owner 0x442fff8f054e52ee99c54bb7b59c27230d3c8063, 0x660283041b289fdf1697f194b33800172b3f0382. add and remove same

[skyonedot]

Related Safe Addresses

0x08c90a74792ba359adf8b8599c87729253a30f07
0xa8d42835bb5357220c2cca885e93fa0a00d1ae1d
0x259d643313e72b2f0db3e645091d3464ecc641f9
0x59bd691a7787638555b904137a1cdbfcab9dc8e1
0x61b940ca1e0e2685532e9791bae6ed45528aeb66

0x15125df64304613024cb09df4f8ec261619e1e25
0xb1881ea5292713057b8cace2cd8371515f400c92
0x22e4272159b4e8c83051aa5a3a59a45640058904
0x7ddb08109a51999f6f6907256070ebca72d4333f
0x93719f835a57115fd06aad763677d64e0c891ed0

Reasoning

There is an abnormal behavior that is understandable 🍄

However, if there are many abnormal behaviors, then there is enough reason to determine that these addresses are airdrop farmer.

1. All of group1 the owner is same 0x442fff8f054e52ee99c54bb7b59c27230d3c8063, only this address

2. All of group2 the owner is same 0x660283041b289fdf1697f194b33800172b3f0382, only this address

3. All of the multi-sign address, the behaviour is always same and stange .

   • 100% of the group1 multi-sign adddress addOwner and removeOwner transaction took place from 2021-06-26 to 2021-06-29.(at the same tx, no exception)

   • 100% of the group2 multi-sign adddress addOwner and removeOwner transaction took place from 2021-09-12.(at the same tx, no exception)

   • The group1 and the group2 , All of them execute 1 transactions, add owner and remove owner in 1 tx, always the same tx.

   • the group1 add owner address is always 0x442fff8f054e52ee99c54bb7b59c27230d3c8063 , remove owner address is always 0x66A0FF664f8509370C5D718A0f69AC1DC01f5c3D

   • the group2 add owner address is always 0x660283041b289fdf1697f194b33800172b3f0382 , remove owner address is always 0x66A0FF664f8509370C5D718A0f69AC1DC01f5c3D

   • Please Check Table

     • Address -- multi-sign address
     • Execute transactions -- The number of execute transactions by multi-sign address
     • AddOwnerTxAmount -- The number of add owner
     • AddOwnerAddress -- The Address of add owner
     • AddOwnerTx -- The tx of add owner
     • AddOwnerDate -- The date of add owner
     • RemoveOwnerTxAmount -- The number of remove owner
     • RemoveOwnerAddress -- The Address of remove owner
     • RemoveOwerTx -- The tx of remove owner
     • RemoveOwerDate -- The date of remove owner

