumptions for the company, about 60% of the revenue is fake.

　　Bigo’s Singapore parent company changed auditors three times in the first four years. Bigo also received three consecutive going concern opinions from auditors from 2016 to 2018. A few months after the acquisition by Joyy Group, Bigo restated its 2017 financial statements significantly in August 2019. These facts support our conclusion that Bigo also essentially engages in fraud.

　　Bigo has had corruption issues from the very beginning. Joyy Group claimed to have acquired Bigo from Chairman Li Xueling, which was itself a scam. Through the transaction, Chairman Li at least obtained 156.1 million US dollars from Joyy Group shareholders, and Joyy Group also overstated its revaluation profit. In fact, the founder of Bigo is Joyy Group, not Li Xueling.

　　Bigo has integrated a large amount of revenue from mainland China. According to our preliminary investigation and interviews with former Bigo employees, we believe that Bigo’s business in mainland China, Hello, is almost entirely fake. We estimate that as of the third quarter of 2020, this highly fraudulent Chinese business division still accounted for 13.4% of Bigo’s announced revenue.

　　We have conducted more than a year of research on YY’s business and adopted a two-pronged approach. The first method is to collect and analyze macro data from 115.6 million transactions through automated means. The second method is the traditional ‘muddy waters’ technique, including reviewing documents and accounts, conducting secret on-site investigations and interviews with employees.

　　A careful study of various anchors who are said to have high income can show the severity of fraud at the micro level:

　　The popular music group ‘Modern Brothers’, who achieved great success in the pop music field, held a free concert in a popular shopping area, but the ‘fans’ of the anchors had to pay to attend. Modern Brothers now perform less on YY live, but they still receive gifts through the platform when they are off-air. Many of these gifts come from YY servers. The analysis of the data of 96 randomly selected donors found that about 97.9% of the sampled gift income may be false.

　　A random sample of YY paying users during the public health event lockdown showed that about 87.5% of the gift income may be fraudulent. Most of the fake paying users can connect to the mobile device ID (IMEIs) of YY servers, and a considerable number of IP addresses shown by the paying users in Wuhan mysteriously jumped from one city to another during the lockdown.

　　The big anchor ‘Mr. Li’ (also known as ‘Old Li’) is a scam. ‘Mr. Li’ was the YY live anchor who received the most gifts in 2019. However, our data shows that in the December event, Mr. Li’s mobile device was shared with the fan who donated the most to him, who sent 7 million RMB in gifts, accounting for about 40% of the total. In addition, the gifts sent from the devices related to him were more than the gifts Mr. Li received, exposing a related account network, which recycles gifts and raises the total income of YY.

　　It is said that the Bigo anchor RCTíKhan can receive $50,000 in gifts every month, and he only needs to sit in front of his desk and do paperwork. His live broadcast does not have that much appeal because the camera is often aimed at the wall or ceiling. Until recently, he admitted that the second largest donor was himself. (His other top donors are almost certainly members of a gift recycling network.)

　　We list the survey results of the investigation of the other four high-income anchors, the top four donors, and a large number of interviews with senior members of the YY ecosystem, which support our conclusion that the gift income of YY live and Bigo is basically false;

　　Table of contents;

　　Our data analysis and sampling show that 90% of YY live’s income is false;

　　Data collection and analysis methods;

　　In December 2019, about half of the gift income was generated by paying users under the欢聚集团;

　　The fake users in the internal network and the fake users on YY servers were exposed due to a failure;

　　The ‘Official Little Angel’ event launched by YY live shows that only 1/3 of the fake users were discovered through IMEI sharing;

　　The sample of Wuhan paying users indicates that the proportion of users controlled by YY is about 87.5%;

　　The financial statements of the top 5 YY live broadcast channel anchors show an income gap of 85.9%, confirming our estimate that about 90% of YY live’s income is false;

　　Refunds and fraud are prevalent on YY live streaming;

　　Case study: Modern Brothers built a modern fraud scheme;

　　Case study: Li Sheng, a well-known YY anchor, had fake income of tens of millions of yuan;

　　Case study: Xiao Zhou, the best anchor of YY from October 2019 to January 2020, also showed similar phenomena;

　　Case study: Rui Tiantian, ranked second, is also the same;

　　Case study: Famous anchor Shen Man could still receive small gifts regularly during her suspension;

　　Case study: Cui Aza received 60 million in gifts every year, but the guild said she only got a small part according to the contract;

　　Case study: Anchor Liu Yishou publicly laughed at YY as a ‘money scam’ platform;

　　Take a guild as an example to show how a guild colludes with YY to achieve the plan of increased revenue;

　　YY should upgrade its fraud technology: some mistakes exposed itself in the gift fraud;

　　Case study: ‘Killing time’;

　　Case study: Xiao Mian or the brave Doraemon who lost his cat;

　　Case study: Live room intern field control Guolizi;

　　Case study: ‘Aoli ge’ or ‘nono ke’;

　　Joyy’s ‘robot’ farm: There are more than 1100 paying users on the same IP address block;

　　YY’s social networking channels are not the secret money tree of the rest of its revenue;

　　Joyy Group’s financial data in China is abnormal, indicating the existence of cash fraud and fraudulent behavior;

　　About 80% of Bigo’s revenue is forged;

　　Case study: RCT_KHAN, the top consumer user of Bigo, is one of the best deceivers;

　　Even under Hummer’s optimistic estimate, Bigo also has 59.1% of its revenue fake;

　　The acquisition of Bigo was a multi-year, multi-level scam benefiting insiders of the Joyy Group;

　　Former senior executives confirmed: most user data are fake;

　　Live streaming刷量, anchors reciprocating gifts;

　　Bigo’s revenue in China’s region also exists with fraud.

　　Appendix A: Definitions related to the analysis;

　　Appendix B: Description of data and data sources;

　　Appendix C: Internal network usage.

　　Our data analysis and sampling show that 90% of YY live streaming’s income is fake.

　　We analyzed and sampled YY’s user data and gift income with three methods to estimate the proportion of paying users and their related income in YY live streaming. Through the above three methods, we concluded that nearly 90% of YY live streaming’s gift income is fake.

　　The first method is to analyze the nearly 10,000 paying users (PU) tracked by Xiaohulu (XHL). We found that nearly half of the gifts, in terms of value, come from fake users related to YY. We selected a core group of paying users from the dataset containing YY’s IP addresses and tracked the shared IMEI users radiating from this group.

　　However, through detailed surveys of paying users, we also found that most of the remaining half of YY’s gift income is also fake. Another method of identifying fake users is to randomly select 96 paying users from Wuhan during the Chinese public health event lockdown. The results show that 87.5% of these Wuhan paying users are obvious fake users.

　　The third method, we extracted 96 live paying users of Modern Brothers, and the results show that about 97.9% of them are false users.

　　We compared the income reported by the leading guilds to the China Administration for Market Regulation (SAMR) with the income reported by the Huajù Group. We found that the top five guilds’ income claimed by the Huajù Group differs by 85.9% from the income in the credit reports.

　　Data collection and analysis methods

　　The data analysis and collection methods consist of two components. Through Google Chrome web development tools, we can track 88 data points for each transaction, including the name of the paying user, the YY ID of the paying user, transaction time, gift name, gift unit price, gift ID, gift quantity, recipient’s name and YY ID, paying user IP address, and device IMEI. The data of IMEIs shows that about half of the gift income of YY Live comes from YY’s own servers. The device IMEIs also show how common it is to exchange gifts on YY Live. We used a third-party data analysis service owned by an insider of the Huajù Group, Xiaohulu, to track the number of gifts sent and received by each account. (The founder and owner of Xiaohulu were also one of the founders of YY and are currently shareholders of two key variable interest entities.) For Bigo, we developed custom code to utilize mobile applications and collect data from the top anchors and their top 50 paying users.

　　Starting from October 2019, we have used Google Chrome development tools to collect data from YY Liveonline casino tutorialClick to enter. From November 27, 2019, to February 4, 2020, we expanded the scope of data monitoring and collected over 115.6 million gift transaction data sent by 1.2 million paying users to 20,715 anchors. In the following months, our researchers mined this vast database to check the relationship between anchors and paying users, speculate on their transaction patterns, and check the details of irregular transactions (i.e., robot searches during the 2020 public health event lockdown).

　　We have checked the gift income and details of over 180,000 YY paying users and more than 120,000 anchors, and established contact with their respective guilds through the Xiaohulu database. Our estimate of false income is also based on Xiaohulu’s data. We believe that Xiaohulu’s data is consistent with YY’s internal accounts for two reasons. First, Cao Jin, the founder of Xiaohulu, is one of the founders of the Huajù Group, was a major executive of the Huajù Group, and is currently a shareholder of two VIEs (Guangzhou Huaduo Network Technology Co., Ltd. and Beijing Tudu Technology Co., Ltd.) under the Huajù Group, and is also the legal representative of the third VIE, Guangzhou Duowan Information Technology Co., Ltd. Second, the former subsidiary of the Huajù Group, Huya, once used Xiaohulu data as evidence in a lawsuit in a Chinese court, indicating that the data monitoring platform has authority, independence, and reliability.

　　The macro data sources used for the analysis of Bigo come from live traffic room monitoring and data collection tools, as well as third-party application analysis databases.

　　In December 2019, paying users under the YY Group accounted for about half of the gift income.

　　In December 2019, we reviewed the data of 96.432 million YY live paying users tracked by Xiaohulu. Our analysis found that 24.9% of the paying users were controlled by YY. We further found that in our sample, these users’ donations accounted for 48.0% of the total gift income.

　　We obtained information about paying users from Xiaohulu, including 96,400 paying users, who have donated a total of 68.65 billion RMB. A total of 24,051 paying users meet at least one of the above definitions, accounting for 24.9%. These users have donated 3.30 billion RMB, accounting for 48% of the total gift amount.

　　There are 1382 paying users showing two behavior characteristics controlled by YY (internal network paying users and YY server paying users). Among them, the gift information data of 300 paying users on Xiaohulu indicates that they have sent out 175 million RMB in gifts, accounting for 2.5% of all gifts in the Xiaohulu dataset. Although this group is small in absolute terms, it led us to find two larger groups, which share IMEI with these users and have a close connection with YY.

　　The fake users of the internal network and the YY server were exposed due to a fault.

　　Internal network fake users are paying users who display internal network IP addresses of YY Group (100.64.0.0~100.64.0.10). On the other hand, YY server fake users are paying users who display the IP address of the local host server (127.0.0.1).

