Today, we are looking at possibly the largest multilog investigation that has taken place in the Club Penguin Armies organisation. Unlike the ones of the past four years, this one took place outside of the CPA: Battleground. 

Note about the title: The Templars’ historical capital is Jerusalem; that’s why it was used in it. The server is currently possessed by the Water Vikings after a war between the two armies.

Incidents supporting multilogging allegations

Ever since near the beginning of the year, the Templars have been using Club Penguin Journey more and more. Multiple armies, if not most, have done the same in the past two years, so it was an expected move. However, Templars CPJ events first got into the spotlight when they maxed over 100 in one of their events. Initially, this was thought to be size hyperinflation using rogue troops. Armies in general max more in CPJ than they do on CPA: Battleground, since the first has a sufficient player base that helps armies attract people outside of the army community in their events. Armies like the Army of Club Penguin and the Rebel Penguin Federation have both had high maxes at times in CPJ, but they supported that in CPAB too by having 100< maxes there too. 

In the same week as the 109 max, TCP held 2 events on CPAB, maxing 25.5 on average in them, while having a 53.67 max in CPJ over 6 events. This raised questions, as the CPAB and CPJ sizes did not agree at all. The same pattern continued for the next 17 weeks. There were three exceptions to that: during the March Madness and TCP anniversary, with TCP average weekly CPAB sizes surpassing the CPJ ones twice and being close to it a third time. This trend raised further suspicions, but at the time it was mostly believed that there was rogue exaggeration. All of this happened before the new Top Ten Regulations were released, so it was believed Templars were just heavily using rogues to boost their Top Ten ranking.

The ACP Post

Near the end of April, the ACP declared war on TCP, spanning both CPAB and CPJ, and began by raiding one of the TCP events and raising patrols. 

While there are many things to talk about when it comes to that war, most are irrelevant to the current case. What is relevant and important is that about a month after the war had begun, on June 9, after ACP had raided, or tried to raid, the Templars a few times, it released a large post. 

Alongside other things in that post, they also raised multilogging suspicions when it came to the Templars’ events. They were divided into two parts, one for CPAB and one for CPJ. The CPAB ones had already been mostly investigated before the post became public. What was not looked at already was investigated, and there were no signs of multilogging.

TCP has had a bad habit of having common accounts for troops and veterans who don’t have CPAB accounts or have lost them, which ends up making investigations more time-consuming and easier to raise suspicions against them. It is notable, though, that account sharing has been less common in TCP lately, as they themselves understand the risks that come with it. 

Club Penguin Journey Multilogging

The last part of the ACP post is where the Club Penguin Armies administration focused the most. ACP presented what they believed was clear proof that multilogging had occurred in CPJ by TCP. They also included a lengthy video from their raid where the troops’ behaviour can be seen. From the video and the screenshots, it indeed appears that there were many multilog alts present in the raid. Many behaviours suggest most of the P accounts were alts. To begin with, ALL chatbar penguins were P accounts. Without the CPJ feature that makes the chatbar transparent and removes the User Interface, this would not be visible. As expected, in their posted event pics, the chatbar isn’t removed in an attempt to hide the P penguins. Those penguins are posted in a way that their names are mostly not visible. Only 4- 5 P-number penguins can be seen. 

At the same time, through the video, the suspicious P-number movements can be seen. The accounts seem to be doing tactics one by one, which is another multilogging sign. 

The numbers of the P accounts were also interesting. They were often close in number to each other. Additionally, they remained as P users on purpose, as weeks, and even months in some cases, had passed since the accounts were created. Normally, accounts get verified and receive their name instead of the P numbers much quicker. 

Aside from that, ACP checked the stamps of some of those accounts, and they barely had any, increasing the multilog suspicions. 

A few days before they published the post, ACP conducted their own investigation and looked at the Templars’ events from April 28 to May 22 in order to check the suspicious Templar P accounts. They found out that many of those accounts were still wearing the Templar items from the last event they had attended. Below, the ACP findings can be read. 

Pnumbers | Events attended | Notes

If they have nothing, means they look like normal players and their names have been approved.

If there is a name, it is because it is verified AND relevant.

Notes section key:
No Name = The username hasn’t been approved.
Beside No Name = Items they’re wearing.