Address	Execute transactions	AddOwnerTxAmount	AddOwnerAddress	AddOwnerTx	AddOwnerDate	RemoveOwnerTxAmount	RemoveOwnerAddress	RemoveOwerTx	RemoveOwerDate
0x08c90a74792ba359adf8b8599c87729253a30f07(group1)	1	1	0x442fFF8F054e52EE99c54Bb7B59c27230d3c8063	https://etherscan.io/tx/0x38bce23d16e431fcf57d721a1cd86350aa7c685608cd92ee198e2f9b78022a54	2021/06/26T21:44:05.000Z	1	0x66A0FF664f8509370C5D718A0f69AC1DC01f5c3D	https://etherscan.io/tx/0x38bce23d16e431fcf57d721a1cd86350aa7c685608cd92ee198e2f9b78022a54	2021/06/26T21:44:05.000Z
0xa8d42835bb5357220c2cca885e93fa0a00d1ae1d(group1)	12	1	0x442fFF8F054e52EE99c54Bb7B59c27230d3c8063	https://etherscan.io/tx/0xf3d8cebdd75ac3a97f2429ded4d93f8b21a4f845fa6ac75c0d305665c2082ec8	2021/06/29T21:12:31.000Z	1	0x66A0FF664f8509370C5D718A0f69AC1DC01f5c3D	https://etherscan.io/tx/0xf3d8cebdd75ac3a97f2429ded4d93f8b21a4f845fa6ac75c0d305665c2082ec8	2021/06/29T21:12:31.000Z
0x259d643313e72b2f0db3e645091d3464ecc641f9(group1)	1	1	0x442fFF8F054e52EE99c54Bb7B59c27230d3c8063	https://etherscan.io/tx/0x862b12c825a5e84dd9d2880cd767e21c01f2fb3fc7d49def6fa22102f90dfbfe	2021/06/26T19:53:55.000Z	1	0x66A0FF664f8509370C5D718A0f69AC1DC01f5c3D	https://etherscan.io/tx/0x862b12c825a5e84dd9d2880cd767e21c01f2fb3fc7d49def6fa22102f90dfbfe	2021/06/26T19:53:55.000Z
0x59bd691a7787638555b904137a1cdbfcab9dc8e1(group1)	1	1	0x442fFF8F054e52EE99c54Bb7B59c27230d3c8063	https://etherscan.io/tx/0xf97412851bd9487dae386bb14116b1c5703c1f4c806fa2556ca637f1b10825bf	2021/06/26T19:37:01.000Z	1	0x66A0FF664f8509370C5D718A0f69AC1DC01f5c3D	https://etherscan.io/tx/0xf97412851bd9487dae386bb14116b1c5703c1f4c806fa2556ca637f1b10825bf	2021/06/26T19:37:01.000Z
0x61b940ca1e0e2685532e9791bae6ed45528aeb66(group1)	1	1	0x442fFF8F054e52EE99c54Bb7B59c27230d3c8063	https://etherscan.io/tx/0x2e9f466f1bfa2c1fe004627c52dc89550d74b1b5a80858715c3457bc4021c95c	2021/06/26T19:51:18.000Z	1	0x66A0FF664f8509370C5D718A0f69AC1DC01f5c3D	https://etherscan.io/tx/0x2e9f466f1bfa2c1fe004627c52dc89550d74b1b5a80858715c3457bc4021c95c	2021/06/26T19:51:18.000Z
---	---	---	---	---	---	---	---	---	---
0x15125df64304613024cb09df4f8ec261619e1e25(group2)	1	1	0x660283041B289fDF1697f194b33800172B3f0382	https://etherscan.io/tx/0x249d278197acdf0f03bf8c018fd1da1ba44c3c59ef1826a47194f00bfa5003eb	2021/09/12T12:27:22.000Z	1	0x66A0FF664f8509370C5D718A0f69AC1DC01f5c3D	https://etherscan.io/tx/0x249d278197acdf0f03bf8c018fd1da1ba44c3c59ef1826a47194f00bfa5003eb	2021/09/12T12:27:22.000Z
0xb1881ea5292713057b8cace2cd8371515f400c92(group2)	11	1	0x660283041B289fDF1697f194b33800172B3f0382	https://etherscan.io/tx/0xdca29d577f63754dfca270c9a2901faa6e6ae0571ce597601118241443ac64df	2021/09/12T12:35:45.000Z	1	0x66A0FF664f8509370C5D718A0f69AC1DC01f5c3D	https://etherscan.io/tx/0xdca29d577f63754dfca270c9a2901faa6e6ae0571ce597601118241443ac64df	2021/09/12T12:35:45.000Z
0x22e4272159b4e8c83051aa5a3a59a45640058904(group2)	1	1	0x660283041B289fDF1697f194b33800172B3f0382	https://etherscan.io/tx/0xbc41c4a9b5d3291ab60d0ae53149e8b25cd32059d2b10de3ba283f2fb2e0987b	2021/09/12T12:20:58.000Z	1	0x66A0FF664f8509370C5D718A0f69AC1DC01f5c3D	https://etherscan.io/tx/0xbc41c4a9b5d3291ab60d0ae53149e8b25cd32059d2b10de3ba283f2fb2e0987b	2021/09/12T12:20:58.000Z
0x7ddb08109a51999f6f6907256070ebca72d4333f(group2)	1	1	0x660283041B289fDF1697f194b33800172B3f0382	https://etherscan.io/tx/0xeb5812b080dc8a6cbadd2dfdc4bb025a67d4855ba39bc6fee5135985780f783e	2021/09/12T12:23:58.000Z	1	0x66A0FF664f8509370C5D718A0f69AC1DC01f5c3D	https://etherscan.io/tx/0xeb5812b080dc8a6cbadd2dfdc4bb025a67d4855ba39bc6fee5135985780f783e	2021/09/12T12:23:58.000Z
0x93719f835a57115fd06aad763677d64e0c891ed0(group2)	1	1	0x660283041B289fDF1697f194b33800172B3f0382	https://etherscan.io/tx/0x00b25a3e2a06bcfc24076af1d5a94761fab1a2d02e68d0da71313c59785d04af	2021/09/12T12:33:26.000Z	1	0x66A0FF664f8509370C5D718A0f69AC1DC01f5c3D	https://etherscan.io/tx/0x00b25a3e2a06bcfc24076af1d5a94761fab1a2d02e68d0da71313c59785d04af	2021/09/12T12:33:26.000Z

---

Methodology

Addresses are reported by retrieving information from the chain, using bitquery's graphql, and detecting abnormal behavior, such as empty wallets, mutual transfers, etc.

When only some of the anomalous behaviors are present, we can consider the address reasonable, but when an address has all the anomalous behaviors, we have good reason to suspect that the address is false. Especially if the multi-signature address and the owner address have obvious exceptions both, then it is obvious that this is airdrop farmer.

Abnormal behaviors include

• For Multi-Sign Address

  • Few transactions were executed
  • There is a lot of overlap in the interactions, such as the destination address, and the time
  • The owner of multiple multi-signature addresses is exactly the same, and never changes from start to finish

• For Owner Address

  • Empty address
  • The first source of funds is the owner.
  • Mutual transfer
  • Behavior similarity

If the verification is passed and my strategy is great, I can provide my source code, but for now it is not conveninet

Safe Address

0xce495858e36c95f491b5a32ca2664405cf10ab76

Thanks

[tschubotz]

Thanks for the report. All of these Safes except for 2 have been found by a previous report, unfortunately.

And for this one I'm unable to follow your reasoning. It might be legitimate use.

0xa8d42835bb5357220c2cca885e93fa0a00d1ae1d
0xb1881ea5292713057b8cace2cd8371515f400c92