I'm not the only one to have noticed this (discussions on reddit here and here): out of 70 or 80 incoming connections on my bitcoin core full node, about 50 are from just one single network (18.104.22.168/16, belonging to DigitalOcean, an apparently reputable cloud hosting provider) and all running variations of bitcoinj. This just seems peculiar.
I don't have a particularly fast connection here and my upload bandwidth has been saturated by this for weeks, so I'm dropping incoming connections from 138.197 until I figure out what's going on. Since those nodes don't appear to be contributing to the bitcoin network, it doesn't seem like I'm harming it by dropping them, but I still feel bad doing it. But I also don't feel right with over half of my connections coming from one place! So, does anyone know if this is legitimate usage, perhaps an attempt at relaying SPV cients' transactions extra-quickly or the like? Is it a test or experiment of some sort? Or is there something nefarious going on?