From one spam email to 208 domains and a French webmarketing company

• Sicarius - Profundis Team
osintwhoisspamlead-genfavicon
On this page

Hey there,

This one starts with a single junk email and ends on the web server of a registered French company. On the way there’s a WHOIS privacy setup that doesn’t hide much, a fleet of throwaway domains named after video games, and a favicon that ties it all together. I’ll show every query, so you can redo it on your own spam.

TL;DR

  • One fake “subsidized insulation” email in my quarantine folder. Its tracking domain, sportglisse.fr, is registered to herve@oceads.com.
  • Pivoting on that registrant (email, name and organization together) returns about 208 WHOIS records, around 169 live domains, including some hidden behind the AFNIC privacy proxy.
  • One Pivot on sportglisse.fr makes that join by itself: two registrant hubs, 133 domains in one call, and the 34 that only the organization field still ties to OCEADS.
  • The owner is OCEADS, a registered and profitable French webmarketing company (NAF 70.21Z).
  • The company’s own website and its lead-gen landing pages share the same favicon, the same OVH server and the same WordPress backend.
  • Only public WHOIS and scan data: three queries by hand, or two Pivots.

1. The starting point: one spam in quarantine

The mailbox is an old laposte.net account I’ve kept for ten years. About 29,000 emails, and a Quarantine folder where the provider puts whatever looks suspicious. It’s full of the usual French spam: a fake Ryobi promo, “cheaper senior health cover”, “shutters that cut your bill”, and a fake subsidized thermal insulation offer (‘isolation thermique’).

Something I keep seeing with this kind of spam: it passes SPF, DKIM and DMARC. The sender signs their own throwaway domains properly.

DKIM and DMARC (with SPF) are the checks that prove an email really came from the domain it claims. DKIM signs the message, DMARC tells the receiver what to do when a check fails. They prove “this domain sent this email”, not that the email is honest.

So you won’t catch it on authentication. You catch it on its infrastructure, which means a lot of lookups I didn’t want to do by hand across 29,000 messages.

I gave the raw insulation email to Claude Fable 5, connected to the Profundis MCP, and asked it to follow whatever the message pointed to. The tracking link went to sportglisse.fr, so that’s where it started. My part was picking where to go next, checking the numbers, and dropping the leads that didn’t hold.

2. The pivot: one domain, one registrant, a fleet

The first query:

search_whois  domain:sportglisse.fr
→ registrant_email        : herve@oceads.com
  registrant_organization : OCEADS
  registrar / NS          : OVH / octopuce

One registrant, so the next step is to pivot on it.

The WHOIS registrant is whoever registered the domain. Profundis indexes three registrant fields you can search on: email, name and organization. A domain can show up under one field and not another, which matters a lot here.

Email and organization don’t return the same thing:

search_whois  registrant_email:"herve@oceads.com"     → 146 domains
search_whois  registrant_organization:OCEADS          → 169 domains

The organization pivot finds more than the email pivot. On some domains herve@oceads.com is gone, replaced by an address from the AFNIC privacy proxy (xxxxxxxx@k.o-w-o.info and similar). The proxy is supposed to break the link between a domain and its owner, but it only replaces the email. The registrant_organization: OCEADS field was still filled in.

Claude’s first summary gave a single number for the fleet, which was wrong: 169 by organization, 146 by email, and neither one covers everything. The correct query is the union of the three fields:

search_whois  registrant_organization:OCEADS
              OR registrant_name:OCEADS
              OR registrant_email:"herve@oceads.com"
→ ~208 records  (≈ 169 live domains, at peak enrichment)

So about 208 records and 169 live domains. That’s the figure I use for the rest of the article, keeping in mind it’s a union of three fields.

Part of the fleet is behind the privacy proxy, and it doesn’t help much: the union of the registrant fields brings the whole set back.

