The reported addresses were discovered by checking for irregularities in the Safe creations through the Safe: Proxy Factory 1.1.1 contract.
I checked for the addresses that had the biggest # of Safe creations each month. In March, 2021 part of this group was the address in question (0x66d) and it is not a relayer.
I then manually looked at the value stored in the safes (which is always the same = 0), the # of Safe Transactions and the date on which the safes were created:
Related Safe Addresses
0x4a61E2d459f24378fAc26721705BB4a974DF4e93 0x3Bef9cFfEEe4da69fBA9c9b47CC9A75c50e62e8b 0x9937c074e94eCd7D7C23B3b963106eb47fA9235B 0xacc819aBcfaaD2b8E0fFbd701a86d72cfd10407e 0xea166EFbCc7Ca9bD86d665512C488CdDcA5Bdae3 0x7d027B807444dA6252a187B044DE3a196120E897 0x01069fF7f59514Ade22E8F682B7334676C00c56c 0x68A54972e4faeb548C23214FC949197b85058d0E 0xc802b29dE31cdb42B5406AADa2f8DAe24121D248 0xc6101C2595db8bb9179De79ADB44F0ED6683D419 0x3086AB78F3Ec3298545346bD9Dc167ebE1539Ae1 0x673F7Db60E99EAf80e26a2F0e3c716B0e8d15dfD 0x0982eb56Be2F16DE53D76f75FBAC4dF2D69b9CA7 0x85C1217921751f146Df95dcb6a8E8e9f85554D54 0x426c90fe3Dc43AC291Ef849CD3c74dEbB5CCD23a 0x08B8D1D7C92357EEBE892A51e3185B770A58f485 0x174C99D6fFE6e4b7f39d2f33fA73ab3D23E168d5 0x83C6Efecd8084722475f23708E7a260EE8Db52c4 0x744f1Cb0e1baDaDAA951C7e9Db8218F04B70716B 0x7deDc6BfBa089cA3618A1E76c4a2908BF1cD2751 0xd43936F2B187c9C66000a3e8a2E195464603027E 0x2Fc9E83c5175E997A4e9Aaf7E7C3F13742d3B214 0xdaf4eE10Bfe98d6337A1483465FE5849dDa74E3F
Reasoning
0x66deb0894b0949eb3d34176201ab0219161a3b07 created 23 Safes which are eligible for the airdrop.
And while Safes with the same creator aren't necessarily airdrop farming, let's look into what makes this an obvious case:
All of the 23 Safes currently don't store any value, neither ETH nor any other ERC-20 tokens.
The Safes were created in batches, sometimes 3 or 4 only minutes apart of each other:
Feb-24-2021 10:47:28 PM - 10:52:31 PM +UTC: 4 Safes created 1 2 3 4 Mar-04-2021 09:20:49 PM - 09:27:22 PM +UTC: 3 Safes created 5 6 7 Mar-11-2021 06:47:52 PM - 06:50:59 PM +UTC: 3 Safes created 8 9 10 Mar-16-2021 04:53:26 PM +UTC: 1 Safe created 11 Mar-18-2021 09:40:26 PM - 09:51:42 PM +UTC: 4 Safes created 12 13 14 15 Mar-25-2021 06:21:16 PM - 06:27:56 PM +UTC: 4 Safes created 16 17 18 19 Apr-05-2021 05:26:51 PM - 05:35:27 PM +UTC: 4 Safes created 20 21 22 23
Methodology
The reported addresses were discovered by checking for irregularities in the Safe creations through the Safe: Proxy Factory 1.1.1 contract.
I checked for the addresses that had the biggest # of Safe creations each month. In March, 2021 part of this group was the address in question (0x66d) and it is not a relayer.
I then manually looked at the value stored in the safes (which is always the same = 0), the # of Safe Transactions and the date on which the safes were created:
Safe Address
0x81058ff64a2D765E73fC04c6a19E051701D101C8