I. The Volume Game

DigitalOcean operates in a fundamentally different market than ColoCrossing or Psychz. It's a mass-market cloud provider — the AWS alternative for indie developers, small SaaS companies, and startups. This means millions of droplets, of which only a small percentage are malicious. The low average threat score (25.5) reflects this dilution.

But 117 IPs at abuse_score=100 is not small. That's one-third of all tracked IPs — universally flagged as malicious by independent reporters. On a percentage basis (33.4% at abuse=100), DigitalOcean is comparable to Psychz (91.7%) only if you count the high-threat population alone.

II. The Global Footprint

Unlike every provider in 032A-032C (all US-only), DigitalOcean operates across 8 countries. The abuse profile shifts dramatically by geography:

The India and Singapore data centers produce IPs at 2× the threat level of US operations. Canada has only 4 IPs but they average 64.8. Australia: a single IP at 74. The pattern is clear — DigitalOcean's smaller, non-US data centers have proportionally much worse abuse profiles. These facilities likely have smaller trust & safety teams, or route abuse reports through US-based processes with timezone delays.

III. The Registrant Archaeology

The "Network Operations Center" entity is notable: 5 IPs at avg threat 57.0 — significantly higher than DigitalOcean's direct registrations (25.2). This generic entity name appears on DigitalOcean's ASN but could represent a customer allocation, a partner agreement, or an internal operations block. Its elevated threat score suggests a cluster of misused infrastructure.

DigitalOcean appears under at least 7 different RDAP entity names: DigitalOcean LLC, digitalocean, Digital Ocean Inc administrator, IRT-DIGITALOCEAN-AP, DIGITALOCEAN-ASN, DigitalOcean London, Network Operations Center. For a public company, this is remarkably fragmented. Each entity corresponds to a different regional registry, a different historical corporate structure, or a different acquisition.

IV. Five Campaigns, One Provider

DigitalOcean is the first provider in TI-2026-032 to host multiple distinct botnet campaigns:

This is qualitatively different from 032A-032C, where all high-threat IPs belonged to the single hassh-14b2ddda386a4d10 campaign. DigitalOcean's mass-market model attracts diverse criminal operators — not just one botnet purchasing bulk infrastructure, but multiple independent operators choosing DO for different campaigns.

V. The Public Company Problem

DigitalOcean (NYSE: $DOCN) files 10-K annual reports with the SEC. It has a trust & safety team. It publishes abuse reporting procedures. It has legal, compliance, and investor relations departments. And yet:

• 117 IPs at abuse_score=100 (maximum independent reporting)
• 1 IP at threat_score=100 (maximum threat assessment)
• 5+ distinct botnet campaigns operating simultaneously
• 976 honeypot hits from tracked infrastructure

This is not a ColoCrossing that can claim ignorance. This is not an Internap in bankruptcy. This is a company that trades on the New York Stock Exchange, raises capital from institutional investors, and employs hundreds of engineers. The question isn't whether DigitalOcean knows about abuse on its network — the question is whether knowing about it creates a legal obligation to act on it faster.

VI. The Developer Economy

DigitalOcean's business model — $5/month droplets, instant provisioning, no questions asked — is optimized for developers. It's also optimized for abuse. The same frictionless experience that makes a student deploy their first web app makes a botnet operator deploy a scanning node.

The economic math for DigitalOcean is challenging:

If investigating and acting on a single abuse report costs $200 in staff time (reading the report, investigating the customer, issuing a warning, following up, potentially terminating the account), and the customer pays $60/year — every abuse investigation is a net loss. For 117 IPs at abuse=100, that's approximately $23,400 in investigation costs against $7,020 in annual revenue. The rational economic decision is to do nothing.

VII. The Conspiratorial Reading

VIII. Conclusions

DigitalOcean demonstrates that scale creates its own accountability gap. With 350 tracked IPs, the company can point to a low average threat score (25.5) while simultaneously hosting the highest individual threat score in the entire series (100), the most campaign diversity (5+), and the most geographic spread (8 countries). The average conceals the peaks.

After four letters of TI-2026-032:

531 tracked IPs across four US provider groups, 259 at abuse_score=100. DigitalOcean alone contributes more IPs than the other three combined. The distinction between "volume hosting with abuse problems" and "abuse hosting" is semantic when the affected IP count reaches this scale.

Next: FranTech/BuyVM — a provider that philosophically defends the right to privacy hosting, where the line between principle and complicity gets genuinely complicated.