This is the method I often use on-chain to identify cluster dog庄 (market manipulators). This method was taught to me two years ago by @tocuee, Sister Q. Public announcement: Blue V mutual follows. Leave your footprints in the comments, and I’ll definitely reply. Here’s the method I frequently use: A. Address transaction profiling: 1. Purchase behavior (requires backtesting): - Buying at the bottom (low buy) - Selling at the top (high sell) 2. Set a relatively fixed range for the amount of funds used, e.g., 0.5 ETH, 1 ETH on the mainnet. Characteristics: Bulk, concentrated Behavior: During a specific period, bulk and concentrated 0.5 ETH buying behavior appears. B. Determine whether it’s a cluster under the same entity using the principle of address profile consistency: 1. Source consistency: 1.1 Fund source 1.2 Asset source 1.3 Gas source 1.4 Whether the first fund/asset address is consistent 2. Consistency of tools and protocols used: 2.1 Cross-chain protocol tools 2.2 Tools for adding/removing liquidity pools 2.3 Protocol tools used for bulk DCA/TP 2.4 Anonymous DEX/DeFi protocol tools used for mixing coins and money laundering 3. Link structure consistency: Similar link structures used, e.g., A → B, C, D → E 4. Same CEX deposit: Cross-checking CEX deposit addresses used for withdrawals 5. Consistent aggregation addresses 6. Contract control relationships: Same deployer, owner, admin, proxy implementation, Gnosis Safe owner/module 7. Bulk creation traces: CREATE/CREATE2 factory, consecutive nonce, bulk deployment or transfers within a close timeframe 8. Same signature/authorization patterns: Repeatedly approving the same spender, calling the same contract function, highly consistent calldata structure Process: Seed address → Address profiling → Transaction profiling → Expanding fund flow → Filtering exchange/contract infrastructure → Finding aggregation/deployment/authorization relationships → Behavioral fingerprint verification → Assigning confidence levels to the cluster.