OVH Visitors - Genuine Or Not?

[RedBar]

Every now and then I get a couple of hudred PVs usually from OVH Canada. These PVs are always individual PVs in that the same page is viewed twice, logged-off then a few seconds later move on to another page for two views, then repeated for another page etc.

The browser and OS usually changes yet the IP does not during these visits.

Occasionally I see OVH from France however Canada is the most regular sometimes a couple of times a month. It used to be more often however this year it has noticeably decreased.

I doubt these are genuine visits and in the overall traffic it is not a lot however is there any way of telling if they are genuine or should I simply not bother?

[not2easy]

This is my old list of blocked OVH IPs:
OVH - 5.39.0.0 - 5.39.127.255
5.39.0.0/17
OVH - 5.135.0.0 - 5.135.255.255
5.135.0.0/16
OVH - 8.7.244.0 - 8.7.244.255
8.7.244.0/24
OVH - 8.18.122.0 - 8.18.122.255
8.18.122.0/24
OVH - 8.18.128.0 - 8.18.128.255
8.18.128.0/24
OVH - 8.18.136.0 - 8.18.143.255
8.18.136.0/21
OVH - 8.18.172.0 - 8.18.172.255
8.18.172.0/24
OVH - 8.20.110.0 - 8.20.110.255
8.20.110.0/24
OVH - 8.21.41.0 - 8.21.41.255
8.21.41.0/24
OVH - 8.24.8.0 - 8.24.15.255
8.24.8.0/21
OVH - 8.26.94.0 - 8.26.94.255
8.26.94.0/24
OVH - 8.29.224.0 - 8.29.224.255
8.29.224.0/24
OVH - 8.30.144.0 - 8.30.144.255
8.30.144.0/24
OVH - 8.30.145.0 - 8.30.145.255
8.30.145.0/24
OVH - 8.30.146.0 - 8.30.147.255
8.30.146.0/23
OVH - 8.30.208.0 - 8.30.215.255
8.30.208.0/21
OVH - 8.33.96.0 - 8.33.103.255
8.33.96.0/21
OVH - 8.33.128.0 - 8.33.135.255
8.33.128.0/21
OVH - 8.33.136.0 - 8.33.136.255
8.33.136.0/24
OVH - 8.33.137.0 - 8.33.137.255
8.33.137.0/24
OVH - 37.59.0.0 - 37.59.255.255
37.59.0.0/16
OVH - 37.60.48.0 - 37.60.63.255
37.60.48.0/20
OVH - 37.187.0.0 - 37.187.255.255
37.187.0.0/16
OVH - 46.105.0.0 - 46.105.255.255
46.105.0.0/16
OVH - 77.111.192.0 - 77.111.255.255
77.111.192.0/18
OVH - 87.98.128.0 - 87.98.255.255
87.98.128.0/17
OVH - 91.121.0.0 - 91.121.255.255
91.121.0.0/16
OVH - 92.222.0.0 - 92.222.255.255
92.222.0.0/16
OVH - 94.23.0.0 - 94.23.255.255
94.23.0.0/16
OVH - 109.190.0.0 - 109.190.255.255
109.190.0.0/16
OVH - 142.4.192.0 - 142.4.223.255
142.4.192.0/19
OVH - 167.114.0.0 - 167.114.255.255
167.114.0.0/16
OVH - 176.31.0.0 - 176.31.255.255
176.31.0.0/16
OVH - 178.32.0.0 - 178.33.255.255
178.32.0.0/15
OVH - 178.236.224.0 - 178.236.239.255
178.236.224.0/20
OVH - 188.165.0.0 - 188.165.255.255
188.165.0.0/16
OVH - 192.95.0.0 - 192.95.63.255
192.95.0.0/18
OVH - 192.99.0.0 - 192.99.255.255
192.99.0.0/16
OVH - 193.104.19.0 - 193.104.19.255
193.104.19.0/24
OVH - 198.27.64.0 - 198.27.127.255
198.27.64.0/18
OVH - 198.50.128.0 - 198.50.255.255
198.50.128.0/17
OVH - 198.100.144.0 - 198.100.159.255
198.100.144.0/20
OVH - 198.245.48.0 - 198.245.63.255
198.245.48.0/20
OVH - 213.186.32.0 - 213.186.63.255
213.186.32.0/19
OVH - 213.251.128.0 - 213.251.191.255
213.251.128.0/18

That list is over 4 years old and there are more scattered into the monthly files for the date they were first noticed.

Another OVH discussion: [webmasterworld.com...]

OVH is a worldwide server farm, they host sites - and other things. It is known that they host proxies/VPNs that might have human users. If you want to know for sure, you should consider logging headers or finding these visits in your access logs to see if/whether they request all resources to view pages or only a select format, say for example, they request .html files without the .css linked to it. I am suspicious of repeat "GET" visits without all the resources a human might want. UAs are sort of whatever you tell them to be.

[RedBar]

Thanks, obviously OVH do have "genuine" users and it's causing me no problem whatsoever however I've copied the IPs just in case they become needed!

[dstiles]

> list is over 4 years old

The list below (72 items) has some recent additions you may not have.

