News

Enforcement Notice: Scammer Permanently Banned – And What Our Logs Actually See

A player has been permanently banned for scamming another player out of an item. Both accounts he was operating are closed. We are publishing the details because we want every player on this server to understand exactly how much we can see — and how little it helps to lie to us about it.

2
Accounts closed — one player, both permanent
11 → 0
Players who mailed him items — returned to none
121
Item transfers between his two accounts since 2023
12 days
From his last warning to this offence
100%
Of item movements permanently logged

What happened

A player lent a Charm of Apvas to the character RealEstatePH. It was sent by in-game mail, as a loan, with the understanding that it would come back. It never did. The borrower then blocked him.

The owner reported it to support with screenshots. We did not decide the case on those screenshots. We traced the item itself.

What our records show

📩
The Charm of Apvas was sent to RealEstatePH by in-game mail, and he claimed the attachment the same evening.
27 July 2026 · 7:35 PM

It was never sent back. Every reply he mailed to the owner — including one that read “master thank you lab u” — went out with all ten attachment slots empty.

🛡
That exact item is still equipped on his character. It was not lost, not sold, not consumed. He was wearing it when we banned him.

📦
He took a second item from the same player the next day, and used it up.
28 July 2026 · 6:01 PM

🔄
This was not one bad trade. He received mailed items from 11 separate players and returned items to none of them, while moving goods onto a second account he controlled.

He had already been sanctioned in July for an item duplication exploit he never reported. He was given a reduced penalty instead of a ban. Twelve days later he moved those same flagged items onto his second account and committed this offence.

He was running two accounts. Here are the actual records.

This is the part players assume we cannot do, so we are going to show you rather than tell you. He was not playing on one account — he was running a second account alongside it and using it to park and move goods. Both are now permanently closed, so there is nothing to quietly shift the loot onto and carry on with.

How we know. Every time an account logs in, our system records which device the login came from and which connection it used. This is ordinary login security — your bank does the same thing when it asks whether you recognise a new sign-in. It also means that two accounts played from the same phone are not a theory we have to argue for. They are two rows in a table with the same value in them.

These are extracts from that table, exactly as stored.

Exhibit A — the two accountsmaster.account
Account ID Characters
vilajoyce123 5072 RealEstatePH (98) · VirgilRas (85)
virgilras143 1373 VilaJoyceRas (113) · DodongTu (70) · DodongVirgil · DodongVirgilio
Note the names. The account vilajoyce123 holds the character VirgilRas. The account virgilras143 holds the character VilaJoyceRas. He named each account after the other one’s character.
Exhibit B — devices used by both accountslogin device register
Device Device fingerprint vilajoyce123 virgilras143
Redmi Note 12 7968db47bb22dbc2e90f3d22411e183e 14 logins 86 logins
OPPO A18 4d131ca035c58fced68c7a1f24968eda 5 logins 23 logins
Pixel ffb1309733555e01a5e74b0804fddf51 5 logins 487 logins
Not one shared phone. Three — and the fingerprint is identical, not similar.
Exhibit C — login log, 12 April 2026raw rows, unedited
Row Time Account Device Fingerprint IP address
161156 04:35:17 vilajoyce123 Pixel ffb13097…fddf51 162.128.41.120
161157 04:35:31 vilajoyce123 Pixel ffb13097…fddf51 162.128.41.120
161459 08:17:11 virgilras143 Pixel ffb13097…fddf51 162.128.41.120
161461 08:17:32 virgilras143 Pixel ffb13097…fddf51 162.128.41.120
162110 13:49:01 virgilras143 Pixel ffb13097…fddf51 162.128.41.120
162600 22:47:26 virgilras143 Pixel ffb13097…fddf51 162.128.41.120
One day. One phone. One internet connection. Both accounts. Row IDs are sequential in our log, so these rows sit exactly where they should — nothing was inserted after the fact.
Exhibit D — login log, 8 June 2026raw rows, unedited
Row Time Account Device Fingerprint IP address
206688 06:03:57 virgilras143 Redmi Note 12 7968db47…e183e 110.54.222.169
206699 06:11:37 vilajoyce123 OPPO A18 4d131ca0…68eda 110.54.222.169
206707 06:17:13 vilajoyce123 OPPO A18 4d131ca0…68eda 110.54.222.169
207167 11:12:42 virgilras143 OPPO A18 4d131ca0…68eda 110.54.222.169
207259 12:02:52 virgilras143 Redmi Note 12 7968db47…e183e 110.54.222.169
He switched handsets during the day and the log followed him. In the morning vilajoyce123 is on the OPPO A18; five hours later virgilras143 logs in from the same OPPO A18, on the same connection. A sibling with their own phone does not produce this.
Exhibit E — the item itselfitem store · mail · equipment
Record Value
item template 503543 — Charm of Apvas
item object ID 3158463149
mail #319904 — from [reporting player — redacted]
mail #319904 — to RealEstatePH
attachment claimed yes
claimed at 2026-07-27 11:35:51 UTC  (7:35 PM PHT)
currently in container 3758304268 — RealEstatePH, main equipment
currently in slot 30 — equipped
The same object ID that arrived in his mailbox on 27 July is the object ID sitting in his equipment slot today. It is not a similar item or another copy — it is that one.

