Former Cheat Outs Bot Rings Plaguing High-Stakes Online Poker HUSNGs

  • Online poker bot user outs others using illegal software to cheat high-stakes online games
  • At least five prominent networks claimed to be infected by cheating rings' activity
  • Vengeful cheat posts lengthy chats with developer, including strategies for escaping detection
male playing online poker
A forum poster has outed a large-scale bot ring operating on many of the world’s largest online poker sites. [Image: Shutterstock.com]

Bot rings may infest ‘hyper’ variants of HUSNG format

A one-time participant in a form of online-poker “bot” cheating targeting high-stakes heads-up sit & gos (HUSNGs) has published a YouTube video busting open one — if not several — bot rings participating on many of the world’s largest sites.

The video and accompanying post on TwoPlusTwo.com, a prominent poker discussion forum, also detail some of the technical methods the rings’ players used to evade detection by the sites.

busting open one — if not several — bot rings participating on many of the world’s largest sites

The postings quickly raised heated debates, and the fallout is likely to increase public pressure on online poker sites to dedicate more resources to combat the ongoing bot issue.

Two-device setup helped evade detection

The unidentified player posted screenshots of a two-device setup in action on several different online poker sites.

The setup, in which a primary computer was connected to the targeted online poker site, then also output a live video stream to a second computer. That second computer was equipped with optical character recognition (OCR) to read the poker play in real time, then moved the deciphered info into decision-making software that recommended the appropriate action to the bot-using player.

Many poker sites’ detection methods can ‘sniff’ the existence of attached secondary computers, but the video posted showed how these cheaters had already created a workaround. This involved using stream-splitting technology readily available online, coupled with a hidden, centralized database of optimal solutions for most situations.

The poster did not identify himself publicly, thus leaving vengeance over a probable failed business deal as the likeliest motive for outing the other cheats. Most of many dozens of text exchanges between the poster and other participants date from October of 2017.

Among the final posts are a contract between the poster and the bot’s developer, Sergei Radulov (it’s unknown if this is an alias), that shows some of the terms of the deal. The bot software, including the OCR translator, cost $25,000, plus 25% of the profit earned through its use.

Though seemingly exorbitant, the videos show that the software was being used at the highest stakes offered for hyper and turbo heads-up sit & gos on many sites, ranging from $50 to $2,000 each for just a few minutes of play.

Radulov explaining several tactics for helping to evade detection as a bot operator if problems arose

Heads-up SNGs have long been a focal point of bot-based cheating play; the simplified format has been largely solved advanced computing processes.

The lengthy chats between the poster and Radulov also found Radulov explaining several tactics for helping to evade detection as a bot operator if problems arose.

Names and locations published

Besides the software’s developer, Radulov, the poster also published numerous text exchanges with two online players, Martin Pung and “Ivan”, the player behind numerous high-profit “xrab” accounts on various sites.

The poster also published claims about several interrelated bot rings sharing the software and divvying up the online poker’s HUSNG world as territory for the bot rings’ participants to operate. The poster was also encouraged to participate in head-ups battles against other cheats, likely as cover for the larger operation.

The posted video shows or claims the software was in use on many sites and networks, including 888, partypoker, Winning Poker Network (WPN), Microgaming Poker Network (MPN), iPoker, and others.

The poster also claimed that xrab’s cheating on partypoker was done with the help of a team of Bulgarian players, who were posing as German players using a complex VPN (virtual private network) setup.

A partial list of account names claimed to be used by or linked to the xrab group includes: Doqch, xrabreneca, xtard, tratatuwk1, RBARX555, and homeless1 (all on WPN); SChoveka, iTakee, el0nmusk, xtardNo1, fivehumans, Saauron1, ToTheNeatYo, and homeless1 (all on partypoker); 5Choveka, Doqcha, itakee, el0nmusk, mnschwach, fivehumans, and Noqqx (all on 888); and TheSweatshop, xtardNo1, E10M4sk and Saauron12 (all on iPoker).

The video shows several of these accounts in action using the two-device cheat, thus supporting the claims.

None of the accused players nor affected sites have commented as yet regarding the allegations.