The same join, in one Pivot

Profundis now has a tool that does this join for you. I gave Pivot sportglisse.fr and nothing else (5 credits):

Pivot on sportglisse.fr: two registrant hubs and three groups of domains

Two registrant hubs come out of the seed: the email (Pivot shows it redacted) and the organization OCEADS. The domains then fall into three groups: 66 have both, 33 only the email, and 34 only the organization. Those 34 are the ones an email pivot misses. Open the group and the landing pages from section 5 are in it (energiereduc.com, lateleassistance.com), next to the proxied .fr:

The 34 domains tied to OCEADS by the organization field only

Open this pivot in Profundis: free to view, every node with a free account.

I checked two of them in the raw WHOIS: assur-malus.fr has an AFNIC proxy address (…@v.o-w-o.info) and energiereduc.com has no email at all, but both still say registrant_organization: OCEADS.

One limit worth knowing: Pivot keeps at most 100 domains per shared value, so 133 is what one call shows, not the size of the fleet. To count, the union query above is still the right tool. To see how the fleet is put together, Pivot takes ten seconds.

3. Who is OCEADS?

At this point we leave threat intel and open the company register. oceads.com belongs to a registered business (source: Pappers / public register).

Legal nameOCEADS
Activity (NAF 70.21Z)Public relations and communication consultancy
Declared activity“traditional marketing, webmarketing and public relations”
Net profit96.9 k€ (2022) · 122 k€ (2021)
Cash position218 k€ (2022)
Structureholding DOELSE INVEST (Laigneville, Oise) + YT23 INVEST in the capital; long-time director Hervé D., sole partner

A NAF code is the activity code every French business has. 70.21Z is “public relations and communication consultancy”, the category OCEADS chose for itself.

So we have a profitable French webmarketing company with about 169 throwaway domains used to send spam. Lead-gen means collecting contacts and reselling them (health cover, insulation, insurance, debt consolidation), and here it’s done by a legal company using spammer methods.

4. What the fleet is made of

I asked Claude to sort the 208 records by what the domains look like. Three groups came out.

Rotating sending domains. Random names with no link to anything, and a lot of video game references, mostly Zelda: akkala.fr, durianzelda.fr, falconpunch.fr, galiorjump.fr, gumaadc.fr, chamglagla.fr, bouchedelouche.fr, larsonglacon.fr, lislitlix.fr… These send mail for a while and get replaced by the next one, which is why blocking them one at a time doesn’t achieve much.

Themed landing domains. These are the ones that make money, with names built to convert: isolationexpertise.fr, energiereduc.com, expertassur.fr, assur-malus.fr, bankkeys-rachatdecredit.fr, auditif-pro.fr, comparezlesoffres.fr, lesmeilleurescroisieres.fr, animosante.fr. auditif-pro.fr sells hearing aids, a classic senior target. It’s also on domains like this one, not on the sportglisse.fr record, that the personal name “herve d.” appears.

Fake “news” domains that carry the message: depechehebdomadaire.fr, depechejournaliere.fr, informationimportante.fr, dechiffremonmessage.fr, desmessages.fr, bonplandumois.fr.

graph LR
  MAIL["'insulation' spam\n(laposte quarantine)"] -->|tracking link| SG[sportglisse.fr]
  SG -->|WHOIS| REG["registrant\nherve@oceads.com"]
  REG -->|email pivot| D146["146 domains"]
  REG -->|union pivot\nemail · name · organization| D208["~208 records\n≈169 live domains\n(AFNIC proxy de-anonymized)"]
  D208 --> BURN["burner rotation\nakkala · durianzelda · falconpunch…"]
  D208 --> LEAD["lead-gen landing\ninsulation · insurance · debt consolidation · hearing aids…"]
  REG -.register.-> CO["OCEADS (NAF 70.21Z)\nwebmarketing · 97k€ net\nHervé D. / DOELSE INVEST\nwww.oceads.fr"]
  SG -.shared NS.-> NS["heberge.info / octopuce\nSOA alice.octopuce.fr"]
  ADK["adktrack48.xyz · adktrack78.xyz"] -.shared NS.-> NS
  LEAD --> FAV["favicon 189865458\n21 hosts · OVH 146.59.209.152\nWordPress backend lp-ocd.com"]
  CO ==> FAV

See it live. Open the saved Pivots on sportglisse.fr and on the favicon 189865458, free to view.

