WarErZA Investigation Uncovers Coordinated Brazilian Account Cluster

YOUR. VOICE. MATTERS.

“The Coordinated Brazilian Account Cluster”

AN ANONYMOUS TIP

What began as a tip from a confidential source has developed into one of the more concerning account-activity patterns WarErZA has investigated.

A few days ago, the Newsroom was approached with a simple allegation: that a number of Brazilian accounts may be operating in coordination and potentially being used to generate resources and donations, particularly around major Brazilian battles.

The source could not prove the allegation, and neither can we at this stage.

What we can show, however, is a pattern of behaviour unusual enough that we believe it warrants an investigation by WarEra staff.

Our investigation has identified a core group of six accounts:

https://app.warera.io/user/6a39ff630e35d3def9410747
https://app.warera.io/user/6a2ae36940574430efe62b6c
https://app.warera.io/user/6a395ca2cbc8c33437743051
https://app.warera.io/user/6a3b1c710c041a145e26a230
https://app.warera.io/user/6a599a311e131ac76021e5a5
https://app.warera.io/user/6a585a495d39bcb5ecbba402

Publicly available data shows repeated similarities between these accounts in their companies, transactions, activity patterns and donations.

The evidence does not prove that these accounts are controlled by a single person. Determining that would require information unavailable to ordinary players, including IP addresses, devices and authentication-session records.

What the public evidence does show is extensive coordination.

IDENTICAL COMPANIES

One of the first things that attracted our attention was the companies owned by the accounts.

Four of the six: F39_Gripen, Guaxinim, Petrobras and Lalatina, each operate an identical portfolio of ten industrial companies:

1 Concrete
4 Iron
1 Limestone
4 Steel

Guarani and NAe_Sao_Paulo each operate an identical eight-company variation:

1 Concrete
3 Iron
1 Limestone
3 Steel

Every one of these companies uses the game's default company names, however, that alone proves very little. Plenty of ordinary players never rename their companies. The unusual part is what happens when the company structures are combined with the timing.

On several occasions, multiple accounts created the same types of companies within minutes of one another. On 30 June, for example, Lalatina, F39_Gripen, Petrobras and Guaxinim created companies within a fourteen-minute period. Similar bursts occurred again in August and September.

THE TRANSACTION FINGERPRINTS

The strongest evidence comes from the accounts' transaction history.

Investigators compared transactions using what we have called a "transaction fingerprint": the exact transaction type, whether the account was buying or selling, the item involved, its quantity and the exact BTC amount.

The six-account cluster produced 2,271 qualifying events.

Of the 28 possible account pairings examined, 23 repeatedly produced identical transaction fingerprints on at least three separate dates.

For comparison, the eight most active accounts in a control group produced more than twice as many transactions: 4,637 events, yet only 10 or 11 of 28 account pairings crossed the same threshold. The most extreme pairing, F39_Gripen and Lalatina, produced matching transaction fingerprints on 32 separate dates. The highest result among the comparison accounts was 13.

Investigators also identified 71 occasions where at least three suspected accounts shared the same transaction fingerprint. The comparison group produced four under the primary method.

Examples include six accounts purchasing exactly one Steak for exactly 3.749 BTC within thirty minutes of one another, and another occasion where six accounts bought one Steak for exactly 3.738 BTC within a 31 minute period.

Being online at similar times is normal, but repeatedly buying or selling the same item, in the same quantity, at the same price, in the same role, across multiple accounts and across many different days is considerably harder to dismiss.

3810 BTC IN SEVENTY MINUTES

Then came 10 September. During Brazil's resistance battle against Liberia, four of the accounts became active one after another:

• F39_Gripen operated between approximately 17:56 and 18:00 SAST.

• Petrobras followed between 18:04 and 18:06.

• NAe_Sao_Paulo appeared between 18:33 and 18:36.

• Guarani was active between 19:06 and 19:10.

Each account performed broadly similar economic routines involving wages, market activity, crafting or dismantling and other transactions. These routines were followed by a pattern of donations:

• F39_Gripen donated six separate amounts of 200 BTC.

• Petrobras donated four counts of 200 BTC.

• NAe_Sao_Paulo donated three 200 BTC payments alongside a 5 BTC donation.

• Guarani donated six 200 BTC payments alongside another 5 BTC donation.

In total, the four accounts made nineteen separate 200 BTC donations and two 5 BTC donations: 3,810 BTC in approximately seventy minutes. Again, donating to your country during a battle is obviously not suspicious by itself, Brazilian citizens donate heavily during wars.

In fact, the wider investigation found that Brazil received 76.4% of all observed donated BTC during battle periods. The repeated sequence of similar account activity immediately surrounding the donations is most concerning.

THE KROIS CONNECTION

The investigation also repeatedly encountered the Brazilian player https://app.warera.io/user/6998fbf5abdf5405eddf98db. Krois's public profile showed 612 referrals at the time evidence was collected. More importantly, four accounts from the cluster: Guarani, F39_Gripen, Guaxinim and Petrobras, received wage transactions from Krois during the period investigated.

That does not mean Krois controls the accounts. Receiving wages from the same employer is perfectly legitimate gameplay.

Initially, we were unable to independently confirm claims regarding exactly which accounts Krois referred. The game's authenticated referral interface returned blank results during testing, including when investigators tested their own profiles, while the referral API denied access.

We later managed to get it working, and uncovered all of the publicly accessible data relating to Krois’s referrals, which is detailed below.

THE KROIS REFERRALS

We used a script to investigate all 612 direct Krois referrals identifiable in the public referral atlas⁠ as of 26 July. Current profiles and company records were successfully retrieved for all 612 through the public gateway⁠.