　　The IP addresses displayed by these fake users can only come from within YY. However, these internal IP addresses are usually concealed by ordinary IPs. Fake users rarely reveal these IPs: we suspect that YY Group usually uses VPN or other software to conceal transactions from within YY. Due to our continuous monitoring of paying users during the observation period, we discovered these issues. More details will be disclosed in the later chapters of this article.

　　There are 20,399 paying users who share IMEIs with the fake users in the aforementioned YY department network and YY server. Among them, 10,606 paying users’ little gourd gift data recorded gifts totaling 91.1 million yuan, equivalent to 13.3% of the total amount of gifts in the little gourd dataset. We believe that some of the paying users are also anchors, and we classify their guilds as controlled by YY.

　　Additionally, after data deduplication processing, 30,323 paying users with unique IDs shared IMEIs with anchors under YY-controlled channels. This includes 13,145 paying users with little gourd gift data. These 13,145 (13.6%) users sent gifts totaling 2.212 billion yuan, equivalent to 32.2% of all gifts in the little gourd dataset. We believe these are also fake users.

　　In summary of the total amount of gifts from the fake users, we found that 48.0% of the live gift income is fraudulent based solely on IMEI sharing. Through other research methods, we also found that almost all of the remaining half of the live gifts are also fake. We associated two paying user samples, and the results show that the vast majority of paying users are robots. YY has signs of controlling fake users for fraudulent gift transactions.

　　In the following table, we show the paying users and their total gift amounts by category. We start with fake users from YY servers and internal YY network, gradually expanding outward, including a total of 24,051 users (accounting for 24.9% of the total), who sent gifts totaling 328.8 million yuan (accounting for 48.0% of the total).

　　Although we have determined that a quarter of the paying users are related to YY, this does not mean that the remaining three quarters of the paying users and half of the gifts are real. On the contrary, as we will show below, most of the remaining paying users have different connections with YY, which means they may also be fake users.

　　The ‘Official Little Angel’ activity launched by YY Live shows that only 1/3 of the fake users were discovered through IMEI sharing

　　During the National Day holiday in October 2020, YY launched a new promotional activity named ‘Official Little Angel’. New anchors will receive gifts sent by YY-controlled paying users, known as ‘angels’, as a reward for live broadcasts.

　　The sample of Wuhan paying users indicates that the proportion of users controlled by YY is about 87.5%

　　We conducted an investigation on Wuhan’s YY users to determine whether they are robots. Due to objective factors, Wuhan was not open to the outside world for a period of time, during which non-robot users were almost impossible to move locations. We searched our database for Wuhan IP address users who actively gifted during the封锁 period. Random sampling of these active Wuhan paying users showed that approximately 87.5% of the users were fake.

　　Wuhan’s paying users must meet the following fraud and controlled characteristics to be identified as fake users and controlled by YY:

　　1. Share IMEI with devices connected to fake users within YY’s internal network

　　2. IP jumps from one geographical location to another abnormally

　　3. Use IP addresses from large IP ranges that send gifts to controlled channel anchors (such as, from robot ‘farming farms’)

　　4. Send most of the gifts to anchors of YY-controlled channels

　　5. Show other characteristics of fraud or compulsion

　　The financial statements of the top 5 YY live streaming channel anchors show an income gap of 85.9%, confirming our estimate that about 90% of YY live streaming income is false

　　YY claimed that the income of its top guilds in 2018 was 1.1 billion yuan, and we collected the local credit reports of these guilds, which showed that the total income of these guilds was only 1.563 billion yuan, a difference of 85.9%.

　　YY stated that the top five guilds in 2018 were娱+, 话社, 舞帝, 中国蓝, and IR, and claimed that the five guilds’ income in 2018 exceeded 1.1 billion yuan. The following is a screenshot of a video on the YY website, which claims that ‘In 2018, YY’s top five guilds earned more than 1.1 billion yuan.’

　　However, the Chinese credit reports we collected for these five guilds show that their total income in 2018 was only 1.563 billion yuan, which is 85.9% less than what YY claimed. We are confident that according to our review of Chinese legal disputes, anchors are paid by the guilds, and based on our interviews with the main responsible persons of the major guilds, we believe that the income figures in the credit report are the total payment to the anchors. In the following table, we compare YY’s income at the General Administration of Market Supervision and Administration with the income YY claimed:

　　In the fourth quarter of 2019, the income of these five guilds accounted for about 28.0% of YY live streaming income. According to the data from Xiao Hulü, these five guilds are still in the top five of the income ranking, and the income of these guilds in the fourth quarter of 2019 accounted for the percentage of YY live streaming as shown in the following table.

　　We believe that the 156.3 million yuan income in the report of the General Administration of Market Supervision and Administration is 85.9% less than the 11 billion yuan claimed by YY, suggesting the existence of large-scale false income increase behavior. This method also leads to our conclusion that only 10% of YY’s income is real.

　　Rebates and fraud are prevalent on YY live streaming

　　When we introduced the following data in detail, we also found that the majority of gift income from the top three YY anchors comes from themselves and robots controlled by YY. Another well-known anchor still receives gifts continuously even when not live, which is almost identical to the robot activities we saw on the channel of Moden Brothers (to be discussed below). Moreover, the four top ranking paying users we will study also show multiple signature evidence of robot behavior, such as IP addresses related to YY switching between different regions. These findings all support our estimate that about 90% of YY live streaming income is false.

　　Case analysis: The modern brothers have created the modern fraud

　　We found that the so-called very popular anchors of the modern brothers are actually not like that. For example, the fans who watched their performance were actually paid to be there by YY. More absurdly, the paying users who continuously made donations on their channel were actually initiated by robots related to YY.

　　’Could it be that I have been bewitched by ghosts?’ sang Liu Yuning, the lead singer of the modern brothers. This was part of his live performance of ‘Be Honest’ in Dandong. On the streets lined with shops, passersby stopped to listen to his singing.

　　The modern brothers performed on the streets of Dandong, and one bulletin wrote ‘Now fans 2000w+’

　　However, despite all the publicity, we still learned from a YY club located in Dandong that these fans were actually people who were paid by YY to watch this street performance for free. At least Milli Vanilli has real fans.

　　In fact, the real reason for the popularity of the modern brothers is that they continue to receive donations from robots. We found that YY created robots in 58 countries and regions to make donations to the modern brothers’ platform. Among the 32,398 paying users who made donations to the channel in January 2020, these robots may account for most of them: for this, we found that almost all the so-called paying users in our sample were actually fake users.

　　We found that 97.9% ± 10% of the paying users sampled by the modern brothers may be fake users. In order to investigate the activity level of the robots, we randomly sampled 96 paying users who made donations during the modern brothers’ broadcast on January 30, 2020, and studied their behavior patterns. We chose this group as a sample because we believe that any paying user is most likely to be real when making donations during the broadcast. In addition, the reason we chose the modern brothers is that they have a unique position in the YY live ecosystem because the channel manager is YY. Therefore, there is almost no fraud force with interests in the third party.

　　In a month when the modern brothers ranked high among the modern brothers, they were ranked 97th on YY and earned 2.9 million in gift income. However, this seems to be the ranking achieved by YY hiring fake paying users. From July 2020 to September 2020, the data from Xiaohulu and the YY app showed that robots seemed to be running their fixed patterns all the time. For example, on July 22 and 23, 2020, although the modern brothers did not broadcast, they received 2,631 yuan from 15,286 paying users and 4,007 yuan from 22,427 paying users respectively.

　　On July 23, 2020, Moden Brothers did not broadcast, but the tips kept coming.

　　Although the normal broadcasting time of Moden Brothers is from 7 to 10 PM, according to the purple line in the gift transaction records counted by Xiaohulu, fake users continuously tipped small gifts around the clock, indicating that the robots were still working. The figure below shows the data counted by Xiaohulu on July 22, 2020, and on that day, Moden Brothers did not broadcast.

　　Case Study: Income Fraud of Famous YY Anchor Mr. Li

　　We found that almost all the tips received by the famous YY anchor Mr. Li came from devices related to YY or himself. By analyzing the transaction data of the anchor’s channel, we found that in September 2019, 8 device IDs associated with Mr. Li contributed over 80% of the income. These devices were not only associated with YY’s controlled fake paying users but also the total amount paid by these users to the anchor was far higher than Mr. Li’s income, which showed the income inflation plan behind YY. In the next three well-known anchors introduced, we found that YY used the same model, that is, most of the fake users controlled by YY shared the same IMEI code.

　　Mr. Li (in the photo below) was once a security guard and later became famous through YY live.

　　Left: Mr. Li broadcasting in 2018. Right: Mr. Li wins an award at the 2019 YY Annual Grand Ceremony and expresses gratitude to the fan Ping Sheng who helped him win the competition.

　　Mr. Li performs different programs on YY live every day, jokes with other anchors and fans. This anchor, born in Hebei, claims to have a fan team of 8.4 million, with hundreds of thousands of clicks on each video. As the third-largest anchor on the YY platform, Mr. Li receives tens of millions in tips every year. In December 2019 alone, the top tipping fan, Ping Sheng, gave Mr. Li 28 million RMB, which accounted for 40% of the gifts received by Mr. Li that month. For an ordinary person from Hebei, this is already a considerable amount.

　　However, our investigation shows that several users share the same IMEI code with Mr. Li. In addition, we also found that 14 other paying users’ IMEI codes are associated with Mr. Li, including the top 8 users who tipped the most. In the past four months, the tipping amount of these 8 users far exceeded the amount received by Mr. Li.

　　On the whole, according to the statistics of Xiaohulu, we believe that more than 85% of the 18.2 million RMB won by Mr. Li in the annual competition comes from fake users controlled by YY. Our analysis shows that among the deep data captured by Xiaohulu, 13.7 million RMB worth of gifts were contributed by YY’s fake users, accounting for 96% of the total. We believe that during the period when Mr. Li stopped broadcasting in December 2019, the majority of the paying users who continuously contributed tips were robot fake users.

　　Above: During the period when Mr. Li stopped broadcasting on September 19, 2020, he still received gifts continuously, especially in the early morning (Beijing time from midnight to 6:35)

　　To us, Mr. Li is more like a big lie.

　　We find that in YY’s ecosystem, this false gifting and false increase in income are common phenomena, which also confirms our findings: 90% of YY live broadcast income is false. In the following, we will list the fraud phenomena of various anchors in YY live broadcast.

　　The biggest lie is the accounts controlled by each other.