Up to here everything relies on WHOIS, and a WHOIS record is only what someone typed into a form, so it can be disputed. HTTP scan data is harder to argue with.

A favicon is the small icon in your browser tab. Profundis hashes it (favicon_hash) and indexes it like any other field. Two servers serving the exact same image are very often the same install.

Claude suggested pivoting on the favicon of the landing pages, so I ran it:

search_hosts  favicon_hash:189865458
→ 21 hosts, on OVH 146.59.209.152 (cluster131/031.hosting.ovh.net)

The favicon shared by the OCEADS landers and by www.oceads.fr (hash 189865458, image served by Profundis)

All 21 hosts are OCEADS landing pages: energiereduc.com, isolationexpertise.fr, superpompeachaleur.fr, lesmeilleurescroisieres.fr, mesnouvellesfenetres.fr, lateleassistance.com, mesvoletsroulantssolaires.fr, mondevispanneauxsolaires.fr, mesplusbeauxvoyages.fr, travel-success.fr, super-rac.fr, offremaisonprotegee.fr, monpersurmesure.fr, mondevismonteescaliers.fr… They’re real WordPress + Elementor sites, not parked pages.

Almost all of them also send this header:

Link: <https://lp-ocd.com/wp-json/>; rel="https://api.w.org/"

That’s the WordPress REST API entry point. It means these landing pages all run off one shared WordPress backend, lp-ocd.com (I read it as Landing Pages OCeaDs). One back office producing every landing page.

And in that same list of 21 hosts there’s www.oceads.fr, the company’s official website. Same server 146.59.209.152, same favicon 189865458. WHOIS told us these domains belong to the same company. The favicon shows they’re hosted on the same server as the company’s own site, and there’s no privacy proxy for that.

The company website and the throwaway fleet share the server, the icon and the WordPress backend. It’s one setup, run by one company.

Pivot finds the same thing from the icon alone. Seeded with 189865458, with the favicon slider at 96% (below that, similar-looking but unrelated icons come in), it keeps two hubs: the exact hash and its 128-bit twin (9329491f…, the same image hashed the other way), 66 domains between them. www.oceads.fr sits in the first one, and lp-ocd.com, the shared WordPress backend, in the second:

Pivot on the favicon 189865458: www.oceads.fr among the landing pages

Open this pivot in Profundis: free to view, every node with a free account.

Pivot draws these links dashed, under “shared page content only”: anyone can copy a favicon, so on its own it’s a lead, not proof. Here the registrant and the backend back it up. The list also shows that several landing pages, and www.oceads.fr itself, now answer with OVH’s “site not installed” page.

In Profundis, favicon_hash is a normal search field, so this is a single query. When the icons are only similar and not identical, the Favicon Matcher finds those too.

6. False clusters

This is where a lot of spam write-ups go wrong, and where I had to correct Claude the most. Links that come from shared hosting look real, and an automated tool will happily report them as findings.

  • Shared IP. Most OCEADS landing pages resolve to 146.59.209.152 (OVH), and several throwaway domains to 91.194.60.6 (Octopuce). Claude flagged the shared IP as a cluster and I dropped it: 91.194.60.6 is an Octopuce shared hosting IP with 17,344 unrelated hosts on it. What ties OCEADS together is the shared favicon, the lp-ocd.com backend and the registrant. The IP is worth mentioning, not worth clustering on.
  • Shared NS or AS. Same problem. Another operator in this mailbox (the one that hid properly, see episode 4) is a good example: its domains resolve to 76.223.x / 13.248.x, which are AWS Global Accelerator anycast addresses (one IP announced from many places and shared by thousands of unrelated sites), and its sending IP is on AS199391, which hosts 6,111 hosts, nearly all legitimate. Being in the same anycast pool or the same AS proves nothing. OCEADS doesn’t use AWS anycast at all, its landing pages are on OVH shared hosting.