In the “younger” cluster: Guaxinim, Petrobras, Lalatina, Guarani and NAe_Sao_Paulo are confirmed Krois referrals. Every possible pair showed matching transactions across at least three dates. With behaviourally linked F39_Gripen included, all 15/15 pairs matched repeatedly, with one pair matching across 19 dates. F39 is not shown as a Krois referral.

In a discovered “older” cluster: https://app.warera.io/user/69a26f6cc1ef4e5a170cc197, https://app.warera.io/user/69bc841eb557789e5f6a9544 and https://app.warera.io/user/69c7d7b5cde5836cb7d84614 have identical 11-company industrial portfolios with default company names. https://app.warera.io/user/69b372cacbf2b5c108797217 has a close variant. All 6/6 account pairs showed recurrent matching activity, plus 13 instances involving at least three accounts.

Examples include three accounts purchasing one Steak at the same price within 8.7 minutes, several three-account 5 BTC donation groups within 14-29 minutes, and three accounts buying 150 Light Ammo for 26.250 BTC within 40.7 minutes.

No additional cloned multi-company groups were found among the remaining referrals.

An overview of Krois’s referrals gives the following statistics:

• 337 generated usernames.

• 415 unverified emails.

• 537 absent for more than 30 days.

• 472 have exclusively default-named companies, although these are mostly ordinary one-company starter accounts.

• 71 referrals made 2,034 Brazilian donations totalling 119,894.136 BTC, representing 48.6% of the captured donation value.

• https://app.warera.io/user/69a8a6f276163617bc6bc475 donated 27,455 BTC and then became inactive, but is a developed level-36 account. That warrants checking but does not resemble a disposable shell. It is more likely a player that quit the game and donated everything they owned.

The complete company pass of Krois’s referrals found 472 accounts whose companies all retained default names. Most were ordinary single-company starter accounts. Only eight confirmed direct referrals had at least four companies and an all-default industrial-only portfolio, and they were exactly the two Krois-linked groups in the register.

We believe this shows strong evidence of coordinated behaviour in two specific clusters, but no public evidence proving common ownership, automation, or that all 612 referrals are multis. That is highly improbable.

AND THEN THEY DID IT AGAIN

While this article was being drafted on 12 September, Brazil entered another battle. That gave the Newsroom an opportunity to watch the accounts in real time.

This time there was no enormous donation burst. Guaxinim donated 5 BTC, Petrobras another 5 BTC and Lalatina 15 BTC. Together, suspected accounts accounted for only 25 BTC — approximately 1.72% of the 1,451 BTC Brazil had received since the battle began.

If anything, that makes what happened next more interesting. All six core accounts became active sequentially:

Guaxinim: 13:36–13:40
Petrobras: 13:43–13:47
F39_Gripen: 13:54–13:56
Lalatina: 14:22–14:25
NAe_Sao_Paulo: 14:44–14:46
Guarani: 15:10–15:12

Each completed a short session containing remarkably similar behaviour, collecting wages, performing market actions, crafting or dismantling, and then fighting. All six produced almost exactly the same number of attacks, between 20 and 23 hits each. Together they made 132 hits and 25,976 damage.

Four of the six accounts,  Guaxinim, Petrobras, F39_Gripen and Guarani, also received batches of exactly ten wage transactions from Krois during these sessions. The behaviour closely resembled the serial activity documented two days earlier.

This still does not prove common ownership, however, it makes the earlier sequence considerably harder to dismiss as a single coincidence.

WHAT WE ARE NOT CLAIMING

There are several important limitations to this investigation.

• We found no direct market trades between members of the main cluster.

• Default company names are common.

• Industrial company setups can naturally become similar when players follow the same economic advice.

• Donations during battles are normal.

• Players in the same military unit or community can naturally perform similar actions.

• And most importantly, public information cannot tell us who is sitting behind a keyboard.

There is currently no evidence establishing Brazilian government involvement, nor can public transaction records demonstrate that these donations were subsequently used to fund specific mercenary contracts.

This article therefore does not accuse the six accounts, Krois, the Brazilian government or any other player of proven multi-accounting. After all, correlation does not equal causation. But we do believe that the correlation should be investigated to put these concerns to rest.

Whether that coordination represents several players working together, automation, shared accounts, approved arrangements, or one individual controlling multiple accounts is something only WarEra staff can determine.

WHAT HAPPENS NOW?

WarErZA has prepared a separate evidence package for WarEra staff.

We are requesting that staff examine IP history, device and browser fingerprints, authentication sessions, account-switching timestamps, referral records and any registered family or shared-IP arrangements associated with the accounts. We believe particular attention should be paid to the account activity surrounding the 10 September sequence.

The intention is not to demand bans outright, but we are asking the people who actually possess the information necessary to determine account ownership, to look at the evidence.

The investigation's conclusion is therefore simple:

We cannot prove these accounts are multis.

But after thousands of transactions, identical company structures, recurring transaction fingerprints, sequential account activity and two separate live examples of remarkably similar behaviour, we believe there is more than enough evidence to ask WarEra staff one question:

Who is actually operating these accounts?

This is a joint article, written and contributed to by the whole of the WarErZA newsroom. I would like to personally thank:

https://app.warera.io/user/69f72b433d641e9efdbea2cf

https://app.warera.io/user/68e538c09c4aafa6f1a0bd5c

https://app.warera.io/user/6a4ceaa74501d0b090a1afa1

DISCLAIMER: As editor in chief, any scrutiny, complaints or overall dissatisfaction is to be directed at me. The staff of the Newsroom all operate under my responsibility. As such, I take full accountability for any and all articles posted.

Thank you, and remember:

YOUR. VOICE. MATTERS.