Same Behaviour of Owner and Safe Address

[skyonedot]

Related Safe Addresses

In this issue, I detailed the problematic multi-sign address and the corresponding owner's abnormal behavior. 🍄

The owner of group is the same, and it has never changed since its creation, which is the most doubtful and basic point. 🚨🚨

0x17869e3cdbc6a768b5fc0808e17aadf60a484b13
0xee6e933f57a993fa4a3221b42b93eca686322e89
0x318069560dec329f7cb02908413f029d1b36bdeb
0x8bd790abd8cb3f20bf973434ceafaedee737519c
0xde2ab67e6bd2b0b3eb872912ebe78b32d1268016
0xee43af24a0059a4f55450ba3eaf62b3d8ce21f60

0x3392138d334078aa210248ca083af3a369785fc2
0xf8a4bfdf5021665ef88b10161e328db35265ad08
0x4ab10d42b16e93ea132bfdeedae324704a05d772
0x5fd99d545df49f33850ce3f8f3a0fc92fdf5ba9f
0x7d781397a9486de4c6b0d06330e33db5391ee6cc
0x7ea5d89a1c566adaf5b8246d5e972682bc2659d5
0x949f6ca2a39df7bc32fe6263b747317b921d3291
0xa29bd6d9470e526ff06f99300bbbcd79b250b1d9
0xc3bbb1fde69dee1d7e5dc4725a5450ea916483ba

Reasoning

There is an abnormal behavior that is understandable

However, if there are many abnormal behaviors, then there is enough reason to determine that these addresses are airdrop farmer.

• All of The Owner receiver Money From Binance

• All of The Owner receiver Money at same time period

• Group1 Owner is always same, no add and no remove,

  • 0x514b8a34510ad3eb27fb6eaba90555241dcca50f -- send 6 transactions, First money came from Binance Date is Feb-24-2021 09:31:27 PM +UTC : https://etherscan.io/tx/0x2e395bf23f9d2c63f97a8b2eeaf36c5dca10d257cff347011888c5f45c799f56
  • 0x9af815e58cff7b324e0614aab547739d88af3397 -- send 9 transactions, First money came from Binance Date is Feb-16-2021 11:24:32 AM +UTC : https://etherscan.io/tx/0x23e7e3d5465e752a0acf3f1d5936bffa0d7a0c02a2f6690ed4f25431b7d8712b
  • 0xb2c157f9a05a4fbe871a3cdb62e592380868d13d -- send 0 transactions, Empty Walelt
  • 0x1e8a224d137a16f6e0855cc13b2b9f07eee88629 -- send 0 transactions, Empty Wallet

• Group2 Owner is always same, no add and no remove

  • 0xd883d21fa1304363e3d9faaf630ff168fed81bb3 -- send 13 transactions First Money came fron Biancne. Date is Feb-24-2021 09:25:45 PM +UTC : https://etherscan.io/tx/0x76890af2159d78a3e10523126d71abe0ef499adcac819295ff5f012fa65163e0
  • 0x20edebe2256912f3409e7abd154b1d3c1b1751dd -- send 14 transactions First money came from Binande. Date is Feb-16-2021 01:41:49 PM +UTC : https://etherscan.io/tx/0xdf4afb729a5b5f3b2ee60589c8aa905a833b2afa44db7354a0128d1eb0dcaeb1
  • 0x274f596361a7d1646e01f963c111480fb76866c6 -- send 0 transactions
  • 0xe581994592df771bea42b6305e6d2b6d5378873b -- send 0 transactions

• All of the safe address send USDT To same receiver 0xf2aa2259702b0eac5a488a7a70a104cfc76fb880 at same time period 2021/06, check table 🚨🚨🚨🚨

• These multi-sign addresses have a very small number of sending transactions, more like farmer of airdrop

• Please Check Table 👇🏻

  • Address -- multi-sign safe address
  • Execute transactions -- The number of execute transactions by multi-sign address
  • Receiver -- The USDT Receiver
  • Token -- USDT
  • Date -- The Date of send USDT to same receiver
  • Tx -- tx

