"Suspicious User (Human Verification)"
This user contacted me via an [offer](https://app.ethos.network/broker/post/2319/human-verification) for Human status verification. In the offer, I clearly laid out the terms and asked them to assess the risks before reaching out to me. I also stated that I could refuse, leave a negative review, or initiate a slash-round.
In this case, I have refused them and am leaving a negative review in order to signal other verifiers to be cautious and assess the risks.
During my investigation of this user, which was outlined in the offer, I identified on-chain patterns of connection between mutual transactions and shared exchange addresses.
There are numerous transactions, dating back years.
The EVM address of [Kryon](https://app.ethos.network/profile/0x7c52496FE91a785CC85bC2383f29868FEaF88B32) and [maradenzksync.eth](https://app.ethos.network/profile/0xd0fF3eE46cA2FA7680DC12b6e57956fc104F43d8) is linked to at least three CEX addresses (below are a few transaction examples):
Kucoin: 0x4cd3f9ae4f0783c3137f2cc1583b592c88919cfa
[Deposit](https://bscscan.com/tx/0x1081b7a829be376f11cdc0c8e82ed10d6a4167a2df46a8037af5dcef53b50af3) from Kenny.
[Deposit](https://bscscan.com/tx/0xbc890c8d77d7928167b0cd281d754b18ef27ff58740855f72f786f410ddebdbb) from maradenzksync.eth.
There are many joint, similar deposit transactions.
Binance: 0xda2afc442c3954a20c95644ee067cf4aaee63ea8
[Deposit](https://etherscan.io/tx/0x728d129271fe3b483eaca26231da2727b6a8486ed53bb3e97e2f7971ddbce8b7) from Kenny.
[Deposit](https://polygonscan.com/tx/0xc82e4612c1cce855f50f01cd82035bf47c97f4ffe28837c971658097b7d17e63) from maradenzksync.eth.
[Deposit](https://bscscan.com/tx/0x4014172eaf1072c2bd1e25c7424351c67fc3dcb1e5b7f194f0901346d7682f10) from Kryon.
FTX: 0x87477d909eced40ae3e6656a39bde42e3588a95d
[Deposit](https://bscscan.com/tx/0x8730fcda167d493ba8250f43fa9176d513379197f1c92eb478cf38b602b53926) from Kenny.
[Deposit](https://bscscan.com/tx/0x5cbbedca107f5f439bde63474660f0b22f97178510a4380e7ee53934e215ee11) from maradenzksync.eth.
[Deposit](https://bscscan.com/tx/0x6c0e524ec10bfb976e13be0568dbd0c3babe6bcbc7872d5dbfa65a176ce27192) from Kryon.
Kenny also has numerous incoming and outgoing on-chain signals with the users Kryon and maradenzksync.eth.
[Txs](https://bscscan.com/tx/0xe65cfb43ae2ac42ae10b5b2b5a558994255cb2436c81a05f60e6d57455ef7e06) maradenzksync.eth (send to) (0.5100 POL ($0.40)
interval 6 min
[Txs](https://bscscan.com/tx/0xe65cfb43ae2ac42ae10b5b2b5a558994255cb2436c81a05f60e6d57455ef7e06) from maradenzksync.eth (receive) (+0.0017 BNB ($0.41)
[Txs](https://etherscan.io/tx/0x306b16ebd9da1e090e14549dde673aa1e7fba8f9872d7a821af058dac5f2800f) Kryon (Send to)
[Txs](https://bscscan.com/tx/0xb50c7fdb318187226da559336804a74a92f37e662f9f5ee6db3a1749aae071ce) Kryon (Send to)
Kenny himself does not interact with them through Ethos for some reason. I [asked](https://ibb.co/Kxb9qxrJ) him if he knew these accounts, and after about five minutes of hesitation, [he said](https://ibb.co/Q3HbR74v) he did not know them. That answer was definitive.
The combination of these accounts points to another user who looks very suspicious based on social signals, the accounts he invited into Ethos, and reviews. He also has bonding for Human verification. His username is [percykrafix | ETHGas](https://app.ethos.network/profile/0xA50c4833c39DDa58646277d99E05c42F8AC0F303).
I advise anyone who receives a verification request from the user kenny to be cautious. We cannot say for sure that he is not a human. However, we also cannot say for sure that this is not or will not become his only account with Human status.
I will not consider this account in the context of the sybil hunting [bounty](https://app.ethos.network/broker/post/2317/looking-for-my-love-sybil-with-human-verification), nor the entire cluster connected to them, as of the time this review was written. I may study all of them on my own in the future.
It should also be mentioned that Kryon and maradenzksync.eth know each other, which is confirmed by their mutual reviews.
It is important to understand that I am not accusing him of sybiling (at this time). However, due to the circumstances described above, I find this very suspicious and believe it requires caution on the part of verifiers.
**Addendum:** My actions are justified under Section 8.3 of the Human Verification documentation. Quote:
> *We encourage in-person or video verification over voice-only, rely on validator discretion in choosing verification standards, develop community norms around verification rigor, and impose reputational consequences for validators who are frequently deceived.*
As well as Section 8.4. Quote:
> *Without negative signaling, the community cannot efficiently filter obviously fraudulent requests. Future protocol versions may introduce mechanisms for validators to flag suspicious requests, including reputation-weighted negative signals, threshold-based request removal, and slashing for users who submit provably fraudulent verification requests. This limitation is acknowledged as a known gap in the initial implementation.*
Section 6.1. Quote:
> *This evidence might include proof of duplicate identities (the same person verified under multiple profiles), evidence of bot behavior (automated posting patterns, impossible activity timestamps, or coordination with known bot networks), admissions or public statements revealing non-human status, or technical evidence linking the profile to known sybil operations.*
As well as Section 6. Quote:
> ***Accountability: Slashing**
> Human verification bonds are slashable. If a validator verifies an entity later proven to be non-human (a bot, a duplicate identity, or a coordinated sybil), the bond may be slashed through the standard Ethos slashing mechanism.*
