Who/what is ns4006554.ip-198-27-80.net?

[iomfan]

ns4006554.ip-198-27-80.net has been visiting all sites of mine, including very recently established ones, so its visits appear to be not accidental but deliberate. Only the mainpages is accessed in each case.

This is a host, not a dynamic address, there is never a referer and only a generic browser description in the UA. This host appears to be located in Quebec, Canada (their homepage only shows the generic "Apache installed" information.

If anybody has more information I'd be interested in it. TIA :-)

[keyplyr]

Looks like OVH, a server farm based in Montreal, Canada (as well as France.) It's likely your intruder is one of their customers who is a bot runner.

[jmccormac]

Yep. Keyplyr beat me to it. It is an OVH range. There are at least six OVH ranges in North America.

Regards...jmcc

[keyplyr]

My OVH ban list:
5.39.0.0/17 #OVH 5.39.0.0 - 5.39.127.255
5.135.0.0/16 #OVH 5.135.0.0 - 5.135.255.255
8.7.244.0/24 #OVH 8.7.244.0 - 8.7.244.255
8.18.128.0/24 #OVH 8.18.128.0 - 8.18.128.255
8.18.136.0/21 #OVH 8.18.136.0 - 8.18.143.255
8.18.172.0/24 #OVH 8.18.172.0 - 8.18.172.255
8.20.110.0/24 #OVH 8.20.110.0 - 8.20.110.255
8.21.41.0/24 #OVH 8.21.41.0 - 8.21.41.255
8.24.8.0/21 #OVH 8.24.8.0 - 8.24.15.255
8.26.94.0/24 #OVH 8.26.94.0 - 8.26.94.255
8.29.224.0/24 #OVH 8.29.224.0 - 8.29.224.255
8.30.208.0/21 #OVH 8.30.208.0 - 8.30.215.255
8.33.96.0/21 #OVH 8.33.96.0 - 8.33.103.255
8.33.128.0/21 #OVH 8.33.128.0 - 8.33.135.255
8.33.136.0/24 #OVH 8.33.136.0 - 8.33.136.255
8.33.137.0/24 #OVH 8.33.137.0 - 8.33.137.255
37.59.0.0/16 #OVH 37.59.0.0 - 37.59.255.255
46.105.0.0/16 #OVH 46.105.0.0 - 46.105.255.255
77.111.192.0/18 #OVH 77.111.192.0 - 77.111.255.255
87.98.128.0/17 #OVH 87.98.128.0 - 87.98.255.255
91.121.0.0/16 #OVH 91.121.0.0 - 91.121.255.255
94.23.0.0/16 #OVH 94.23.0.0 - 94.23.255.255
109.190.0.0/16 #OVH 109.190.0.0 - 109.190.255.255
109.190.0.0/16 #OVH 109.190.0.0 - 109.190.255.255
142.4.192.0/19 #OVH 142.4.192.0 - 142.4.223.255
176.31.0.0/16 #OVH 176.31.0.0 - 176.31.255.255
178.32.0.0/15 #OVH 178.32.0.0 - 178.33.255.255
178.236.224.0/20 #OVH 178.236.224.0 - 178.236.239.255
188.165.0.0/16 #OVH 188.165.0.0 - 188.165.255.255
192.95.0.0/18 #OVH 192.95.0.0 - 192.95.63.255
192.99.0.0/16 #OVH 192.99.0.0 - 192.99.255.255
193.104.19.0/24 #OVH 193.104.19.0 - 193.104.19.255
198.27.64.0/18 #OVH 198.27.64.0 - 198.27.127.255
198.50.128.0/17 #OVH 198.50.128.0 - 198.50.255.255
198.100.144.0/20 #OVH 198.100.144.0 - 198.100.159.255
198.245.48.0/20 #OVH 198.245.48.0 - 198.245.63.255
213.186.32.0/19 #OVH 213.186.32.0 - 213.186.63.255 <=== iomfan, this is the range of your intruder
213.251.128.0/18 #OVH 213.251.128.0 - 213.251.191.255

[dstiles]

Thanks, Didn't have any of the level3 rubbish. :( Why do I not trust so many small ranges?

I also have...

37.60.48.0 - 37.60.63.255

emailing services maintained by ovh.

and you give twice...
109.190.0.0 - 109.190.255.255

[keyplyr]

Thanks, Didn't have any of the level3 rubbish. :( Why do I not trust so many small ranges?

At one point I had the Level3 8.0.0.0/8 blocked but soon found I was blocking numerous legit users. I now just block *that* Level3 at 8.28.16.0/23 and get the other companies therein on a case by case basis, as with OVH, to which it appears they have gradually been piecemeal acquiring the smaller subs .

I also have...

37.60.48.0 - 37.60.63.255

emailing services maintained by ovh.

Thanks

and you give twice...
109.190.0.0 - 109.190.255.255

Cut'n paste awkwardness, which I can legitimately blame on a poorly functioning IR mouse :)

[iomfan]

Thanks for the info...! :)