with Ban As (select BLOCK_TIMESTAMP,EVENT_INPUTS:_user AS "banned address" from ethereum.core.fact_event_logs
where EVENT_NAME='AddedBlackList' and CONTRACT_ADDRESS='0xdac17f958d2ee523a2206206994597c13d831ec7'
and EVENT_INPUTS:_user not in (select EVENT_INPUTS:_user from ethereum.core.fact_event_logs
where EVENT_NAME='RemovedBlackList' and CONTRACT_ADDRESS='0xdac17f958d2ee523a2206206994597c13d831ec7'))
select
date_trunc('month',BLOCK_TIMESTAMP) AS month,
count("banned address") AS "banned addresses number",
sum("banned addresses number") over (order by month) AS "banned addresses number over Time"
from ban
group by 1