　　Through the network of Mr. Li’s associated accounts, we found that the gifts Mr. Li received were even more than he got. We identified a group of 15 paying users with shared IMEI connections, among which Mr. Li and another anchor were directly linked to the top 1st, 24th, and 48th paying users on YY. Additionally, the IMEI network Mr. Li shared was also indirectly connected to YY network paying users and paying users on YY servers.

　　The top three Mr. Li and other 12 paying users share IMEI codes, including the top 8 users in terms of gifts

　　From October 2019 to January 2020, the paying users sharing IMEIs with Mr. Li sent gifts totaling 38.4 million RMB to Mr. Li and other anchors. During this period, Mr. Li received gifts totaling 26.9 million RMB, while another anchor sharing the same IMEI code with Mr. Li received 150,000 RMB, with a total income of 27.1 million RMB. After deducting the 50% commission that YY platform should charge, these anchors’ income was 13.5 million RMB. However, during the same period, these accounts related to Mr. Li spent 38.4 million RMB on gifts. This means that although YY seems to have earned 13.5 million RMB from these transactions, the accounts related to Mr. Li resulted in a cash outflow of 24.9 million RMB. Therefore, we believe that YY is helping Mr. Li sustain the popularity of himself and other anchors, as well as YY’s income, by spending far more than its income:

　　IMEI accounts related to the gifts given to Mr. Li exceeding his YY income

　　We find that although these top-ranked paying users and well-known anchors appear to be different entities, they often connect with each other through a vague shared IMEI network. If they were an independent organization, giving gifts to themselves and others, it seems that this could not be sustained for long. However, we do not believe this is the case. Because evidence such as shared IMEIs, paying users connected to the YY server, and fake users within YY indicates that Mr. Li and his associated paying users are operating under the guidance and control of YY, and Mr. Li is one of the anchors we have found to have this fraud phenomenon among many well-known anchors.

　　Case study: In October 2019 to January 2020, the best anchor Xiaozhou of YY also showed a similar phenomenon

　　Like Mr. Li, the number one Xiaozhou also received a large number of donations from associated IMEI users. These users are associated with YY’s controlled paying users, and the associated accounts donated more than Xiaozhou received, indicating that YY directly brought about the inflation of income.

　　Throughout our data collection period, Xiaozhou has been in the first place on YY Live. From October 2019 to January 2020, the data from Xiaohulu showed that Xiaozhou’s donation income was 34.4 million RMB, higher than other channels. After deducting the commission, this amount was 17.2 million RMB.

　　However, we found Xiaozhou’s secret: the IMEI codes associated with his account are also related to the top 2, 8, 35, 146, and 592 paying users on the YY platform.

　　After summarizing these associated accounts, Xiaozhou received gifts totaling 25.7 million RMB in the same period. The final result is that the group associated with Xiaozhou did not benefit from YY’s gifts, but paid a net of 8.5 million RMB, while YY’s income was 17.2 million RMB.

　　Case study: Ruitian Tian, ranked second, is also like this

　　The famous anchor Ruitian Tian also showed the phenomenon of cyclic gift-giving under YY’s control, like Mr. Li and Xiaozhou. In YY’s income inflation plan, the value of gifts paid by her associated users far exceeded the income of this group.

　　From October 2019 to January 2020, our channel monitoring showed that Ruitian Tian’s net income from gifts was 34.1 million RMB. Among them, Ruitian Tian shared 6 IMEI codes with 15 top-paying users, including the fourth-ranked ‘Yang’ and the seventh-ranked ‘Haha Laugher’ among YY’s paying users.

　　The group of paying users sharing IMEI with the famous anchor Ruitian Tian, including the major contributor ‘Yang’

　　The total net cash outflow of this group is 12 million RMB. However, YY still earned 17.1 million RMB from the donations received by Ruitian Tian, as shown in the following figure.

　　In addition, YY tries to maintain the illusion of independence between famous anchors and top-paying users. Previously, an internal news report from YY told a story about Ruitian Tian’s victory in a duel with another anchor with the help of her top contributor, Yang. Strangely, in this fierce competition, Ruitian Tian suddenly left her seat, and then her loyal contributor Yang suddenly gave her the most expensive virtual gift, helping her win. But in fact, this was not a miracle: the shared IMEI code between Yang and Ruitian Tian indicates that Yang merely inflated the income of Ruitian Tian and tens of millions of YY’s income.

　　The three well-known anchors discussed above—Mr. Li, Xiaozhou, and Ruitian Tian, share the IMEI code with 19,391 paying users on the ‘Xiao Mian’ YY server. In December 2019, the total net cash outflow of this large group reached 106 million RMB.

　　The connection between these anchors and paying users further proves our guess that YY fabricates about 90% of the gift income. As we will detail below, YY completed this move within its paying user network and maintained close contact with guilds.

　　Case study: Well-known anchor Shen Man still receives regular small appreciation during the suspension period

　　YY live’s champion in 2017, Shen Man, even during nearly a month’s suspension of broadcasting, received a large number of gifts from paying users and small amounts of appreciation.

　　In late July 2020, the data of Shen Man’s live room showed that her last live was 29 days ago. According to the gift records of Xiaohulu and YY’s own platform, during the week when she did not broadcast, Shen Man received 9958 RMB in gifts. In view of the large amount of evidence of income inflation we found, we believe that this gift-giving model is more like a phenomenon of fraud.

　　According to the data of Shen Man about the statistics of Xiaohulu, in the 30 days before July 23, she did not live on 28 days. However, during the same period, 10,452 paying users all sent gifts worth less than 10 RMB. The purple ID that appeared from June 25 indicated that the gift-giving trend during the break was continuous and regular, suggesting that bots were responsible for brushing low-priced gifts.

　　Such bots seem to be a necessary condition for anchors to succeed on YY.

　　Case study: Cui Aza receives 60 million in gifts annually, but the guild says she only gets a small part according to the contract

　　We found that the actual income of anchors is much lower than the expected income from the gifts they receive. This is because the gift amount is not real. We found that the top 11 guilds were created by former YY employees or split from such guilds. The interconnectedness of YY guilds makes it easier for YY to fabricate income. A top anchor once hinted that his channel had bots刷礼物, but we found that he actually also received a large number of gifts from bots. We also tracked the gift records of the top 4 paying users and found that they were all bots, fake paying users, because their IPs either showed from YY’s internal network or displayed mysterious location switches, or both.

　　Last winter, our investigators went to a commercial plaza in Dandong (Dandong is a port city located at the mouth of the Yalu River, facing North Korea across the river). The investigators took the elevator to the middle floor of a skyscraper and met a YY guild boss in a medium-sized office. The boss was about 35 years old and looked very casual. He wore a Polo shirt and jeans, joyfully discussing how guild bosses make money for anchors.

　　He mentioned the anchor Cui Aza (she is the 16th ranked YY anchor among the four months we monitored), emphasizing that she receives 60 million RMB in gifts every year, and also said that she actually earns a much lower salary.

　　’Cui Aza looks very glamorous,’ he said. ‘Guess how much she earns every month?’

　　He didn’t even wait for our investigator to answer, but hurriedly continued to say: ‘The contract we signed with her is that she can only get a salary of 150,000 to 200,000 yuan per month in the next two years. The rest is the company’s.’

　　According to what he said, that is to say, Cui Aza is willing to take a salary of about 300,000 US dollars a year, which is only 4% of the total amount of gifts she received. If this is true (based on our other investigations, we believe it is true), it fully demonstrates that the water content of YY’s income is very high. From Cui Aza’s example, it seems that she should have received about 15 million yuan in gift income distribution per year, because guilds generally give anchors 20-30% of the virtual gift income. However, the amount of money she actually receives is much less, indicating that the amount of gifts she received may be exaggerated by more than six times.

　　Other anchors have also discussed that the total amount of gifts on YY has water, claiming that this ecosystem has a nature of fraud, but in fact, they themselves have also received many gifts sent by robots.

　　Case Study: Anchor Liu Yishou publicly jokes that YY is a ‘cheating money’ platform

　　Our analysis found that there are a large number of robots sending gifts in Liu Yishou’s channel, with a group of users from the same IP address block sending gifts to several anchors, including Liu Yishou. We found that these robots are controlled by YY because these anchors all received gifts from these users with roughly the same amount, but the specific gift amount may vary from anchor to anchor.

　　Liu Yishou is a star anchor on YY, who once joked that the YY platform is ‘cheating money’. He once jumped to the competitor platform of YY, Kuaishou, to earn more money, and was forced to return to YY platform due to losing a lawsuit against YY, and even topped the Weibo headlines because of this. YY also celebrated his return, and he became the most profitable anchor on YY again. There were reports about a live broadcast content after his return, with the title being ‘Liu Yishou tells that he might have disappeared if he didn’t return to YY, this return is to ‘cheat money’.’

　　Liu Yishou live broadcast

　　At the end of the live broadcast, Liu Yishou gave a warning to his fans and aspiring small anchors:

　　Liu Yishou said that YY is a place that requires money to play, and he also came back this time to ‘cheat money’. However, he also called on those who are working to send him gifts, but those who have sent 5000 should not send more to themselves.

　　As we will show below, it is not surprising that we found that the robots controlled by YY were sending fake gifts to Liu Yishou.

　　Liu Yishou received a string of gifts when he was offline

　　We tracked 100 IP addresses that rewarded Liu Yishou’s live broadcast room, which belong to 38 different IP address blocks. From November 20, 2019, to February 4, 2020, we expanded the monitoring scope and collected gift data from 26 IPs in this IP address block. In this IP address block, we identified 14,503 paying users who repeatedly sent gifts to 35 anchors. These 35 anchors come from 16 different guilds, among whom 11 are in the top 100 in terms of gift amount.

　　The diversity of anchors receiving gift boosts clearly confirms that the gift boosting syndicate is not operated by a single guild or a small group of guilds, but is manipulated by YY itself. As shown in the figure below, the three IPs in this IP block send almost the same number of gifts to the same anchor, including Liu Yishou, Xiao Beijing, and Picasso. This is conclusive evidence of robotic programmed gift boosting:

　　The gift amounts sent to the same anchor by adjacent IP addresses are almost the same, indicating that these paying users are robot fake users

　　Take a guild as an example to show how a guild colludes with YY to implement the plan to increase income by exaggeration

　　Our investigators learned that YY was able to achieve income fraud because most top guilds were either founded by YY openly or secretly, or were heavily dependent on YY.

　　Our investigators drove to a residential area in Guangzhou to visit several houses, which were the low-key office of a large YY guild. The guild was founded by a former YY employee (also a pioneer of YY’s live broadcast guild system), and its predecessor was the “1980s” guild, which once managed thousands of anchors and dominated YY live broadcasting.

