What I find most interesting about those upstream addresses, is that if you follow them back to the piles of BTC in one or the other, the seemingly random outputs start to look almost EXACTLY like the scripts running the now almost defunct scrypt.cc (ponzi) site's hotwallet - Looks just about the same - laundering bitcoin's over and over, much of it landing in Eobot wallets.  In fact, now that I look at both sites' "hot-wallet" addresses, I am pretty sure they were/are both being run by the same criminals. I think someone mentioned that TF had moved onto Scrypt.cc, but I can't recall who or in what thread now .... I would post the addresses and some example tx's for both, but I'm short on time, but I'm sure someone else can double-check.

Good post/thread, thanks!