Of course I can't sniff your traffic arbitrarily.  You can only view traffic on the wire where you are located - so, if you have a server in a data center on the same switch as a pool, for example, you could view all the traffic inbound to the pool.

And OVH is far from a "virtual hoster" - they are one of the largest private data center providers in the world.

---

This is all pretty basic networking stuff.  You want a demo of sniffing packets?  Connect two machines to the same network switch, fire up wireshark on one machine and start monitoring (can filter based on the other machine's IP if you want), and then go to a few websites on the second machine.

---

A forums post made by an OVH tech that was written last month, suggests that intercepting traffic was definitely still possible at OVH (they claim they are updating their switch configuration with a feature that prevent this):
https://forum.ovh.us/showthread.php/306-Misdirected-traffic-on-dedicated-server

It looks like in the case of OVH, some form of DoS attack may be necessary to knock the intended host offline in order to intercept tcp headers.  That OVH employee post certainly confirms in my mind that, when combined with another server at a host that fails to implement BCP38, the attack method I proposed is definitely possible.