　　A senior human resources manager of the guild explained: “Our number of anchors accounts for 70% of the total number of anchors, and everyone knows that the famous anchors on the YY platform are from our company.”

　　It seems strange that so many anchors are concentrated in one guild, because the distribution range of YY anchors should be very wide. However, an employee of a branch of the guild explained, “The 1980s” was founded with the help of Ms. Wang Xiangqi, Assistant to the Chairman Li Xue ling. Coincidentally, Wang later went to Singapore and participated in the founding of Bigo.

　　”That’s the way it is,” he told our investigators. “Frankly… because of Mr. Li (Chairman Li Xue ling)’s strong support for our company, our three guilds were provided by Mr. Li for free. We didn’t spend a cent (to buy the guilds).”

　　We believe that this aid conceals the fact that the income of anchors, guilds, and YY itself in legal sales is far lower than the amount of continuous gifts. In fact, the close relationship between YY and its guilds makes it easier to exaggerate income.

　　The triangular relationship between YY, guilds, and anchors is dominated by YY. The top 11 guilds on YY were created by YY itself, while large guilds jointly created smaller guilds with anchors, effectively building a branch network led by YY. Through its close relationship with guilds, YY created an illusion of a third-party relationship, while also allowing the company to control a ‘Potemkin’ ecosystem composed of fake users and exaggerated income. Before 2016, anchors were employed by YY’s parent company, Happy Valley Media, and directly signed contracts with them. However, starting from 2016, new anchors signed contracts with guilds.

　　过去4年里，YY公会建立了新的公会，并收购了其他公会的部分或全部股权。根据工商总局的信息和我们对给公会刷礼物较多的付费用户的打赏情况的分析，我们可以发现，排名前11的公会控制着许多小公会。小葫芦数据显示，2019年第四季度，前11大公会的礼物收入占YY礼物收入的44.1%。

　　In the past 4 years, YY guilds have established new guilds and acquired part or all of the equity of other guilds. According to the information from the Administration for Market Regulation and our analysis of the rewards given by the paying users who sent gifts to the guilds more frequently, we can find that the top 11 guilds control many small guilds. According to the data from Xiao Hu Lu, in the fourth quarter of 2019, the gift income of the top 11 guilds accounted for 44.1% of the total YY gift income.

　　The top 11 guilds and their share in the total YY gift income

　　YY needs to upgrade its fraud technology: some mistakes exposed their own fraud in gift刷ing

　　When paying users expose the internal IP address of欢聚 in the website logs, we found their relationship with YY. These users either connect to the欢聚 local host server IP (127.0.0.1) or connect to YY’s local network (100.64.0.0/.10). These users are referred to as YY internal network paying users because they cannot be associated with these IPs unless they work within the YY servers. These paying users, including both humans and robots, systematically increased the gift income of various anchors under different guilds, indicating widespread income fraud in the YY ecosystem.

　　Case analysis: ‘kill time’ (user nickname)

　　During our four-month monitoring period, ‘kill time’ was the 4th ranked paying user, with a gift amount of 9.7 million RMB. He also led two top YY guilds – Lan Yu and Qi Ling for over 8 years, and is currently the owner of Qi Ling. ‘kill time’ is a well-known and highly ranked paying user on YY, and he also has a global influence in the YY ecosystem. We found that his account showed the activity level of a robot.

　　In the gifts sent by ‘kill time’, the local host IP 127.0.0.1 suddenly appeared, which we believe was an accidental leak, possibly due to a temporary failure of the software used to cover the real source of the user. We collected 8908 gifts sent by ‘kill time’; among them, 50 records in our sample set recorded the IP address 127.0.0.1.

　　Gifts sent under the ‘kill time’ during the period from November 20, 2019, to February 4, 2020

　　Gifts sent under the ‘kill time’ during the period from November 20, 2019, to February 4, 2020

　　Case analysis: ‘Xiao Mian’ or ‘Daxiong’ who lost the Cat Robot’ (user nickname, hereinafter referred to as ‘Xiao Mian’)

　　During our monitoring period, ‘Xiao Mian’ was the 91st ranked paying user, a member of a robot network. The geographical IP of ‘Xiao Mian’ could switch rapidly between Chile and China, which would be nearly impossible for a real person to do in such a short time between the two countries, and it also exposed the local host IP address 127.0.0.1 of the欢聚 local host.

　　We found that 19,391 paid user IDs are associated with ‘Xiaomian’ through various shared IMEIs. In other words, although a viewer might see 19,392 individual users, our collected data shows that all these paid users are actually bound to the same program running the ‘Xiaomian’ account, which are false users. These IMEIs include the top three YY anchors: Mr. Li, Xiaozhou, and Ruitian Tian.

　　Like ‘Killing Time’, the local host IP address 127.0.0.1 seems to have been accidentally exposed. Among the 29,226 transactions of ‘Xiaomian’, only 10 transactions (<0.08%) show IP as 127.0.0.1. 　　

　　Gifts purchased by ‘Xiaomian’ under the ‘seemingly normal’ IP from November 20, 2019 to February 4, 2020

　　Gifts purchased by ‘Xiaomian’ with IP 127.0.0.1 from November 20, 2019 to February 4, 2020

　　Within a few minutes, ‘Xiaomian’s IP jumped from China to Chile, which is impossible for a real person (assuming he is not on the track), which also indicates that ‘Xiaomian’ is part of a false robot network.

　　Within a few minutes, ‘Xiaomian’s IP jumped from Chile to China and then back to Chile. As shown in the figure below, the local host IP address 127.0.0.1 was also leaked at 17:26 UTC, and the IMEI field became blank, which can be seen in the middle column of the log. When ‘Xiaomian’ sent the next gift at 17:42 UTC, the program reappeared an IP address in Santiago, Chile.

　　Rapid IP switch of ‘Xiaomian’: from Santiago to Shenzhen to local host, and then returned to Santiago

　　The rapid switch from Chile to China and back to Chile of this IP is not an isolated incident. On January 25, 2020, the transaction log showed that within less than 50 minutes, the IP of ‘Xiaomian’ jumped from Santiago, Chile to Beijing again, and then jumped back to Santiago.

　　Xiaomian: From Santiago, Chile to Beijing in less than 50 minutes, and then returned to Santiago

　　The rapid switch from Chile to China and back to Chile of this IP is not an isolated incident. On January 25, 2020, the transaction log showed that within less than 50 minutes, the IP of ‘Xiaomian’ jumped from Santiago, Chile to Beijing again, and then jumped back to Santiago.

　　Xiaomian: From Santiago, Chile to Beijing in less than 50 minutes, and then returned to Santiago

　　Case Analysis: Live broadcast practice field controller ‘Guolizheng’ (nickname)

　　Guolizheng is a top-ranked paid user on YY and also a field controller in YY’s live broadcast room. The gift page shows internal IP addresses of YY and local host IP 127.0.0.1, indicating that there are signs of robot activity on this account.

　　During our four-month monitoring period from November 2019 to February 2020, Guolizheng is ranked 109th in paid users and is also a ‘practice field controller’, as shown in the figure below. Field controllers are personnel used by YY or guilds to monitor the interaction between anchors and viewers, and to assist in managing the content sent by viewers on the public screen.

　　Information about Jusco on the Little Gourd platform

　　Through interviews with different field controllers, we learned that some field controllers are paid in YY’s virtual currency, although according to Chinese law, this is illegal. Paying service fees with Online casino and How to find it directly violates the relevant laws and regulations of China on the use of Online casino and How to find it in online game forums. The figure below shows the recruitment advertisement released by YY, providing field controllers with “a large amount of Y coins”.

　　YY59脱口秀/992 Night Listening Channel urgently needs field control managers

　　Benefits and welfare: YY peripheral products/Y Bear/Y Pillow, with a large amount of Y coins waiting for you to pick up

　　In June 2020, Jusco’s gift-giving pattern changed to robot gift-giving, further proving that YY widely uses robot gift-giving on its platform. Although Jusco is a top-paying user, he also uses YY internal network connection IP and Juju local host IP 127.0.0.1.

　　Gifts from Jusco under the “seemingly normal” IP, from November 20, 2019 to February 4, 2020

　　Gifts from Jusco when the IP is 127.0.0.1, from November 20, 2019 to February 4, 2020

　　On January 28, 2020, when Jusco was刷ing gifts, we also found suspicious IP address redirection. Jusco started to刷gifts from an IP address 112.17.241.1 in Ningbo, and then in a series of gifts, he exposed the local host IP 127.0.0.1 of Juju. After less than a minute of quick gift刷ing, the original Ningbo IP was displayed again. This pattern indicates that he is using VPN or other IP masking software to hide the true source address of the gifts, and this address is YY’s own local server. We believe that using VPN to watch Chinese website streaming content in mainland China is very unusual. This will slow down internet speed and reduce the viewing experience. The part marked in yellow in the figure below shows that the gifts that Jusco刷ed came from the local host IP.

　　Example of gifts from local host IP 127.0.0.1 that Jusco刷

　　When abnormal IP addresses such as local host IP or internal network connection IP are recorded, YY usually does not record IMEI, which can be seen from the blank in the “detailInfo_imei” column above. Such data loss indicates that this is not a normally operating mobile device, but may be a robot program running on a server. This further supports the conclusion that Jusco and other users using these abnormal IPs are either robots or assisted by gift-giving programs running software connected to YY servers, while displaying false mobile device IMEI and external IP.

　　Case study: ‘Aoli Gei or nono ke’ (user nickname)

　　’Aoli Gei’ is the 145th ranked paying user. He not only exposed the local host IP of Joyous but also jumped back and forth between China and Malaysia three times during the epidemic lockdown, indicating that he is a robot.

　　Gift record of ‘Aoli Gei’ from November 20, 2019, to February 4, 2020

　　In Malaysia, the gifts of ‘Aoli Gei’ come from multiple IP addresses, but among them, there are also 10 gift records from 127.0.0.1.

　　Gift record of ‘Aoli Gei’: gifts from local host IP 127.0.0.1 and Kuala Lumpur

　　On January 27, 2020, the IP of ‘Aoli Gei’ jumped from Malaysia to Quanzhou, China, and then back to Kuala Lumpur, Malaysia, in just over 20 hours, while China had already started the epidemic lockdown. Five days later, the IP of ‘Aoli Gei’ jumped back to Quanzhou, Fujian Province.

　　Due to public health events, countries around the world have gradually implemented lockdown policies. Although international flights had not been completely suspended at the end of January and the beginning of February, the possibility of making such rapid back and forth trips between China and overseas was almost zero.