P431706 – 1 – (random 1-2 items)
P569171 – 1 – (no name)
P718089 – 1 – (no name, random 1-2 items)
P725231 – 1 – (no name, random 1-2 items)
P725336 – 2 – (no name, green + 🌈 fan)
P733089 – 7 – (no name, popcorn)
P739055 – 9 – (no name, popcorn)
P741397 – 10 – (no name, shrimp lei)
P745867 – 7 – (no name, mop)
P773145 – 1 – (no name, no clothes)
P784267 – 1
P794057 – 1
P812989 – 3 – aileecat (red normal outfit)
P821722 – 1 – (no name, green)
P831706 – 9 – (no name, popcorn)
P831708 – 9 – (no name, popcorn)
P831722 – 11 – (no name, popcorn)
P831730 – 9 – (no name, popcorn)
P831739 – 1 – (no name, blue +no items)
P834708 – 1 – (no name, pink +no items)
P841882 – 2 – (no name, casual outfit)
P845685 – 1 – (no name, random 1-2 items)
P845885 – 9 – (no name, popcorn)
P860639 – 1 – Penguin doesnt exist (?)
P860659 – 2 – Penguin doesnt exist (?)
P860720 – 1 – (no name, greem + big hat)
P875891 – 9 – (no name, popcorn)
P888872 – 1 – (no name, cece hair +yellow)
P891717 – 9 – (no name, popcorn)
P891723 – 9 – (no name, shrimp lei)
P891730 – 1
P891732 – 2 – (no name, popcorn)
P892979 – 2 – (no name, looks normal)
P893888 – 2 – (no name)
P894718 – 1
P897326 – 1
P898697 – 1
P900427 – 1 – (no name, red +no item)
P901489 – 1
P902764 – 1
P903329 – 1
P904165 – 1
P904629 – 2 – Templar Army (yellow+tuba)
P905719 – 1
P905987 – 1
P906761 – 1
P907305 – 1
P907364 – 1
P910176 – 1
P910985 – 1 – (no name, red +no item)
P911012 – 1 – (no name, popcorn)
P913171 – 1
P929662 – 1 – (no name, popcorn)
P930987 – 1
P934287 – 1
P870011 – At least 9 events attended – (no name, popcorn) – This penguin was initially missed, but added later on.

The only accounts that you can find in the Templar server are P900427, P841882, aileecat, P733089.

• Notice that the above list is referred to as the “ACP list” in the rest of the post.

CPA Continuing the Search

After seeing this, CPA continued the research in mid-June, covering the P users that appeared in the events over the next two weeks after the ACP investigation ended, up to the time the ACP post was out. The results were concerning. 

Templars Post

After all that, TCP requested time in order to collect and provide evidence. They ended up releasing a post on July 6, after it was initially delayed. In their post, the Templars showed the stamps of as many P users as possible, as they claimed they had to add some of them as friends first, since they didn’t have them added, in order to show that they actually had several stamps. They presented the stamps of 9 accounts, all of them having more than 50 stamps, and one even having 104. 

At first glance, the Templars’ post looked like it could decrease the chances of multilogging having occurred. After some thought, though, it is concluded that the number of stamps does not matter at all in the investigation. In the time period between the ACP and TCP investigations, one account went from having 19 stamps to 86 and another one from 20 to 76. This proved that the multilogger could easily get more stamps quickly, in an attempt to “solidify” the accounts as actual users.

At the end of their post, the Templars accuse the ACP of trying to mislead their members and the community against them. They call the ACP investigation as biased and incompetent. At the same time, they claim they have no way to clearly prove that no multilogging has occurred. TCP also released two more posts against ACP but not with anything of value when it comes to the multilogging investigation.

Templar Army account

They presented both to the post and to the Administration all the information they had regarding the “Templar Army” account. It was an account they had no idea who owned it. While it was initially tied to Klombe, it was soon believed it was not actually his and that a different staff member was using the account. 

CPA continues its own investigation

July

During July, the investigation process slowed down, with the focus being partially diverted to the Legends Cup and Summer activities at that time, but with the investigation remaining active. CPA let things run naturally to be able to check how things would unfold, while collecting everything together and trying to pinpoint who the multilogger was. For this reason, at that time, some of the Templars’ events were monitored. During July, unlike the previous months, the suspicious P accounts no longer showed up in events. 

For example, in the above picture, we see 3-4 P users participating in the Templars event out of the about 28 people with leis/yellow color. More P users who look like actual rogues and have no multilogging indicators can be seen hanging around the event. Out of the P accounts, none can be found in the ACP list. In general, CPA kept an eye out for suspicious accounts popping up, but the Templars events seemed normal for the duration of July. It should also be noted that half of the Templars leadership, Sidie9 and Shallissa, were on break for the majority of the month of July. 