What you can actually cluster on:

  • the registrant (email and organization, joined by the WHOIS union);
  • the shared favicon (189865458) and the common WordPress backend (lp-ocd.com), the hardest link to dispute here;
  • a dedicated NS: the tracking domains adktrack48.xyz / adktrack78.xyz use the same Octopuce NS (heberge.info, SOA alice.octopuce.fr) as OCEADS domains like assur-malus.fr, a small group of names rather than a generic host;
  • registration timing (two domains created seconds apart at the same registrar are one batch);
  • shared TLS certificates.

For OCEADS the evidence is the registrant, the favicon and the backend, not the IP.

7. So why is nobody stopping this?

I asked myself the same thing. It’s worth being precise here, because legally spam and fraud are not the same thing.

What this shows is large-scale unsolicited commercial email: bulk prospecting to private inboxes from rotating throwaway domains, with no sign of prior consent. In France that has a regulator.

The CNIL is the French data protection authority. To email a private person for marketing, the law requires their prior opt-in consent, freely and clearly given. Buying or generating a list and mailing it breaks the GDPR and Article L34-5 of the LCEN, and the CNIL fines it, in the tens to hundreds of thousands of euros.

I looked for OCEADS in the enforcement records (CNIL fines, DGCCRF actions, court rulings) and found nothing. No public sanction against the company, the holding or the director.

A few reasons, as far as I can tell:

  • A registered company isn’t a license. The company is real, but the emails are the offense, and they’re judged campaign by campaign, usually after complaints.
  • Throwaway domains are faster than complaints. By the time a complaint about akkala.fr goes anywhere, akkala.fr is gone and another domain is sending. Disposable domains, WHOIS privacy and valid SPF/DKIM/DMARC on each one make that easy, and it looks deliberate.
  • The company front helps. A “communication consultancy” with a holding on top (DOELSE INVEST) looks legitimate, and the throwaway domains keep the sending at a distance.
  • Enforcement has limited resources. It’s complaint-driven, and there are far more operators than investigators.

The sectors this fleet works in (home insulation subsidies, senior health cover, debt consolidation) are ones French regulators already flag for abuse, so it’s not happening somewhere hidden.

Connecting this operation took me three queries. Stopping it is someone else’s job, and so far nobody has done it.

8. Redo it yourself

The three queries:

1. search_whois  domain:sportglisse.fr                  # the registrant

2. search_whois  registrant_organization:OCEADS
                 OR registrant_name:OCEADS
                 OR registrant_email:"herve@oceads.com"  # the fleet (incl. AFNIC-proxied)

3. search_hosts  favicon_hash:189865458                  # the proof:
                                                          # company + burners = 1 WordPress install

Or open the two saved Pivots, free to view: sportglisse.fr for the registrant side, then the favicon 189865458 for the hosting side.

Nothing private, no intrusion, only public WHOIS and scan data that Profundis keeps indexed. Claude ran the queries, I decided which results counted as evidence and which were coincidence. The same approach works with any favicon (to find a brand’s clones), any certificate or any registrant.

That’s it for this one. If you have a quarantine folder, pick a spam, pivot on its registrant and see what comes out :)

Cheers, Sicarius

Sources: public WHOIS and internet-scan data; mailbox analysed read-only, technical indicators only.

Episode 1 of the series. Next: the laposte.info namespace · the anatomy of the 29,000 emails · six lead-gen operators · the homoglyph bank phishing. Investigation carried out with Profundis.