　　It seems that YY’s false paying users have multiple ‘identities’.

　　During the monitoring of YY live data, we found 2.35 million gift transactions from 16,288 paying users in 156 countries. The number of transactions showed a significant increase at the beginning of 2020.

　　Based on the above findings, we believe that Joyous Group has the ability to establish a large-scale overseas IP address network, creating the illusion of paying users in any country.

　　Bigo claims that its users are spread across more than 150 countries, and we believe this is not a coincidence. We believe that the ability to develop the capability to create false paying users and false traffic on a large scale globally is an important part of Joyous Group’s overseas market strategy.

　　Joyous’ ‘robot’ breeding farm: more than 1100 paying users exist in the same IP address block

　　Through the methods used to identify false paying users, we found that 1166 paying users are gathered in the same IP address block. During the lockdown period caused by public health events, the activities of these false paying users suggest the existence of a ‘robot paying user’ breeding farm in Heihe City, Heilongjiang Province, China.

　　In our research, we found that these robots have the following reward patterns (one or more):

　　Rewards will be given regardless of whether the anchor is online or not;

　　Displaying

　　According to the above standards, we find that the joyous robot breeding farm creates hundreds or even thousands of viewers, including both fans robots as paying users and fans robots without payment. Next, we will introduce to you such a robot network in detail.

　　113.8.150.94 is one of the main IP addresses used by the Joyy Group during the public health event blockage. From January 24th to the following 13 days, our data monitoring tools recorded 1,166 paying users on this IP address, with a total of 25,545 individual transactions, making it the most frequently used IP address on the YY platform during the period. The other three IPs from the same IP block – 113.8.150.85, 113.8.150.88, and 113.8.150.95 – followed closely, with 25,422, 24,513, and 22,407 transactions respectively. The four IP addresses together generated nearly 100,000 gift transactions.

　　Gift transactions on the IP address block 113.8.159.XX, from 2020/1/24 to 2020/2/3

　　These IP addresses are all located in Harbin City, Heilongjiang Province, China. According to Chinese standards, Harbin is a fifth-tier small city with a population of about 1.3 million. During the period we tracked, not only was it the period of public health event blockage, but also the Spring Festival holiday. In such an unusual period, there was such a large-scale payment behavior in the remote city of Harbin, and it was concentrated on the same IP address block, which is almost impossible. Harbin City has 191,132 IPs, even if 1,166 real users couldn’t help but want to reward gifts, the probability that they all use the same IP address is almost non-existent.

　　A total of 25,545 independent transactions were made at the IP address 113.8.150.94, with gifts given to 837 different anchors.

　　We checked for abnormal activity patterns among the top five paying users at the IP address (113.8.150.94) during this period, and then found that these five paying users have certain relationships with the Joyy Group. One of them is a YY internal network IP user, while the IP changes of the other four indicate that they used VPN.

　　We believe that all or most of the transaction activities made by these paying users come from robots, which are likely to be carried out through the same server, and the real address of the server is hidden through VPN or similar software.

　　YY’s social networking channels are not the secret money tree for its other revenue.

　　According to the data from Xiaohulu, the reported live broadcast income of YY Live differs from the income obtained from paying users by about 30%. Big One Data Service Company speculates that the less well-known social interaction business under the Joyy Group (i.e., the channels where female anchors chat with male fans or sing for them) contributes a large part of the other income to the group, but not all of it.

　　However, we found that the surge in business income is similar to what we discovered on YY Live. We understand this by detecting the gift income from dating rooms, the overlap of inactive users and paying users.

　　The Chinese third-party data analysis application Big One also noted the huge gap in its revenue estimates and expressed belief that YY Live may have at least 20% of its income from its dating live business. According to the company’s first quarter 2020 report, this part (20%) of the income is equivalent to 5.134 billion yuan.

　　Our investigators used data monitoring technology to assess the activity level and income of the dating platform in Q1 of 2020. During the monitoring period, we observed that YY typically operated about 500 live rooms every day. We further estimated that about half of the users in these 500 live rooms were ‘robots’ – inactive users creating the illusion of viewers watching live streams. These rooms usually had few signs of activity, and some rooms had almost no record of gifts.

　　In many cases, the same paying users appear in multiple live rooms. Moreover, in rooms of different anchors, about two-thirds or even more of the top-paying users are the same.

　　According to the patterns we observed on YY and Bigo websites, many of the top-paying users of this dating platform are also anchors of the platform itself. We estimate that up to 90% of the paying users may also have anchor identities.

　　During the monitoring period, we observed that the highest gift income of a dating channel room was about 150,000 yuan per week. As of March 2020, the weekly gift income of the top ten dating channel anchors ranged from 16,000 yuan to 99,000 yuan. Even assuming there are 500 anchors, each generating an income of 16,000 yuan per week, the total monthly income would only be 34.7 million yuan, or 1.04 billion yuan per quarter. This is at least 79.8% lower than Big One’s estimate of 5.134 billion yuan.

　　Therefore, we estimate that there is a gap of about 80% between the actual and reported income of its dating channel, which is consistent with our estimate that 90% of YY’s non-dating business income is false.

　　Our research finds that in the YY live ecosystem, this little-mentioned business is not a secret weapon (or what is called a ‘money tree’), but just another lie.

　　The abnormal financial data of Hanju Group in China indicates the existence of cash fraud and deception.

　　We obtained the credit report of Hanju Group’s onshore variable interest entity (VIE) in China and compared it with the documents submitted by Hanju Group to the SEC, and found many discrepancieslottery plan and The latest website. The amount involved is several billion yuan, including: the financial data reported in China differs significantly from the data reported to the SEC by Hanju Group, with a serious shortage of cash. This discrepancy, especially the discrepancy in cash balance, indicates that the company may engage in manipulation or fraud.

　　For example, the documents submitted to the SEC by Hanju Group in 2018 show that the company holds 1 billion yuan in long-term deposits. We believe that this number is likely to be fictional or greatly exaggerated, as the onshore variable interest entity of the company does not hold such a large amount of long-term deposits. A rough comparison of the financial statements of these two can reveal this discrepancy.

　　In addition, we believe that Huajue Group either transferred about RMB 13.26 billion to its WFOEs (foreign-invested enterprises) – most of which was transferred illegally – or these cash simply do not exist.

　　According to our calculations, by the end of 2018, Huajue Group’s foreign-invested enterprises held a cash balance of RMB 12.98 billion, of which the vast majority (about RMB 11.6 billion) was overseas. However, given that the company’s filed documents with the SEC did not show substantial dividends or loans flowing to overseas, we believe that either Huajue Group violated regulatory provisions and transferred the vast majority of the RMB 13.26 billion to overseas, or the RMB 11.6 billion offshore cash balance is false.

　　The table shows that, excluding Huya, the onshore and offshore foreign-invested enterprises of Huajue Group had a book cash balance of RMB 12.98 billion.

　　To determine the onshore-offshore division of this cash, we referred to the credit report of Huajue Group in China. The report shows that by the end of 2018, its onshore (excluding Huya) foreign-invested enterprises held no more than RMB 1.38 billion in cash. The table below only shows the cash situation of major onshore (excluding Huya) foreign-invested enterprises.

　　Due to the low onshore cash balance at the end of 2018, of the total cash balance of RMB 12.98 billion, RMB 11.6 billion was offshore cash. See below:

　　From these calculation results, it can be inferred that during 2018, most of the cash transferred to WFOEs under Huajue Group flowed into offshore foreign-invested enterprises. This is because onshore foreign-invested enterprises not only had a low cash balance but also no major financing activities that could have resulted in significant cash transfers.

　　To calculate the amount transferred to offshore foreign-invested enterprises, we referred to the cash flow statement of Huajue Group. In the table below, we first summed up the total cash generated by the company’s variable interest entities in 2018, amounting to RMB 33.8 billion. Then, we added this figure to the cash held by the company’s variable interest entities at the end of 2017, resulting in an amount that should have been reflected in the company’s balance sheet (if no transfers had occurred) – RMB 53.24 billion. This does not match the RMB 39.97 billion shown on the company’s balance sheet at the end of 2018.

　　The RMB 13.26 billion difference includes the secretive transfer to foreign-invested enterprises (excluding Huya) from variable interest entities (excluding Huya), as they disappeared from the cash balance of variable interest entities in 2018. The documents submitted by Huajue Group to the SEC in 2018 did not disclose the issuance of significant dividends or loans to offshore entities. However, as summarized in the table above, almost all of the transferred cash flowed into offshore WFOEs. Therefore, our conclusion is that the vast majority of the RMB 13.26 billion said to have been transferred overseas either violated regulatory provisions or the cash simply does not exist. The following is a breakdown of our calculation of the RMB 13.26 billion:

　　These offshore cash transfers of unknown reasons have inevitably raised concerns about the authenticity of the offshore cash balance of Huajue Group.

　　About 80% of Bigo’s revenue is fake.

　　We believe that the origin story of Bigo’s corruption and the severely exaggerated income make it the worst business under the YY Group. We estimate that about 80% of Bigo’s revenue from overseas live-streaming platforms is fake, and its level of fraud is comparable to that of YY Live. Even with generous and company-friendly calculations from multiple application analysis suppliers, it indicates that 60% of Bigo’s income is fictional.

　　According to Singapore’s filing documents, contrary to the statement of the YY Group, Bigo was not founded by Li Xueling, but by the YY Group. In 2019, the YY Group completed the full acquisition of Bigo, with Li Xueling at least earning 156.1 million US dollars from it. Additionally, Bigo is associated with a Chinese mainland variable interest entity under Li Xueling’s name. In 2019, when Bigo was acquired, this variable interest entity accounted for about a third of its revenue. Based on our preliminary investigation and discussions with Chinese mainland channel partners and gift suppliers, we believe that this Chinese entity is almost entirely fake. According to the 6-K filing submitted to the SEC by the YY Group in June 2019, in the fiscal year 2018, Bigo’s Chinese app recorded 165.5 million US dollars in revenue, accounting for 36.2% of Bigo’s total revenue. As of the third quarter of 2020, we estimate that this Chinese subsidiary, which largely exists fraudulently, claims that its revenue is still growing, reaching 67.2 million US dollars.

　　Through monitoring of top channels and interviews with former senior executives at Bigo, we found that most of the traffic on the site comes from robots, and most of the ‘income’ comes from mutual gifts among paid anchors. In addition, we found that the highest-paid anchor on Bigo is a liar, playing the second-largest donor to his own income. Bigo also altered the account information and donation data of key false paying users, which seems to be a scam carried out continuously to cover up its fraudulent nature.