August

The CPA investigation continued through August, with older events being looked at as well, January-April ones. A chart was made with the data collected, which could be one of the strongest multilogging proofs, along with the ones in the ACP post. In the diagram, the x-axis shows the weeks in order (1 being the first week of the year, 2 the second, etc.) and the y-axis shows the average maximum size per week per CPPS. The blue line shows CPAB and the orange CPJ. In order to remove the chance of rogues being cancelled in the Top Ten Committee counting, the pure numbers were used, the ones TCP claimed originally. 

The Chart

With green markers there can be seen the March Madness weeks can be seen; with red, it’s the TCP anniversary week, where they only had 1 event, the anniversary one. The marker with light green in the CPJ line is the week the ACP raids took place, with TCP having 5 CPJ events and 0 CPAB ones. 2 weeks before, with a dark blue marker, is the week TCP declared war on WV, with TCP having 12 CPAB events. The 3 yellow markers are during the ATWC3 tournament, and the grey line is the week after the ACP post dropped. The last week, week 33, is the third week of August. Note that both of the times when the CPAB marker is above the CPJ one are in weeks when TCP held 1 CPAB event. 

Statistical Analysis

It can be clearly seen that after the ACP post, TCP’s number suddenly fell by 15 and hadn’t gone up again in the following weeks. It appears that till the sixth week, the CPJ line followed the CPAB one with some increase, which could be explained by the rogues, but after that the two lines separated. Apart from March Madness and the anniversary event, the CPJ line deviated from the CPAB one extremely. It is notable that during the week of the ATWC3 finals, TCP had 1 CPJ event and 1 CPAB event. One would expect the CPAB event to be very hyped given it is a tournament final. TCP ended up maxing 28 in the finals and 44 in their CPJ event, 1.57 times more. You could argue that it was single events, so they could just have been lucky. Yet, two weeks earlier, during the ATWC3 group stage, TCP had 2 CPAB events and 3 CPJ ones. In the 2 CPAB events, TCP averaged 14, a low number for a major army. In the 3 CPJ events, TCP averaged 55.67, which is 3.97 times more than what they averaged in CPAB.  

The chart raises the question of what the extent of the Templar multilogging was. Through the chart, the level of the situation was proven to be much larger than what was thought. 

It is also notable that the average of the average maxes per week from the second week of February (week 7) to the week of the ACP post (week 24) was 42.74 on CPJ and 26.43 on CPAB. At the same time, from week 25 to week 33 (the time when the chart was made), the CPAB average was 27.8, and the CPJ average was 30.33. 

This puts the intensity of the differences between Templar CPAB and CPJ events and the difference between before and after the ACP post. This led us to believe that there were 12 multilogs in each TCP event in CPJ on average, during the suspicious time frame. 

Taking a look at the timeline

Upon looking at the statistics, CPA rushed to interrogate the Templars’ leadership on the entire situation. Before we get to that, though, let’s take a look at whom the evidence points to when it comes to being the multilogger.  At that time, there were attempts to try and figure out the person behind the multilogging. Theoretically, the person who did that would have to attend events throughout the entire time from February to June, given the extended duration of it. All current leadership members of the Templars, apart from Ellie, fit in that timeframe. The suspicion was increased by the fact that Sidie and Shallissa attended almost all CPJ events the Templars held in February and late June. 

The picture above is from a Templars event almost 2 weeks after the ACP post had been released, in an event Shallissa attended. While the number of present suspicious accounts had been reduced, there were still two accounts that were featured and heavily discussed in the ACP and TCP posts. There are also two accounts hidden by the chatbar, which could also have been multilogs. 

The next day, 23/6, TCP had another event at the same time, with neither Shallissa nor any suspicious accounts attending, aside from Templar Army. All account names were visible in some event pics too, which makes that event less suspicious. 

Moving on to the next event of Templars, on 25/6 Shallissa was there again, and so were P831706, 891717, 891732 and many other P accounts, several of which were in the same corner. 

Again, the number of suspicious accounts in the image above is not as big as the ones that showed up in the previous months, an example of which will be shown later. 

Above, there is another event on 26/6, this time without Shallissa and without suspicious P accounts either. Templar Army is present once again (above CharlZero)

From there onwards, the same pattern persists. No Shallissa present, no suspicious P accounts present; only Templar Army shows up once in a while. The CPAB maxes pretty much agree with the CPJ ones as well around July and August. 

