Diamond Club

Every account ranked by economic activity. Click any column to sort. Click an account to investigate.

Churn Analysis

Accounts that stopped logging in, with what they left behind. Reference is the latest event in the corpus — not wall-clock — so the threshold stays meaningful when logs are stale. Click an account to drill in.

Check Trail

Every bank check tracked from creation through trades to cashing.

Trades

Vendor Sales

Per-item player-vendor purchases. Each line links buyer → seller → item UID → price. Different from trade logs — no confirmation window, just a direct purchase from someone's vendor.

Gold Flow

Account Relationships

Directional: who gave what to whom across all trades and checks.

Risk Patterns

Forensic signals grouped by family. First row: economic/behavioral patterns from trade and event logs. Second row: account-security signals — failed logins, connection rejections, hardware mismatches, PIN failures.

IP Investigation

All activity across every account that used this IP address.

Account Clusters

Groups of related accounts — two independent evidence bases. IP clusters use frequency-weighted co-residency (promiscuous NAT/VPN IPs excluded). Hardware clusters share a single hw_uuid from the login database — the strongest alt-farm signal.

Staff Activity

All admin actions: jails, mutes, name changes, staff commands, player pages.

Pages

Player .page submissions (GM help requests) with the GM reply, handler, and in-world position. Filter by text, GM, account, or date range. Click an account to drill into the player view.

Kufur Reports

Player-filed .ihbar (swearing) reports with the captured chat transcript around the incident moment. Each row is one incident; expand to read the snippets and see who said what.

World Log

Non-economy events. Player and NPC deaths plus asset lifecycle outside of trades: house demolitions, strongbox destructions, keys pulled, ships scuttled, dungeon chests.

Errors

Honeypot

Server-side cheat-detector trips. Each event is a client action (DoubleClick, PickUp, Target, ...) whose seed didn't match — the client interacted with a bait item (honeypot) the server never showed it. Severity-100 cheat-client signal.

Client Telemetry

Encrypted machine-fingerprint snapshots posted by the client 5 minutes into a session. Includes a screenshot, full driver/process/NIC inventory, and the on-disk path of the running client. Newest 20 per account are retained; older ones are evicted on insert. Click any row to expand the full report.

Live Status

Currently-online players, grouped by IP. Counts come straight from the engine's own arc_online_acc table — every connect/disconnect is a row, latest row per (account, character) where online=1 is the deterministic CCU. Multi-box IPs (most accounts on one IP) bubble to the top. Enriched with country, guild, house flag, last activity from logs, and 24h honeypot / anti-cheat hit counts.

Raw Stream Audit

Server-side grep of one log file using a category regex, cross-referenced against events.sqlite. Lines marked "missed" matched the regex but were parsed as OTHER — that's the silent-drop signal. "partial" means parsed as a generic type when a more specific one exists. "not_indexed" means the file isn't in events.sqlite yet.

Driver Analysis

Detected keyboard/mouse filter drivers per account. Categorized by type and severity — virtualization and cheat-tool drivers are flagged as alerts.

DB Viewer

Read-only browser for the SQLite enrichment sidecar. Use Search to locate any UID across all tables; Browse for paginated table inspection; Query to run SELECT statements directly.

All Events

Files

Gold Accounting

Legitimate-gold accounting per account. Recon totals each account's DB-known gold-in (quest rewards + merchant sell revenue). The other tabs drill into each source leaderboard, plus Storage Wealth — hoarder-scale inventories.

Guilds

All 57 guild stones with their 1,960 members. Shows master / co-owner roles — social cluster signal.

Houses

All 672 houses with owner character, account, coordinates, and type.

Verified Disguises

Character names that exist on 2+ distinct accounts in arc_stat_players — ground-truth disguise detection from DB (vs. statistical inference from logs).

Live Log Stream

tail-f style real-time view of every event being parsed from the SphereServer logs. Visual only — no alerts, no chimes. Use the type filter to narrow to specific signal types.

System

Live resource use, ingest throughput, and worker activity. The freshness pill in the top bar links here. Snapshots refresh every 5 seconds.

Item Spawner

Search the SphereServer item catalog (arc_allitems). Click a row to copy .add <defname> to your clipboard, then paste in-game to spawn or reference.

Glossary

Forensic and SphereServer domain terms used across the app. Hover the dotted terms anywhere in the UI for a quick definition; read the full entries here.