　　Case Study: Bigo’s top consumer user RCT_KHAN is one of the biggest liars.

　　The channel of RCT_KHAN, the most popular anchor on Bigo’s overseas station, is a comical existence. Most of the time, he is live-streaming while flipping through documents in front of his desk. However, his income ranks among the top in Bigo anchors. When trying to determine the source of his channel income, we found signs of fraud similar to YY Live, but different. RCT_KHAN’s second-largest donor is ‘blatantly himself’, which is actually himself, a strategy commonly used on YY Live. Many of the top donors are actually RCT_KHAN’s ‘family members’, or other anchors associated with him, which also fits the fraudulent behavior that appeared on YY Live.

　　RCT_KHAN continuously defeats other opponents in online challenges and global competitions, becoming the highest-paid主播. Most importantly, he does not joke, does not provide entertainment programs, and has not truly done anything.

　　In the camera, he sits in front of his desk doing paperwork every day, or the camera is pointed up at the ceiling. Occasionally, he will also chat with another Bigo anchor during the live broadcast. In 9 months, we watched his live broadcasts over 50 times, and as far as we know, these are the contents of his ‘entertainment live’.

　　His channel is both boring and unwatchable.

　　But looking at his continuously growing income and achievements on the leaderboard, you would believe that Bigo users are his fervent supporters, providing generous returns for RCT_KHAN’s live content.

　　We first noticed RCT_KHAN in November 2019, when he had a total of 130 million ‘beans’, which is the online casino and how to find it earned by the主播 on the platform. But by the end of March 2020, he had earned another 51.5 million beans, meaning his monthly income was about 50,000 US dollars. Even for an excellent anchor, this is a generous reward, let alone for an anchor without substance.

　　The absurdity does not stop there. In March 2020, he topped the global leaderboard again, jumping to the first place in the last 30 minutes of the challenge with an increase of about 1.7 million beans. We believe he captivated his audience with his unique wall and ceiling tiles.

　　From a series of photos below, it can be seen that in the last 30 minutes of this match, Khan had no entertainment live content at all, and he was expressionless even when he topped the leaderboard, almost never looking up at the camera.

　　Through interviews with former Bigo employees, we learned that RCT-khan is both the leader of the RCT ‘family’ and the manager of talent agency. Ironically, his virtual agency actually lacks personnel. We believe his main job is to promote Bigo and carry out ‘internal gifting’ to create the illusion of massive gifting volume for Bigo.

　　When examining RCT_KHAN and his main donors, we found three patterns that raise questions.

　　Firstly, his main donors are all ‘recharge agents’. We suspect that RCT_KHAN’s most valuable service is the one he provides as a ‘diamond reseller’ on the streaming platform, that is, allowing Bigo users to purchase the platform’s ‘diamond’ tokens at a discount, which are not gifts from actual paying users.

　　Secondly, his other top donors are all members of the same ‘family’. This mode of gifting in a closely allied family is not an exclusive pattern of RCT_Khan and his small group, but a common feature that can be seen everywhere in the Bigo ecosystem. The table below shows the correlation nature of the RCT family’s donations to the same several accounts.

　　Third, RCT_KHAN’s second largest donor (donated 24.8 million beans, equivalent to over 400,000 US dollars) – RCT_HYUN BIN, it seems to be him himself.

　　Just before we released this report, something interesting happened to RCT_HYUN BIN. Below is his personal homepage:

　　One day, RCT_Khan’s second-largest donor suddenly became Fahmi NAGA, replacing RCT_HYUN BIN. Bigo changed a large number of false paying user profiles.

　　Fahmi NAGA is not a new donor; his contribution to rewards surpassed RCT_HYUN BIN and jumped to the second place on the donation list. However, there was no change in the ranking of the highest donor. At the same time, RCT_HYUN BIN’s username, homepage image, user family, Bigo ID, and most personal information were quickly changed, and the total contribution of golden beans was reset to zero.

　　We have been tracking RCT_KHAN RCT for nearly a year, during which Hyun Bin’s popularity has continued to rise. Muddy Waters believes that a certain manager at Bigo finally realized how foolish it is to publicly showcase the anchor who has received the most rewards, and who is also his second-largest donor.

　　We also noticed that this is not the first time RCT_HYUN BIN’s profile has been modified. Before being renamed to RCT_HYUN BIN, this user’s name on the platform was VARUN DHAWAN. It is obvious that the platform was involved in this matter, as according to Bigo’s own rules, only one name change is allowed for names associated with Bigo ID. For this reason, we conclude that even if Bigo did not directly help modify the name, it still provided some help in this situation.

　　We believe that these fake user profile modifications are essentially Bigo’s way of covering up the identity of its ‘shills’.

　　Even under our optimistic estimate, 59.1% of Bigo’s revenue is still false.

　　We believe that 80% of Bigo’s revenue is false because Bigo’s ecosystem is similar to YY Live. However, even if we establish a model favorable to Bigo based on the revenue data from Apple Store and Google Play, we still estimate that 59.1% of Bigo’s revenue is false.

　　The following table calculates Bigo’s revenue worldwide (excluding China), including Bigo Live, Likee, IMO, and Hello Yo. We find that, under our conservative estimate, through comparing the app store revenue data and a large number of adjustments favorable to the company, 59.1% of Bigo’s revenue seems to be false. These data are collected from various third-party application data monitoring services of Apple and Google Play games store, and we adjusted their reported data upwards based on the company’s disclosed information and interviews with former employees.

　　Our conclusion of the 59.1% fake ratio also takes into account uncalculated income sources, including PC users, fees from digital stores, and markets not monitored. Firstly, we estimated Bigo’s revenue for the second quarter of 2020 to be $52.4 million based on these data sources.

　　We also added income from other large applications, including Likee, which increased $6.4 million in revenue during the same period. Then, we adjusted the total revenue of $58.8 million by 2.5% because these revenues came from regions not monitored by data services; 30% of the fees from Apple and Google’s app stores; an increase of 28% in Bigo users from PC users, who were not initially included in the calculation; and another 30% of the income from Apple and Google stores.

　　Therefore, our conservative estimate of Bigo’s actual income for the second quarter of 2020 is $1.707 billion. The data published by YY Group shows that Bigo’s revenue was $4.17 billion, from which we infer that 59.1% of Bigo’s revenue is fake. The following figure shows the detailed calculation method.

　　We believe that the gap between the company’s claimed income and its expected model is expanding. In 2018, we found that Bigo’s locally reported income in Singapore was only 29.0% different from what the model showed. Compared with the data disclosed by YY Group in subsequent quarters, this difference has increased significantly, from $52.5 million (35.1%) in the first quarter of 2019 to $2.463 billion (59.1%) in the second quarter of 2020.

　　The similarities between Bigo and YY mainly include three aspects.

　　• Firstly, we found that Bigo platform has a large number of robotsonline casino plan and How to find it. As shown in the above text, the YY robot network shows IPs in South America and Southeast Asia, which means that YY Group can almost fake users anywhere in the world. Therefore, when former managers of Bigo in Southeast Asia, South Asia, and the Middle East said that at any time, the vast majority of Bigo users are robots, we were not surprised.

　　• Secondly, like YY Live, Bigo operates a circular economy of overstated income, where anchors are often hired as contract workers, who are forced to transfer most of their income from work to others (giving gifts to other anchors).

　　• Third, the goal of the entire business is to benefit a small group of insiders, with Lixingling, the Chairman and Acting CEO of YY Inc., being the main beneficiary.

　　The acquisition of Bigo was a multi-year, multi-level scam that benefited the insiders of the Joyy Group.

　　We believe that the Joyy Group’s acquisition of Bigo company for $1.45 billion in cash and stocks in 2010 was a scam, with the purpose of deceiving investors by acquiring another fraudulent company from the chairman’s hand. Muddy Waters obtained the local filing documents of Bigo in Singapore, showing that Bigo was initially established by the Joyy Group rather than Li Xueling: later, Bigo was transferred to the chairman of the Joyy Group, Li Xueling.

　　We also found that Bigo later retroactively increased the revenue of its mainland China business, which was largely fabricated, in order to make it seem like the acquisition was a wise decision and to justify Li Xueling’s high salary.

　　We believe that Bigo was established from the beginning to deceive investors. Since 2015, the company’s management has been misleading investors, telling the public that Bigo was established and controlled by Li Xueling. However, this is a lie: Singaporean documents show that Bigo Technology Pte. Ltd. was established on September 11, 2014, with only one shareholder, Duowan Entertainment Corp., an entity of the Joyy Group in the British Virgin Islands. See the following figure:

　　In comparison, Li Xueling personally invested in Bigo until December 14, 2014.

　　In the early years of Bigo, local audits showed that everything was not as it appeared on the surface. In the first four years, Bigo changed its auditor in Singapore three times. After the 100% acquisition of Bigo, the management of the Joyy Group claimed that although Bigo was in the red overall, Bigo Live (the core live streaming business) was strong enough to support the initial development of other businesses such as Likee, but the Singaporean auditor raised objections. In the three annual reports of Bigo from 2016 to 2018, each audit report contained a warning about the continuation of Bigo’s operations. In addition, a few months after the acquisition was completed, Bigo restated its 2017 financial condition significantly in August 2019.

　　Due to its precarious financial situation, Bigo continues to paint a rosy picture to prepare for acquisition. In the filing submitted to Singapore in 2018, Bigo reiterated its financial condition and added a Chinese variable interest entity – Guangzhou Baiguo Network Technology Co., Ltd., which contributed an additional $110 million in revenue to the company.

　　However, as detailed below, we believe that Bigo’s revenue in mainland China is almost entirely fabricated. In addition, when we compare the details published by the company in Singapore with the financial condition reported by Bigo’s variable interest entity in its Chinese credit report, the institution found many illogical discrepancies.

　　Bigo’s financial fraud helped the parent company, YY, generate huge gains from fair value restatement, which in turn enhanced the value of YY’s stock. YY’s D-round investment in Bigo in 2018 led to a revaluation gain of 9.887 billion yuan, equivalent to 46.7% of the net profit announced in 2018. The acquisition of Bigo in 2019 further boosted YY’s financial situation in the first quarter of 2019, with the recalculated earnings reaching 26.7 billion yuan, accounting for 72.2% of the net profit for 2019.

　　Bigo has always concealed the fact that when the acquisition was made, one-third of its business was not from overseas, but from mainland China. Muddy Waters believes that almost all of the income from mainland China is fake. In addition, we believe that these incomes from China allowed Bigo to obtain a higher acquisition price through false sales, thereby benefiting its chairman, Li Xueling.

