Home → Network & Skins
Developer / research breakdown
The IDN network and agent system: where bots and collusion fit
In one paragraph: IDN licenses one poker platform to many independent operators. Each operator runs a branded skin with its own cashier and support, but all skins share a single player pool and settle money through a tree of agents and sub-agents. Automation on IDN is therefore less about a lone super-bot and more about networked collusion — multiple seats, coordinated through the agent chain, that share information and move chips toward one account. Understanding that chain is the key to understanding both the threat and its detection.
1. The platform-and-skins model
The entity commonly called "IDN Poker" is the platform vendor. It owns the game servers, the random number generator, the wallet ledger, and the mobile clients. It does not, in the usual sense, run a consumer poker room itself. Instead it sells a turnkey licence to independent businesses across Southeast and East Asia. Those businesses are the operators, and the product they put in front of players is a skin.
A skin is a thin brand wrapper: a name, a logo, a cashier flow, a support channel, sometimes a slightly reskinned app. Behind the wrapper, the poker itself is identical across skins because it is the same platform code talking to the same servers. Two players who downloaded different apps, from different agents, under different brand names, can be dealt into the same hand. This is the property that makes IDN attractive to operators — instant liquidity — and the property that makes anti-bot work hard, because the player pool an attacker can reach is the union of every skin, not one room's user base.
2. The agent system: how money actually moves
On a Western site, you deposit with a card or e-wallet and the operator holds your balance. On IDN, the cashier is largely human. Players acquire chips from an agent; agents acquire from master agents or directly from the operator. The hierarchy looks like a multi-level distribution tree:
| Layer | Role | Holds | Settles with |
|---|---|---|---|
| Operator / skin | Runs the brand, books rake | Platform credit line | Master agents |
| Master agent | Wholesales chips, sets sub-limits | Bulk chip credit | Agents |
| Agent | Onboards players, handles cash-in/out | Working float | Players + master |
| Player | Sits and plays | In-game balance | Agent (off-platform) |
Settlement between layers usually happens off-platform: local bank transfers, e-wallets, or messaging-app coordination, often netted at the end of a cycle rather than per transaction. The platform tracks chip movement as ledger entries; the agents track the real money. This separation is deliberate and is the commercial heart of the model.
For a researcher it has one enormous consequence: identity on IDN is agent-shaped. A player is not primarily an email and a card — they are a node under an agent. Accounts that share an agent are financially linked whether or not they ever sit together. That linkage is the thread detection teams pull.
3. Where bots fit
Because clients are mobile and there is no public API, single-account bots on IDN are built with the same toolkit used against any Android app: emulators or rooted phones, screen capture for board state, OCR for cards and stacks, and synthetic input through an accessibility service or a low-level touch driver. A solver or a precomputed strategy chart drives the decisions. None of this is special to IDN; what is special is the environment it runs in.
3.1 Single-seat automation
A lone bot grinding small stakes is the least efficient way to extract money from an agent network, and the easiest to catch. It produces a clean behavioural signature — inhuman timing consistency, a win-rate that drifts away from the field, perfect multi-tabling — and it gains nothing from the network structure. It is the threat people imagine and the least important one in practice.
3.2 Networked collusion — the real model
The structure rewards coordination. Suppose one operator controls ten accounts, onboarded through two or three friendly agents, spread across several skins so they look unrelated at the brand level. Bring them to the same tables in the shared pool and you can:
- Share hole cards. With several seats reporting their cards to one brain, the colluding side plays with partial-information advantage that no honest player can match.
- Soft-play and squeeze. Colluders avoid raising each other and gang up on the lone outsider (the "fish"), shaping pots in the group's favour.
- Chip-dump. Funnel value toward one designated account, then cash that account out through its agent — a clean exit that also doubles as a money-movement channel.
Collusion is older than bots, but automation industrialises it: the bots never get tired, never misplay the agreed strategy, and can run far more tables than a human ring. On a shared-pool agent network, this is the dominant integrity threat, and it is why "is there a bot at my table" is the wrong question. The right question is "is this group of seats coordinated, and do they share a settlement path?"
4. How the same structure makes it traceable
The agent tree that makes collusion convenient is also a detection gift. Honest players who meet at a table almost never share an agent, a device fingerprint, and a money flow. Colluding seats tend to share at least one, often all three. Detection on IDN-style networks therefore leans on graph analysis over three overlapping signals:
- Money graph. Which accounts settle through the same agent or master agent, and do chips consistently flow toward one node?
- Table graph. Which accounts appear together more often than chance, and do their decisions correlate (folds to each other, joint pressure on outsiders)?
- Device graph. Which accounts share an emulator fingerprint, a build signature, a sensor profile, or an IP/ASN pattern (the subject of the Mobile Client Security page)?
When two or three of those graphs overlap on the same cluster of accounts, you have a colluding ring with high confidence — far higher than any single-hand "that play looks like a bot" heuristic. The practical defence on an agent network is not perfect per-hand bot detection; it is cluster detection plus agent accountability.
5. Accountability sits with the agent
One last structural point. Because players are onboarded and funded by agents, an operator's strongest lever is not banning individual accounts — those are cheap to recreate — but holding the agent responsible for the players beneath them. A master agent whose subtree keeps producing colluding rings is a liability the operator can cut off, and that pressure flows back down the tree. The economics of who-vouches-for-whom end up doing as much anti-bot work as the technical detection does.
Summary
IDN is a shared-liquidity platform fronted by many skins and funded through an agent tree. Bots run here, but the structure pushes the real threat toward automated, networked collusion rather than lone super-bots — and the same agent and device structure that enables collusion is what makes it detectable through overlapping money, table, and device graphs. The next article goes down to the device: what a mobile poker client actually checks before it trusts you.
