Network surveillance across every online poker app · game-integrity.com
We map colluding rings, bot farms, and chip-dumping clusters — and the overlaps between them — across the online poker ecosystem. Same-day evidence packets clubs and unions can act on, backed by cross-corroborated network graphs, not isolated flags.
Modern cheating in online poker is never two accounts. It is rings that shelter bot-run seats, farms that fund cash-out clusters, and clusters that reveal ring membership. We work the pattern behind the pattern.
Three, five, sometimes a dozen accounts playing as one — soft play, whipsaw raising, information sharing across seats. We fingerprint the ring as a whole, not just its loudest pair, and deliver the full membership list with corroborating evidence.
Coordinated bot networks share infrastructure, schedules, and stat fingerprints. We cluster them via behavioural velocity, device linkage, and stat stability — then map the winning nodes that fund the whole farm.
Multiple accounts funnelling chips into a single cash-out — a laundering typology regulators recognise. We reveal the entire cluster: sources, sinks, timing, and payment linkage that turns edges into named accounts.
Anonymised operating metrics from live surveillance. Every finding a club or union receives clears the same evidence bar — decisive, corroborated, and ready to action without waiting on an app operator's confirmation.
Minimum composite confidence before a network case is escalated for immediate action. Below that bar, cases stay under observation — never delivered as a soft flag.
Cases are graphed at the ring or cluster level. A single suspicious pair alone is not a case — it is a starting node for community detection across the pool.
Behavioural, financial, and technical evidence must all agree before an escalation leaves the review floor. Two-of-three is under-observation only.
From the analyst pressing Scan to a signed evidence packet in a club's hands — a typical high-confidence network case closes inside a day.
Our methodology is platform-independent. If the platform produces hand histories, transaction logs, and connection metadata, we can map its networks.
Evidence goes to the club or union that engaged us. Nothing is broadcast, and nothing is delivered to a poker app operator unless our client asks us to.
The evidence packet clubs can act on.
Every high-confidence case ships as a signed PDF: network diagram, member roster, confidence and evidence scores per family, corroborating chip-transfer graph, device and connection linkage, and the retained qualifying game IDs behind the finding. Clubs and unions have everything they need to remove the ring the same day — without needing an app operator to sign off on the decision.
Three anonymised cases from one review cycle. Read left to right they look like separate findings; read together they reveal a single operator wearing three different masks — a ring sheltering bot seats, a farm funding a cash-out cluster, and a cluster whose sources trace back into the ring.
Three cases surfaced independently. Cross-corroboration then revealed a single operator running all three — a colluding ring that sheltered bot seats, a bot farm that fed a chip-dump cluster, and a cash-out identity that laundered the whole operation. Under-observation cases become ban-ready when a second case corroborates the same account through a different signal family.
Overlap turns an under-observation case into a ban-ready one. A single account flagged in Case 02 by device linkage moves above the confidence bar the moment Case 01 corroborates it through behaviour, or Case 03 through chip flow.
A twenty-one-day trace of the review cycle that surfaced all three cases. Each stage names what a single, deliberate analyst action produced — and what it revealed about the account underneath.
A routine analyst scan on a client union’s mid-stake pool flagged a seven-account subgraph with fold-to-partner rates three-plus standard deviations above the baseline. Confidence closed at 88% — above the review floor, below the 90-percent ban bar. Case 01 opened.
A parallel device-and-connection scan on the same union produced a twelve-account cluster on shared GPU fingerprints, connection ranges, and profit-target session shapes. Behavioural stability across the cluster exceeded every human comparable in the pool. Case 02 opened at 92% confidence.
A graph join of Case 01 members against Case 02 device fingerprints returned two exact matches. Two accounts inside the ring were bot-controlled seats embedded to guarantee chip mobility. Case 01 confidence rose from 88% to 96% on cross-family corroboration — no fresh scan required.
A directed pot-level chip-flow scan across the pool surfaced a nine-source funnel converging on a single previously-unflagged cash-out identity. Source accounts shared no device links at the seat level, but the sink pattern was canonical. Case 03 opened at 91% confidence.
Joining Case 03’s source list against Case 02’s roster returned three exact account matches; a further join against Case 01 returned one. Case 03 confidence rose to 97%. The three cases were no longer three cases — they were one operator running three networks against the same pool.
A single evidence packet — network diagram, roster of 29 unique accounts, per-case confidence, chip-transfer graph, device-and-payment linkage — landed with the client. Every account, including the under-observation Case 02 siblings, was banned that afternoon and the cash-out sink’s funds were held.
A deliberate, analyst-driven workflow. Every scan produces network-scale candidates; only cases that clear the confidence bar leave the review floor.
Hand histories, chip flow, timings, device and connection signals — ingested from whichever poker app the club or union operates on.
An analyst configures history window, minimum shared games, evidence score, and result limit, then presses Scan. Deliberate execution, no autonomous sweeps.
Community detection on the co-play graph surfaces candidate rings and clusters. Pairs are only starting nodes — cases are graphed at the network level.
Behavioural, financial, and technical signal families are scored independently. All three must agree at confidence-tier weight for escalation.
A signed evidence packet — network diagram, roster, per-family scores, retained game IDs — goes to the club or union. They ban on that packet the same day.
Three independent signal families feed a single composite confidence score. Cases only leave the review floor when all three agree and the composite clears the 90-percent bar.
Two of three family agreement produces an under-observation case, not a delivery. All three, over the confidence bar, produces a signed packet the club can act on immediately. Where an account appears in more than one open case, cross-case corroboration counts as an additional family — under-observation findings can flip to ban-ready without a fresh scan.
A decisive posture built on high-confidence evidence, applied consistently across every poker app.
Cases only leave the review floor above the 90-percent confidence bar. Below it, we observe. Above it, the evidence is decisive enough to ban without waiting on an app operator's confirmation.
A single suspicious pair is a starting node, not a case. We graph the whole ring, farm, or cluster and deliver the full membership list — cutting the network's edge, not one of its seats.
We work with whichever platform the club or union operates on. Our detection is built on hand histories, chip flow, and connection metadata — not on any single vendor's cooperation.
Evidence packets go to the club or union that engaged us, and to no one else. Nothing is disclosed to a platform operator unless our client instructs us to.
game-integrity.com
Game Integrity Surveillance builds ban-ready evidence packets clubs and unions can act on without waiting — across every poker app in the ecosystem.