“So I’ll just reset my phone.”

You can. It will not save you, because the device register is only one of the things we read — and it is the easiest one to lose.

The item trail does not reset. These two accounts passed items back and forth 121 times between 2023 and last week — the same two mailboxes recycling one thread for three years. 42 minutes after he claimed the borrowed charm, he moved 16 items between the two accounts in under three minutes, and among them were the exact weapons flagged in his earlier duplication case, matched by object ID rather than by name. That pattern lives in the item log, not on your handset. A new phone does not erase it, a new account name does not erase it, and it keeps accumulating every time you move something.

Wiping a device only means we identify you the slower way.

Why “that wasn’t me” does not work here

Every item on this server carries a unique ID. Every mail, every trade, and every equip is written to a permanent record. We do not settle these cases by deciding who sounds more convincing — we read the log.

We can see which account is holding an item right now. We can see the exact second it changed hands. And we can see which accounts belong to the same person, no matter what name is on them.

“That was my brother.” “Someone else used my phone.” “I never got it.” “The server bugged and ate the item.” We hear all of these. None of them change what the record says, and the record is what we act on.

If you are running a second account to hold what you take from people, understand what that actually buys you: when we close the first one, we close that one too, in the same action.

Three things every player needs to know

1 — Scamming is a permanent ban. There is no points ladder for it.

It is not reduced for a first offence, for an apology, or for handing the item back once you are caught. Every account belonging to the offender is closed along with it, and any new account we trace back to the same person is closed too.

2 — We do not support middleman trades, lending, or borrowing.

Support will not broker, hold, witness, or guarantee a deal between players. If you make that kind of arrangement, you are doing it entirely at your own risk.

3 — Scammed items are not returned. Not even when we ban the scammer.

Once you hand an item to another player voluntarily, we do not reverse it — even when the other person acted in bad faith, and even when we permanently ban them for it, as we did here. This is not us being harsh with one player. If we replaced every item lost to a bad deal, we would be minting gear into the economy every week, and every honest player on this server would pay for it in devalued items.

The ban is the remedy. The item is not.


If someone asks to “borrow” your gear — even a guildmate, even someone you have played beside for months — the honest answer is no. Once it leaves your inventory, we cannot get it back for you.

Report scams to support with as much detail as you can give us: character names, rough dates and times, and what was taken. We will trace the rest. We would much rather ban the right person quickly than argue about screenshots for a week.

We do not publish player records lightly, and we do not publish the names of players who were scammed. We are publishing this one because the deterrent is worth more to the server than the offender’s privacy.

Tantra: The Lost Codex — Game Integrity ← All news