　　At the press conference announcing Bigo’s D-round financing in June 2018 and the acquisition of Bigo in March 2019, Bigo was portrayed as a global live streaming platform valued at 1.45 billion US dollars. These statements emphasized that the Bigo Live live streaming platform does not include China, but did not mention that a large part of Bigo’s income came from the audio live streaming app in China.

　　However, according to the filing submitted to the SEC on June 6, 2019, the 165.5 million US dollars in sales came from China, accounting for about one-third of Bigo’s total revenue in 2018. The income from audio live streaming was almost the same, at 159.4 million US dollars, which means the audio live streaming app Hello from mainland China has earned more revenue. When we detailed the infra, we suspected that Bigo’s restatement of earnings in 2017 and its income from Bigo and related audio live streaming business in 2018 were likely false or greatly exaggerated. All these findings support our estimate that 80% of Bigo’s income is fake.

　　The former executive confirmed: most of the user data are fake

　　Three former senior executives of Bigo confirmed to us that most of the user data on the platform are not real people, but robots commanded and allocated by the artificial intelligence at the Singapore Bigo headquarters or the YY Guangzhou headquarters.

　　Our investigators interviewed a former senior executive of Bigo’s Indian branch and inquired about the company’s business practices. The executive said that about 60% of the viewers in Bigo主播’s rooms are robots, and the distribution of robots is decided by the Chinese management teams in Singapore and Guangzhou.

　　He believes that using robots is necessary and pointed out the flaws in Bigo’s platform foundation. “So basically, when anchors join, the company cannot just ignore them…but should allocate some fans accordingly,” he said. “If you join this platform and start live streaming, and there is no one to tip, at this point the company must give you some fans…That is the right thing to do. You can also try your best to attract viewers, but no one would do that.”

　　A former Bigo Middle East division executive described to Muddy Waters the approximate proportion of fake users. He said: ‘For Bigo, only about 30-40% of the viewers are real, with about 60-70% being bots.’ However, this former executive stated that Bigo can adjust the proportion of bot users on its platform, and this number can be quite high in practice. For example, in the music channel, the top 5000 viewers are usually bots.

　　Finally, a former Bigo Southeast Asia division executive confirmed these statements, explaining to us that the common proportion of bot viewers in Bigo channels is 70%.

　　Live broadcast traffic, mutual rewards among streamers

　　Bigo uses talent agencies and live broadcast teams to manage the distribution of gold beans, thus creating a dynamic similar to YY Live without the need for implicit control over guilds.

　　Bigo streamers are all pre-arranged. To receive compensation, streamers need to reach specific gold bean quotas and follow a regular live broadcast schedule to compete for rankings on the streamer leaderboard. Streamers must maintain a daily live broadcast time between 30 minutes and 2 hours to ensure they log in as much as possible each month, while the company aligns its payment incentives with the indicators of third-party analysis companies, which rank the APP based on engagement metrics. Bigo gives the impression of high engagement, but in fact, most streamers are just a group of paid performers following a schedule.

　　According to a former Bigo manager we interviewed, the profit quota system for gold beans forces streamers to be unable to cash them out. Some streamers receive compensation, but for streamers in countries like the United States, Morocco, and others, they are paid in the form of gold beans on a monthly basis, which helps Bigo increase the number of gold beans circulating in the ecosystem.

　　Bigo also introduced a circular mechanism that allows streamers to continue using gold beans within the platform. They can purchase discounted gold beans to reward each other. In this way, when the number of gifts received does not meet the quota, streamers usually seek help from talent agencies or live broadcast teams to exchange for discounted gifts. Streamers typically retain about half of their gold beans for a month to prepare for the need to exchange gifts with other streamers to meet the quota. Such activities can maintain the flow of Online casino and How to find it and generate huge profits within the Bigo app.

　　We reviewed some popular streamers and found that they often reward a large number of gold beans, sometimes in amounts that seem to equal or even far exceed their total income. However, due to Bigo changing the identities of a large number of tourists as well as altering the account statistics of reward users, it is difficult to make precise calculations. For example, the following is an example of the reward expenditure of the streamer RCT_KHAN, which shows that it has decreased by 99.8% in some way over a period of 7 months:

　　RCT_KHAN’s continuously decreasing rewards expenditure.

　　The left figure: In April 2020, the anchor sent out a total of 131 million diamonds

　　The right figure: In November 2020, the total number of diamonds sent out decreased by 130.7 million

　　Bigo explains the definition of ‘tips’ in its APP

　　We believe that the intention behind the large-scale modification of user data is clear: to prevent others from discovering the scale and absurdity of Bigo’s fraud.

　　Bigo’s revenue in the Chinese region also exists with fraud

　　Bigo also has business in mainland China, but this business was not mentioned in the company’s previous earnings call, and the company tried to hide it in the annual report. We believe that the company avoids mentioning the Chinese business because it is essentially an ’empty shell business’, as the activity of its APP users is very low, even to the point of no real user activity. Huanju Group reported that Bigo’s revenue in Asia and China in 2018 was $165.5 million, with the revenue from its audio live streaming part being $159.4 million. Bigo’s core product, namely Bigo and Likee, mainly focuses on the video field, targeting markets outside of China. In 2018, the financial report showed that the revenue of Bigo’s Singapore parent company was $5.382 billion, with the revenue from the Chinese region accounting for 30.7% of the total, which is a very considerable amount for a market that was almost not mentioned.

　　The following SEC filing shows Bigo’s specific revenue by region:

　　In 2018, Bigo’s revenue surpassed that of domestic APPs including Hello Voice

　　Through our investigators in the mainland and conversations with former employees of Bigo, we confirmed that mainland Chinese users cannot normally download Bigo through APP stores, and its main source of revenue in China comes from anchors who are employed by the company to interact with overseas Chinese or other foreigners. Therefore, we believe that the Chinese users of Bigo Live are actually anchors themselves and do not generate any substantial income.

　　The information disclosed by Huanju Group makes us believe that China’s revenue actually comes from an APP named Hello Voice. In the 6-K filing submitted by Huanju Group in June 2019, it was pointed out: “In March 2016, Baiguo Network Technology Co., Ltd. launched an audio streaming mobile APP named HELLO Voice, focusing on China’s business.” Our investigation of Bigo’s Chinese variable interest entity (VIE structure) – Baiguo Company shows that the company operates multiple APPs and websites in mainland China, many of which seem to have disappeared. The main APPs operated under its banner are HELLO Voice, which focuses on the social field of voice streaming media, and has a very small market share. Other APPs that seem to still be operating, including Yiqi and YuanYuan, have even smaller market shares. Therefore, we believe that the so-called audio live streaming business revenue and revenue from mainland China are essentially the same, and should mainly (if not all) come from Hello.

　　We also found that Bigo’s average revenue in the Chinese region has been contributing to the growth of total revenue. In 2019, the Joyy Group began to disclose specific information about live streaming revenue in the Chinese and non-Chinese regions in its quarterly reports. The Joyy Group’s non-Chinese region revenue mainly comes from Bigo, with a small portion from Huya and Hago. Assuming that Bigo and its merged subsidiaries account for 100% of the Joyy Group’s non-Chinese revenue, then we can subtract all of the Joyy Group’s non-Chinese region revenue from Bigo’s total revenue to calculate the minimum revenue of Bigo in China. From the latest financial data disclosed by the Joyy Group (excluding Huya), it can be seen that the business revenue in the Chinese region accounted for 13.4% of the company’s total revenue in Q3 2020 and increased by 27.4% year-on-year to 456.2 million yuan.

　　Bigo’s domestic revenue seems to be limited to applications and investments under the Baixiangyuan Company, and this part of the revenue should basically come entirely from Hello Voice and its sister applications. However, when our investigators spoke with YY guilds and online casino and How to find it businesses, they found that they knew very little about the Hello Voice APP. To date, we have found almost no evidence to indicate that the APP has any significant importance in terms of brand awareness, brand image, downloads, MAU, or revenue in China. As described below, we suspect whether Hello Voice and its sister APPs have the capability to support a large part (if any) of the actual revenue of the company.

　　Hello Voice has a deep connection with YY.

　　Our investigators conducted an initial investigation of Hello Voice and found that there is almost no user activity, which further reinforces our belief that this APP generates almost no revenue. Moreover, through the analysis of the information disclosed by the application, we found that Hello Voice seems to have been established by the Joyy Group rather than Bigo Company.

　　We monitored several live streaming rooms and found them to be a joke, not only with poor content, but also most rooms lacked hosts and viewers. While browsing the APP, we noticed that the number of active users was very low, even in fully occupied rooms, there was very little interaction between hosts and users, almost no signs of gifting. Most users seemed to be ‘sitting robots’, not participating in any activities, and it appeared that they neither joined nor left these zombie rooms. The following two examples demonstrate situations where the APP showed fully occupied live streaming rooms with no interaction at all.

　　We believe that the existence of Hello Voice and its sister apps is for the convenience of management, and the company may find that ‘creating’ income domestically is easier and cheaper than operating in overseas markets. We further believe that the operation of these applications helps to improve the performance of Bigo Company, further enhancing its historical and recent contributions to YY’s performance, while bringing continuous revenue growth and past fair value returns. In addition, such income fraud is a way for Joyy Group co-founder and CEO Li Xueling to artificially increase the valuation of Bigo Company. By including the false revenue of Baiguo Fruit Garden Company in China in its revenue, Li Xueling obtained greater benefits from Joyy Group.

　　To prove that the operational business of Baiguo Fruit Garden Company is mainly composed of Hello Voice, we can look at the following figure, which shows that the company’s public General Administration of Market Regulation records indicate that its official website is www.520hello.com.

　　Additionally, as of August 2018, before Joyy Group acquired Bigo, Hello Voice used YY customer service email: hello@yy.com. This was a dangerous sign for a small-scale enterprise, but more intriguing for Bigo. It was reported that in that year, the market expected Bigo’s revenue to exceed 1 billion yuan in 2018. This indicated that some of its operations and management had been merged and were under the joint control of YY.

　　We mentioned other evidence of actual control rights in our blog post in January 2017, which involved how to set up accounts and withdraw commissions from Hello Voice. According to the submitted documents, since 2016, Bigo has controlled Baiguo Fruit Garden Company and Hello Voice and they have been completely separated from YY. However, Hello Voice users were still encouraged to link their YY accounts to their Hello Voice accounts and use YY’s payment system.