From February to June 22, there were barely any events where Shallissa did not participate. Only one was found in the event pics, which can be seen below:

Unfortunately, there weren’t many event pics from this event, which was held on 21/3, but from what we can see, there are no suspicious P accounts and no Shallissa either. TCP did not have extra event pics either. All of the above were proof that the Templars’ leadership was involved in the multilogging; what was unknown was the extent of the leadership’s involvement. This was kept in mind when dealing with the leadership. 

CPA – Templars talks

Initially, before going to the group chat, there were some discussions between JojoTeri and Ellie, Leader in Training of TCP at the time, who had joined Templars after the multilogging had begun and thus was the least likely member of the leadership to be involved in it. The discussion mostly involved verifying penguins from some old event pics, specifically from May and an event that was suspicious. In that event, there were 10 P users out of the 36 total max, 28%, with a large number of the P troops being in the ACP list too. 

The request was that as many participant names out of the 36 be verified and matched to Discord accounts. Not many were verified.

Then, on the same day, 27/8, the same request was sent in the CPA-Templars group chat for a different event pic, which also included many ACP suspicious accounts. 

In this event, the Templars leadership managed to verify only 12 penguins as TCP troops who are enlisted in the Discord server, out of the total of 50. 

The P-numbers user attendance issue

It should be noted here that the Templars leadership claims that it does not know who owns the suspicious P accounts on the ACP list. 

Friend list

So, of course, the leadership was asked how they explain these accounts showing up in multiple Templars events. A rogue could randomly stumble across 1 army event, maybe 2, but to attend 11+ events, you have to know about them and when they take place. Borapenguins claimed that the P users could be people without Discord who join the Templars’ events because they are “loyal rogues”. He claimed that they could track Templars members through their friend lists. This, however, does not explain at all how they are able to do tactics in-game, along with other holes in this theory. They would need access to the Templars Discord server to know about the tactics, formations, and room changes. 

Bora shared his friend list, and only 1 account from the ACP suspicious list matched the users in the friend list. From Shallissa’s pictures above, we can also see that she does not have the suspicious accounts added. Sidie had barely posted any event pics in the suspicious timeframe, so it is tough to talk about her when it comes to the friend list. In the very few event pics that she has sent, there can be seen two suspicious ACP penguin who she does not have friended, and no other suspicious accounts in the event pics. Many are hidden by the chat bar, though, so there may have been more present. 

Website

Aside from Bora, who claimed that the users joined via the friend list, Sidie and Shallissa claimed that the troops joined through the events tab. While the Templars did use that at some point, it has been left unused and not updated for a long time, and it also does not explain much regarding the suspicious activities of the P accounts. Especially during the two weeks when Sidie and Shallissa only attended half of the events, and the suspicious accounts followed them. They also said that the number of joins in the TCP Discord server through the website is a very small fraction compared to the total views. It would make sense that the number of people who followed the events tab would be small too, then. In addition, there were no comments on the TCP website regarding the event tab when it suddenly stopped updating, which decreases the already very low chances of people attending via the website info. 

Assumptions?

From this point onward, things escalated a bit. The TCP leadership called CPA’s conclusions assumptions. They were certain that no multilogging could be confirmed without concrete proof. The leadership seemed to rest on the fact that in CPJ, encrypted IPs cannot be matched like in CPAB, and activity cannot be tracked so easily. They claimed that there were suspicious patterns and coincidences but not definite multilogging. Their stance remained like this throughout the remainder of the investigation. 

When presented with the chart that was shown here further up, they claimed that they failed to convert the CPJ troops into CPAB ones, which is the reason why there was such a big difference between the CPJ and CPAB maxes. However, keep in mind that they were unable to verify more than 12 penguins in their max 50 CPJ event earlier. They were not able to give an explanation for the sudden CPJ drop initially. Then Sidie claimed that she was not there for several events due to being busy, which is what caused the CPJ drop. She claimed that TCP was very reliant on her for CPJ events. However, this does not explain the sudden drop in the Templar average maxes within one week, nor the disappearance of the suspicious accounts during her and Shallissa’s break. The leadership also claimed that the catalog did not have good items, and the CPJ party at that time ended, which is why the Templars’ sizes dropped. However, it is not the first time a CPJ party ends or a CPJ catalog changes, and there does not seem to be a drop like this, which mostly stabilised over the next several weeks. 