Address	Execute Transactions	Receiver	Amount	Token	Date	Tx
0x17869e3cdbc6a768b5fc0808e17aadf60a484b13	1	0xf2aa2259702b0eac5a488a7a70a104cfc76fb880	1507452.61	USDT	2021/06/15T17:55:22Z	https://etherscan.io/tx/0xc24569680da31aae973b9432b95fae074eb3613777804c2b089ad31f8ded38eb
0xee6e933f57a993fa4a3221b42b93eca686322e89	1	0xf2aa2259702b0eac5a488a7a70a104cfc76fb880	1524150.76	USDT	2021/06/15T18:43:47Z	https://etherscan.io/tx/0x4a1d7d98b6b337b6ab1ff9bdb5345df1b3e9bfb1a91a8a47a82ddc5d94013f75
0x318069560dec329f7cb02908413f029d1b36bdeb	1	0xf2aa2259702b0eac5a488a7a70a104cfc76fb880	2852472.12	USDT	2021/06/15T18:00:12Z	https://etherscan.io/tx/0x2a15e03fe89da99b0696e6e77b8f98fa3764a825f49ee7c7a6cc1a9aa01f0b96
0x8bd790abd8cb3f20bf973434ceafaedee737519c	1	0xf2aa2259702b0eac5a488a7a70a104cfc76fb880	2536115.27	USDT	2021/06/15T18:46:17Z	https://etherscan.io/tx/0x0389d460a3e51f2875fad1a1d45442dc9e00a5cdc7e3aae416b546358ec24272
0xde2ab67e6bd2b0b3eb872912ebe78b32d1268016	1	0xf2aa2259702b0eac5a488a7a70a104cfc76fb880	96545.898	USDT	2021/06/15T18:41:42Z	https://etherscan.io/tx/0x618a9792e62bf3f3880d21c66a99f1b92a4c48ed804c6583dff272564dd74638
0xee43af24a0059a4f55450ba3eaf62b3d8ce21f60	2	0xf2aa2259702b0eac5a488a7a70a104cfc76fb880	1390752.7	USDT	2021/06/15T17:53:02Z	https://etherscan.io/tx/0xa42c1c9fe89524f8384659b142e6da02a1f65151fe73aa5c2a1460260e04dba8
---	---	---	---	---	---	---
0x3392138d334078aa210248ca083af3a369785fc2	1	0xf2aa2259702b0eac5a488a7a70a104cfc76fb880	169326.66	USDT	2021/06/16T18:27:31Z	https://etherscan.io/tx/0xd12ed9c40ba2283a6e1f6d87ace448718b2dfb1032abeff6f94cbc6525df7e2d
0xf8a4bfdf5021665ef88b10161e328db35265ad08	2	0xf2aa2259702b0eac5a488a7a70a104cfc76fb880	2839484.37	USDT	2021/06/16T18:16:58Z	https://etherscan.io/tx/0xdff8538dc4858625116c8830838ff52f3c609be6589d1425e1b73591cb83a376
0x4ab10d42b16e93ea132bfdeedae324704a05d772	1	0xf2aa2259702b0eac5a488a7a70a104cfc76fb880	2729169.55	USDT	2021/06/16T18:30:33Z	https://etherscan.io/tx/0xf0fb3b8df404d331a4ab77d2e6ad4ba5308d6cc175fb038b284973e09892a234
0x5fd99d545df49f33850ce3f8f3a0fc92fdf5ba9f	1	0xf2aa2259702b0eac5a488a7a70a104cfc76fb880	1905966.67	USDT	2021/06/17T13:00:25Z	https://etherscan.io/tx/0xb2cc272123c6adad557ff3f6e473bfc9cdbf511f3749b2ea9c6ac52860b7d024
0x7d781397a9486de4c6b0d06330e33db5391ee6cc	1	0xf2aa2259702b0eac5a488a7a70a104cfc76fb880	1513063	USDT	2021/06/16T18:26:20Z	https://etherscan.io/tx/0x51edbebe88109db3e53ab81f86a7be4ea938b8f1827bc2d6961ec590ed76893a
0x7ea5d89a1c566adaf5b8246d5e972682bc2659d5	1	0xf2aa2259702b0eac5a488a7a70a104cfc76fb880	667896.34	USDT	2021/06/16T18:20:14Z	https://etherscan.io/tx/0x1812e49c9e4320d3ee9b250248c9e5121f1e0887042862bd11b248f0dde9208f
0x949f6ca2a39df7bc32fe6263b747317b921d3291	1	0xf2aa2259702b0eac5a488a7a70a104cfc76fb880	2246674.92	USDT	2021/06/17T13:01:54Z	https://etherscan.io/tx/0x5cb383d7c97cb63c06e0b34a751000a0c2cfb645b9249d4838aa004e3f359210
0xa29bd6d9470e526ff06f99300bbbcd79b250b1d9	1	0xf2aa2259702b0eac5a488a7a70a104cfc76fb880	2600965.76	USDT	2021/06/17T13:04:02Z	https://etherscan.io/tx/0x8eb9c7acedd9c2dda9888372e6034bbce90baba4a81f65e375f90df2bd4af481
0xc3bbb1fde69dee1d7e5dc4725a5450ea916483ba	1	0xf2aa2259702b0eac5a488a7a70a104cfc76fb880	2168646.89	USDT	2021/06/16T18:25:07Z	https://etherscan.io/tx/0x5960dbb8ab871b0951f991677839e76b2cbbc323383e9b02dff0a76b646ffc78
0xf63889961d75f5cda879357187266546f371a3b9	1	0x2e2921e23b28fbbeb888953e1ec02d78d316ea4b	1274219.45	USDT	2021/06/29T21:56:35Z	https://etherscan.io/tx/0xfbcb4a5774a60af9a5c68f37d49471505e62df2ac3bbc965c1851f76d21659c7

---

Methodology

Addresses are reported by retrieving information from the chain, using bitquery's graphql, and detecting abnormal behavior, such as empty wallets, mutual transfers, etc.

When only some of the anomalous behaviors are present, we can consider the address reasonable, but when an address has all the anomalous behaviors, we have good reason to suspect that the address is false. Especially if the multi-signature address and the owner address have obvious exceptions both, then it is obvious that this is airdrop farmer.

Abnormal behaviors include

• For Multi-Sign Address

  • Few transactions were executed
  • There is a lot of overlap in the interactions, such as the destination address, and the time
  • The owner of multiple multi-signature addresses is exactly the same, and never changes from start to finish

• For Owner Address

  • Empty address
  • The first source of funds is the owner.
  • Mutual transfer
  • Behavior similarity

If the verification is passed and my strategy is great, I can provide my source code, but for now it is not conveninet

Safe Address

0xce495858e36c95f491b5a32ca2664405cf10ab76

Thanks

[skyonedot]

@tschubotz @johannesmoormann @lukasschor Hello, Can you check this, i even don't edit it. SAD

[tschubotz]

These Safes store lots of USD stable coins, even if just for a short period of time. Store of value is legitimate use.