　　Appendix A: Definitions related to the analysis

　　Gift Income: The value of gifts sent by paying users or the value of gifts received by anchors, as recorded by the Xiaohulu (XHL) platform. For YY live streaming, gift income is approximately the cash value received by the Joyy Group.

　　Guild: The party operating the channel or providing live broadcast services to viewers on the YY platform. The channel on YY is called a ‘room’. For YY anchors, the channel owner is also known as ‘OW’.

　　Channel Manager: An individual or virtual individual responsible for the operation of the guild, which can be management or shareholders.

　　PU: Paying users, viewers who give gifts to anchors during live broadcasts.

　　FU: Fake paying users. The fake users of YY show signs of fraud and platform control in their gift-giving behavior and transaction details.

　　PU Ranking: This ranking is calculated based on the value of gifts given by paying users to anchors from October 2019 to January 2020, as recorded by Xiaohulu (unless otherwise specified).

　　Anchor Ranking: This ranking is calculated based on the gift income received by anchors from October 2019 to January 2020 according to the report by Xiaohulu (unless otherwise specified).

　　IP subnet: Grouping IP addresses from the same network together. Usually a group has 256 IP addresses.

　　UID: See above explanation.

　　FromID and ToID: FromID indicates that the ID is as a paying user to give gifts, and ToID indicates that the ID is as an anchor to receive gifts. If someone uses his ID to live stream or gift, the two transactions have the same ID number, and the title of the ID will change according to the direction of the transaction, which can become fromID or ToID.

　　FromName and toName: Variables associated with FromID and ToID. A YY ID can have multiple FromName and toName. Users can change their usernames freely.

　　Four-month monitoring period: October 2019 to January 2020.

　　Expanded monitoring period: November 27, 2019 to February 5, 2020.

　　YY Group controlled paying users: If the paying user uses the local server of YY Group or the internal network IP, and the IMEI of the phone of the anchor under the channel controlled by YY Group is the same as that of the paying user, the IP address displayed when the user gifts will show the robot network IP controlled by YY Group.

　　YY Group server false paying users: The IP addresses of 82 paying users are 127.0.0.1

　　YY Group internal network false paying users: The IP addresses used by 1,301 paying users are in the range of 100.64.0.0-100.127.255.255, and these IP addresses are limited to internal network use only.

　　YY Group IP addresses: The IP address 127.0.0.1 is used by the local server of YY Group for false paying users, and the IP address range 100.64.0.0-100.127.255.25 is used by the internal network false paying users.

　　Appendix B: Description of data and data sources

　　Data collection

　　By analyzing the traffic generated by the YY Group server, we began monitoring the live studios of anchors from October 20, 2019. Our analysis is based on the data of live gift transactions from November 27, 2019 to February 4, 2020, over a 7×24-hour period. 20,715 anchors received 115.585 million gifts sent by 1.19 million paying users.

　　Expanded monitoring period: Beijing time from November 27, 2019 to February 5, 2020.

　　COVID-19 lockdown period: Beijing time from January 23, 2020 to February 5, 2020.

　　According to the report of Xiaohulu during the monitoring period, the income of the 20,715 anchors we monitored accounted for more than 88.3% of the YY live business income.

　　For each transaction of a gift赠送 gift, we obtained 88 pieces of information, such as the time of the transaction, IMEI, IP, the name of the paying user, the YY ID of the paying user, the name of the gift, the unit price of the gift, the ID of the gift, the quantity of the gift, the name of the anchor who received the gift, and the YY ID of the anchor, etc.

　　Table: Key information for data analysis

　　In addition to the above data, we also purchase and collect little gourd data for data analysis. The little gourd is a data monitoring company that provides ‘independent and reliable’ 107 market data reports on gift transactions to support the income generated by the YY platform.

　　Our large dataset contains over 115 million unique transactions after deleting duplicate data (115GB of data), covering the period from November 27, 2019, to February 4, 2020.

　　We mainly use this data as a large sample to judge the relationship between paid users and anchors, infer patterns, and check data details.

　　We will not use it to estimate the company’s income.

　　The little gourd (XHL)

　　The little gourd is a mobile application analysis company focusing on entertainment and social networking.

　　In the court documents of the lawsuit between the YY Group and Huya, we found that the YY Group itself regarded the little gourd as a reliable source of income data for these companies. Therefore, we extensively use its data to argue for the company’s operations and income.

　　The CEO of the little gourd, Cao Jin, was a co-founder of the YY Group and is still a minor shareholder of two variable interest entities (VIEs) of the YY Group, respectively holding 2.11% and 0.77% of the shares of Guangzhou Huaduo Network Technology Co., Ltd. and Beijing Tudu Technology Co., Ltd. Since December 2008, he has also been the legal representative of Guangzhou Duowan Information Technology Co., Ltd.

　　The little gourd claims to use web crawling technology, and the description provided is very similar to our technology. However, when comparing the little gourd data with the backend data of the anchor, we saw a perfect match. Unless direct access to the YY Group’s own data source is possible, this is impossible. Therefore, we believe that the claim of the little gourd using crawlers to collect data is false, and instead, it is directly linked to the backend of the YY Group.

　　When reviewing the monthly or quarterly data of the little gourd, the difference in its revenue and paid user data is significant compared to the YY Group. For example, in the fourth quarter of 2019, the live broadcast revenue of the YY Group was 31.62 billion yuan RMB, with 4.5 million paid users, while the reported live broadcast revenue of the little gourd was only 21.31 billion yuan RMB (-32.6%), with only 1.32 million paid users (-70.7%). We also observed some discrepancies between our monitoring data of gift giving and the data recorded by the little gourd.

　　When we asked the employees of the little gourd about this matter, they were unable to provide an explanation, but they assured us that their results were consistent with those of other companies in the same industry, with an error of about +/- 5%.

　　We ruled out the possibility that this difference is caused by incorrect records of the lucky stars obtained from the lottery and the lucky lottery gifts received by the anchor. The estimated income of the little gourd includes the value of the lucky stars obtained from the lottery (each worth 0.02 yuan RMB, rather than the original unit price of 0.1 yuan RMB) and the income from the value of the lucky star gift. However, the income from these lucky star gifts is not included in the financial performance of the YY Group. After this adjustment, we can see that this is not the cause of the difference.

　　This contradiction can be explained as Xiaohulu wanting to appear as a genuine, unrelated third party. A genuine third-party application analysis company is unlikely to have perfect data; therefore, we believe that they deliberately created such data that is roughly comparable to that of competitors.

　　Our conclusion is that nearly 90% of YY Live’s revenue is fake. We use the data of paid gifts in Xiaohulu to prove how much of the proportion is fake.

　　Reiterate again, despite these anomalies, we still used the data from Xiaohulu because we believe that the dataset the company wants investors to review and evaluate.

　　Bigone

　　Bigone is another Chinese data analysis company that collects revenue data from Huya and Joyy Group. There are significant differences between its data and that of Joyy Group, and some differences also exist between its data and that of Huya. The reasons for the differences are attributed to the ‘Online Dating’ channel of Joyy Group and the gift value not included in revenue at Huya.

　　YY data calculated by Bigone (Unit: Billion)

　　Data published by Joyy Group

　　(Unit: Billion)

　　Difference

　　2019Q4

　　2.297

　　2.950

　　-22.1%

　　2019Q1

　　1.862

　　2.567

　　-27.4%

　　2019Q2

　　2.033

　　2.863

　　-29.5%

　　2019Q3

　　2.043

　　2.899

　　-29.5%

　　Huya data calculated by Bigone (Unit: Billion)

　　Data published by Huya

　　(Unit: Billion)

　　Difference

　　2019Q4

　　1.531

　　1.442

　　6.2%

　　2019Q1

　　1.539

　　1.553

　　-0.9%

　　2019Q2

　　1.918

　　1.922

　　-0.2%

　　2019Q3

　　2.045

　　2.156

　　-5.2%

　　An example of a third-party application monitoring service

　　Sensor Tower is one of the several analysis platforms commonly used by technology developers, analysts, and investors, and we use it for evaluation. These application analysis companies use data from Apple and Google Play Store, including rankings and user engagement, as well as internally developed algorithms to estimate revenue.

　　BuzzFeed reported that Sensor Tower has at least 20 applications that can track user mobile data. This information was secretly collected from millions of users who installed VPN and Android and iOS ad-blocking applications. These apps have more than 3,500 downloads. Although this is very inappropriate and violates user data privacy, we believe it is very likely to have improved the accuracy of its data and algorithms.

　　In the past year, we reviewed data from other third-party analysis services and observed that these data basically coincide with each other. The initial revenue used in our model is based on multiple data sources.

　　Appendix C Usage of Internal Network

　　Intranet: 100.64.0.0/10 & 127.0.0.1

　　In our transaction dataset, 0.03% of the transactions show local network IP 100.64.0.0/10 (100.64.0.0 – 100.127.255.255), and 0.002% of the transactions show local host network IP 127.0.0.1.

　　The IP address is 127.0.0.1, indicating it is a robot or controlled by Hanju Group servers. This is very unusual because the real users of YY Live are at home, in the office, or in public places, not on Hanju Group’s servers.

　　The IP address 100.64.0.0/10 is more interesting, within this range, we have 38,823 transactions (0.03%) coming from this IP address. As shown in the company’s 20-F filing, some of Hanju Group’s infrastructure (possibly all of it) is hosted by two cloud providers, Jinshan Software and Sunhongs.

　　This cloud hosting is important because we know that most cloud providers have specific instructions regarding the 100.64.0.0/10 IP address block, and it is used only for internal (cloud-in or enterprise network) communication. This means you cannot directly communicate with 100.64.0.0/10 IP addresses on the public network.

　　Netflix has introduced how they transferred their infrastructure to Amazon’s private cloud, as well as how they used the 100.64.0.0/10 network block during this process.

　　Amazon File:

　　https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Subnets.html

　　Microsoft File:

　　https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview

　　Google File:

　　https://cloud.google.com/vpc/docs/vpc#manually_created_subnet_ip_ranges

　　Jinshan has a clear statement indicating that the 100.64.0.0/10 address block cannot be used in their cloud services. Therefore, we have reason to believe that in this case, the IP address is not from Jinshan.

　　A reasonable explanation is that Hanju Group uses robots on their cloud infrastructure. When the VPN or external anonymous service is interrupted or has issues, their robots continue to submit transactions to YY.com through the internal network until the VPN service is restored. We also observed this situation in the data we collected, where the users’ IP addresses initially were public addresses, then jumped to Hanju’s internal network IP addresses, and finally returned to public IP addresses.

　　Figure: The situation when the VPN is enabled

　　Figure: The situation when the VPN is down