The Accusations

The Templars leadership denied all accusations that there was concrete evidence of multilogging when they were accused of it. They were trying to change the subject and divert the focus by spamming GIFs. They were also asked to verify troops from another event in May, which had multiple suspicious accounts from the ACP list. 

There can also be seen 8 P accs sitting together in the top right corner and the P….06 & P….08 sitting next to each other at the bottom. There can be seen a total of 19 P users in this max 44 event, 43% of the total troops, with several out of the 19 being featured in the ACP list. 

When the fact that P accounts disappeared after Sidie and Shallissa went on break was brought up in the group chat, they both responded with sarcasm. Bora claimed that it was Sidie’s friends who no longer show up because they wouldn’t like the event as she wasn’t there. Sounds like a plausible explanation for the unknown troops who are not on the Discord server and thus don’t know when someone is on break, along with everything mentioned earlier. The Templars’ response is pretty much the same once again, as seen below.

Conclusion

The investigation concludes with the following:

• The Templars multilogged CPJ events from the second week of February to the fourth week of June. A total of 20 weeks. Near the end of June, after the ACP post, the multilogging was toned down, with fewer accounts being logged in.
• The Templar Army account was a separate case from the main multilogging, possibly owned by Templar staff.
• The number of multilogs is estimated to be about 12 on average per event from February to the middle of June.
• A large number of the 83 CPJ events that TCP held from mid-February to late June included multilogs in it.
• The multilogs consisted mostly, if not at all, of P-number users.
• The multilogs only appeared in the events that Sidie and Shallissa were attending. When they were absent, the multilogs were also absent. Due to this, it is unknown how involved the entire leadership was, but at least partial involvement is certain.
• No multilogging occurred on CPAB.

CPA‘s reaction

Given the length and severity of the multilogging, CPA has decided to take a few measures to ensure that the community remains a fair space where unsportsmanlike behaviour that violates the community rules is not allowed. Notice that multilogging is a technical misconduct, which CPA has punished and keeps punishing, mainly via deductions. The case changes when map wars are affected, or additional misconduct occurs.

In this case, the Templars participated in two wars during the multilogging period. The first one was on CPAB and on the map, against the Water Vikings. Since there was no CPAB multilogging, the war is not affected. The second war against ACP was in the CPJ, but an off-map war. As an off-map war, it is once again not affected by CPA’s investigation.

Yet, for the multilogging as a whole, CPA has decided that the following will take effect for the Templars, which are all Top Ten related;

Going forward:

• 4 weeks of a *0.6 multiplier on Templars full points, applied starting this week
• a *0.4 multiplier on the sizes of all CPJ events that the Templars hold from this week up until December 5
• Rogue P accounts in TCP CPJ events will not be counted even if they fulfill the rogue requirements. They would have to be recruited in the army, or already be enlisted, in order to be added in the counted maximum
• Templars classification (Major/SM) will be decided based on the pre-multiplied size average of the events they host each week

In Retrospect:

• On the weeks that the Templar Army account shows up, from July onwards, TCP will receive a -1 deduction from the full points
• From the second week of February till the last week of June, all Templars’ size points will be reset and recounted. Event points will not be affected. The following formula will be used to estimate the actual Templars’ sizes, while all CPJ maxes in that time period will be wiped;
  (a1*n1+a2*n2+a3*n3)/(n1+n2+n3), where a<x> is the average CPAB size of each week and n<x> is the number of events each week. At the same time, x= 1 is the week before the target week, x=2 the target week, x=3 the following week. If there were no events in weeks 1 and 3, then the previous and following weeks with events will be taken into account, respectively. 
  This is done in order to include the Templars in the Top Tens with as accurate size points as possible, given the CPJ numbers are heavily flawed due to the multilogs and the army mostly hosted CPJ events. 
• The Templars’ classification won’t change in retrospect. So if they failed to meet the 3 weeks of 20+ size points in a week in the past, after the formula fix is added in, they won’t be considered a Small-Medium army for that period. 

---

As always, Club Penguin Armies does not condone multilogging and will punish it severely when found.

This is definitely the longest spotlight the Club Penguin Armies have released. The data that had to be looked at and the time frame were huge, which led to the investigation taking much time in order to ensure that it is thorough. What do you think of the situation? Will we see another spotlight soon?

CPA Aura Era
df44 • Edu14463 • JojoTeri • Kira

More Information