More behind the scenes (part one)

(I've had to split this blog post into multiple parts because of its lengthiness. Additional parts will be coming up soon.)

What I would like to show you is the process that we go through when an account becomes suspect of cheating on Rescreatu. The first clue usually comes about when we are doing our daily reviews of the logs, and come across something like this (click for full size):

The arrows indicate transfers that cause suspicion. In this particular example, the red arrows are all transfers between the same two accounts, and the green arrow is a transfer between two accounts which are already known to be separate users who are not cheating. Whether or not the users making the red arrow transfers are cheating or legit is not known yet, so next, we check out the profile for "immediate" clues (click for full size):

In this example, the username displayed on the profile is the same as another username that has registered on the same IP address. Both are blocked out in red. However, these were not the usernames involved in the suspect bank transfers. Another username that was registered on the same IP address was the one involved; it is blocked out in purple. It is now time to dig deeper. We compare the transfers of each account in relation to the other. I am not going to post screenies of that part here; what was revealed indicated that everything gained in two of the accounts is being transferred regularly to only one account. At this point, experience tells me that cheating is happening, but just to be sure, more digging is necessary. The next step is to take a look at the login history (click for full size):

All but the last two digits of the user ID have been blocked out, so that you can see there are indeed three different ID's involved here. The second blacked-out column is IP addresses. The third column shows the date and timestamp that the login was attempted. As you can see, all three accounts involved were logging in and out of each account repeatedly, mere minutes or even seconds apart. The times that they logged in and out coincide with the times they sent items, pets, and TU from the spare accounts to the main account. The example only shows logins from one date, but the entirety of the login history shows the same pattern. This is the final proof needed in this case; cheating has definitely occurred and a ban is issued.