Trends in Networks: Spam #10

Here are this week’s spammy Freenom and .xyz TLDs coming from the Digital Ocean network.

Oct16	x1	x1	x1	x2	x1	x2	x2	x2	x2	x6	x1	x1	x2	x1

Oct17	x1	x1	x1	x2	x1	x2	x2	x2	x2	x6	x1	x1	x2	x1

Oct18	x14

Oct19	x14	x3	x1	x6	x1	x1	x2	x12	x2	x2	x1	x1	x1	x2	x2	x2	x1

Oct20	x1	x2	x1	x1	x1	x2	x3	x2	x2	x2	x1	x1	x8	x7	x2	x3	x1	x1	x1	x8	x2	x3	x1	x1	x1	x2	x1

Oct21	x1

To elaborate on the enormous marketing spam campaign coming from the Digital Ocean network mentioned last week, this activity does not seem to be slowing down. Those who are subscribed to the SDLU ( mailing list may have read about these ‘compromised’ Digital Ocean IPs sending a high volume of messages. This actor is utilizing older domains (domains registered 5-10+ years ago), likely picked up as they were expired. Using older domains is one way for a domain to look more ‘legitimate’ on the surface; at the very least an older domain is intuitively more reputable than a freshly registered one (when the domain name is not a recognizable brand).

Many, if not all of these suspicious domains, are registered with They also share the same registrant organization ‘Hosting Magic’. No company under the name ‘Hosting Magic’ could be found with a brief google search.

The above picture is what an email from this spam campaign typically looks like. The link will redirect you to a spammy looking ad-click style website, nothing of substance.

Below are some of the Digital Ocean IPs we’ve detected sending this marketing spam over the past week.

Oct16	x109	x105	x126	x34	x76	x116	x22	x27	x121	x102	x120	x24	x31	x23	x35	x21	x24	x19	x78	x123	x93	x118	x82	x91	x23	x80	x3	x114	x108	x19	x32	x27	x24	x82	x78	x110	x78	x86

Oct17	x28	x149	x131	x150	x143	x24	x38	x143	x44	x30	x34	x30	x148	x148	x130	x47	x39	x143	x170	x32	x23	x24	x132	x141	x26	x38	x15	x3	x27	x178	x37	x154	x131	x31	x140	x8	x128	x144

Oct18	x158	x170	x125	x137	x135	x32	x29	x23	x22	x33	x30	x31	x23	x26	x18	x130	x132	x191	x34	x173	x179	x26	x120	x26	x124	x136	x136	x125	x199	x28	x118	x173	x161	x137	x168	x149	x153	x131

Oct19	x40	x175	x196	x180	x23	x23	x21	x47	x204	x13	x184	x16	x32	x20	x21	x198	x35	x189	x201	x34	x32	x22	x23	x211	x215	x234	x204	x195	x212	x21	x26	x204	x188	x202	x156	x173	x185	x226	x216	x210

Oct20	x22	x98	x24	x102	x105	x23	x22	x28	x29	x20	x97	x104	x99	x105	x21	x100	x26	x148	x25	x96	x92	x103	x152	x167	x116	x110	x118	x101	x17	x24	x28	x100	x125	x23	x15	x89	x108	x25	x105	x103

Oct21	x88	x91	x22	x24	x22	x18	x18	x94	x28	x24	x17	x23	x20	x30	x77	x83	x92	x84	x86	x87	x80	x18	x90	x86	x23	x27	x22	x79	x21	x26	x15	x84	x21	x97	x73	x91	x90	x30	x30

This entry was posted in Informative and tagged , , , , , , , , , . Bookmark the permalink.

Leave a Reply