5.39.0.0 - 5.39.127.255
5.135.0.0 - 5.135.255.255
5.196.0.0 - 5.196.255.255
8.7.244.0 - 8.7.244.255
8.18.122.0 - 8.18.122.255
8.18.128.0 - 8.18.128.255
8.18.136.0 - 8.18.143.255
8.18.172.0 - 8.18.172.255
8.20.110.0 - 8.20.110.255
8.21.41.0 - 8.21.41.255
8.24.8.0 - 8.24.15.255
8.26.94.0 - 8.26.94.255
8.29.224.0 - 8.29.224.255
8.30.208.0 - 8.30.215.255
8.33.96.0 - 8.33.103.255
8.33.128.0 - 8.33.137.255
37.59.0.0 - 37.59.255.255
37.60.48.0 - 37.60.63.255
37.187.0.0 - 37.187.255.255
46.105.0.0 - 46.105.255.255
51.38.0.0 - 51.38.255.255
51.68.0.0 - 51.68.255.255
51.75.0.0 - 51.75.255.255
51.77.0.0 - 51.77.255.255
51.81.0.0 - 51.81.255.255
51.83.0.0 - 51.83.255.255
51.89.0.0 - 51.89.255.255
51.91.0.0 - 51.91.255.255
51.161.0.0 - 51.161.255.255
51.178.0.0 - 51.178.255.255
51.195.0.0 - 51.195.255.255
51.222.0.0 - 51.222.255.255
51.254.0.0 - 51.255.255.255
54.36.0.0 - 54.39.255.255
66.70.128.0 - 66.70.255.255
77.111.192.0 - 77.111.255.255
79.137.0.0 - 79.137.127.255
87.98.128.0 - 87.98.255.255
91.121.0.0 - 91.121.255.255
91.134.0.0 - 91.134.255.255
92.222.0.0 - 92.222.255.255
94.23.0.0 - 94.23.255.255
109.190.0.0 - 109.190.255.255
137.74.0.0 - 137.74.255.255
139.99.0.0 - 139.99.255.255
142.4.192.0 - 142.4.223.255
142.44.128.0 - 142.44.255.255
144.217.0.0 - 144.217.255.255
145.239.0.0 - 145.239.255.255
147.135.0.0 - 147.135.255.255
149.56.0.0 - 149.56.255.255
149.202.0.0 - 149.202.255.255
151.80.0.0 - 151.80.255.255
158.69.0.0 - 158.69.255.255
164.132.0.0 - 164.132.255.255
167.114.0.0 - 167.114.255.255
176.31.0.0 - 176.31.255.255
178.32.0.0 - 178.33.255.255
178.236.224.0 - 178.236.239.255
185.15.68.0 - 185.15.71.255
188.165.0.0 - 188.165.255.255
192.95.0.0 - 192.95.63.255
192.99.0.0 - 192.99.255.255
193.70.0.0 - 193.70.127.255
198.27.64.0 - 198.27.127.255
198.50.128.0 - 198.50.255.255
198.100.144.0 - 198.100.159.255
198.245.48.0 - 198.245.63.255
213.32.0.0 - 213.32.127.255
213.186.32.0 - 213.186.63.255
213.251.128.0 - 213.251.191.255
217.182.0.0 - 217.182.255.255

[tangor]

Heh ... I was pretty much OVH free until this post appeared. :)

Got hit with a batch, so THANKS TO ALL for the headsup on IP ranges!

[JorgeV]

Hello,

From my experience nothing good comes form OVH, excepting Qwant crawler (but I don't know if they still use OVH's IP range).

So I "block" OVH ranges, at the level of their ASN. By blocking, I mean that, I am displaying an home-made captcha challenge, just in case real visitors are coming from a VPN. But so far, no one from an OVH IP has answered the captcha challenge. So , may be they are lazy, or may be they are not really humans.

That being said, if you are have legitimate audience from France, make a difference between OVH 's host IP range, and OVH Telecoms IP range. Because OVH also proposes DSL,and Fiber connection for companies' offices and also home users.

[dstiles]

qwant has its own range 91.242.162.0/24.

[lammert]

OVH uses AS block AS16276 which is used for their world-wide operations in Canada, France and a few other countries where they have smaller subsidiaries. Instead of relying on four-year-old manually maintained lists, you may want to check this AS block on one of the online IP services to get the current list of their IP addresses.

[RedBar]

AS block AS16276

Oh, wow, that chucks up lots of info, thanks.

[tangor]

PLEASE! Stop commenting on OVH! I just got hit by three more! (Seriously, keep it coming, my Deny entries have trebled in size!)

All thanks, half joke, half sigh and half ... wait, too many halfs!

Looking back through my last two years of logs I do note those ips were pretty spare ... THIS year, however, has come on like gang busters.

[lucy24]

Anecdotal data point: As noted elsewhere, my access controls are primarily header-based. But over the years I’ve been obliged to add a few IP-based lockouts, meaning IP ranges that never bring anything good and therefore aren’t subject to the usual !bad_range exemption. Within this small group, the single largest offender is OVH.

[brotherhood of LAN]

Curious why maintainers don't use RDAP as a programmatic means to maintain ranges? Always wondered if the whack-a-mole of IP abusers is a hobby rather than a science...

You can grab the OVH ranges as an up to date list on a daily basis quite trivially. FWIW OVH being a huge provider (the largest in Europe IIRC), you either tar the whole brush or look at it as one of the largest ISPs in the world, often popular for ToR exit points and private proxies so YMMV.