How do you know if a competitor is using Negative SEO against your site?

[deepsand]

Asked & answered.

[AVC]

It is just a coincidence that these hosting companies are in the same city Deepsand ?

It was also just an error that the "fake sites" happened to be hosted on Alan's host too ?

[deepsand]

Asked & answered.

[AVC]

Still some mysteries here that your side can't explain Deepsand ?

Funny how that works !

[deepsand]

"You can't learn what you don't want to know." - Anon.

[AVC]

I want to know the truth, lay it out and I will proclaim to the world what a complete moron I have been here Deepsand and tell everyone that "Deepsand won a debate against me" !!!

Get Terry to help you explain the hard stuff and the fuzzy math still going on here.

[deepsand]

Asked & answered.

[ddfrench]

Originally Posted by deepsand

However, if a wrong IP Address is entered into the Name Server for any Domain Name, and that Address happens to belong to a real resource, i.e. a DN which has "something there," then a request sent to the former DN will return the content of the latter one.

Here's something I don't follow. If domain A has the wrong server IP address in its DNS record, a request for any page on domain A will generate a response along the lines of "domain not found". If domain A does not exist on the server, it will not return a page from domain B (Alan's domain which is on the server).

If the only response is an error message, I don't see how the DNS errors would cause Alan's problems with Google.

[deepsand]

Originally Posted by ddfrench

Here's something I don't follow. If domain A has the wrong server IP address in its DNS record, a request for any page on domain A will generate a response along the lines of "domain not found". If domain A does not exist on the server, it will not return a page from domain B (Alan's domain which is on the server).

If the only response is an error message, I don't see how the DNS errors would cause Alan's problems with Google.

Resources are accessed via the IP Address; that IP Address identifies a hostserver, which in turn contains the data belonging to, in this case, a particular Domain Name.

If a Name Server has the wrong IP Address for a Domain Name, and that IP Address points to a hostserver that actually exists, then that server will contain, at the least, in this case, a default page, aka index or home page. Therefore, absent any additional parameters which specify a data file other than the default, any request made to that IP Address will return that page, not a 404 Error.

See the analogy with a telephone directory at How do you know if a competitor is using Negative SEO against your site? .

[deepsand]

Originally Posted by ddfrench

Here's something I don't follow. If domain A has the wrong server IP address in its DNS record, a request for any page on domain A will generate a response along the lines of "domain not found". If domain A does not exist on the server, it will not return a page from domain B (Alan's domain which is on the server).

If the only response is an error message, I don't see how the DNS errors would cause Alan's problems with Google.

Here's an experiment you can perform that will illustrate the situation at hand.

Of IBM's many IP Addresses, one is 129.42.56.216; enter this IP Address into your browser's address bar, hit Enter or Go, and you will get the default page IBM United States .

If another Domains Name's Name Server points to 129.42.56.216, anyone going to www.that-other-domain-name.ext will get that IBM page.

However, IBM does not have any resource at http://129.42.56.216/my-webproblog , which you can see by clicking on the preceding link, which will yield a Custom 404 error.

And, so will www.that-other-domain-name.ext/my-webproblog, as such is actually trying to access 129.42.56.216/my-webproblog .

The Domain Name is, via the Name Server, translated into an IP Address; any parameters following the Domain Name are then appended to that IP Address.

If the hostserver at that IP Address has a resource that matches that requested, it will serve it up. And, as the default page require no parameters, a bare IP Address will yield that default page on that IP Addresses's hostserver.

[ddfrench]

Originally Posted by deepsand

Here's an experiment you can perform that will illustrate the situation at hand.

Of IBM's many IP Addresses, one is 129.42.56.216; enter this IP Address into your browser's address bar, hit Enter or Go, and you will get the default page IBM United States .

Got it.

Originally Posted by deepsand

If another Domains Name's Name Server points to 129.42.56.216, anyone going to www.that-other-domain-name.ext will get that IBM page.

In this case yes. However, on a shared server, some default message would be issued; either an error message or an ad or some other customized page.

Originally Posted by deepsand

However, IBM does not have any resource at http://129.42.56.216/my-webproblog , which you can see by clicking on the preceding link, which will yield a Custom 404 error.

And, so will www.that-other-domain-name.ext/my-webproblog, as such is actually trying to access 129.42.56.216/my-webproblog .

Correct

Originally Posted by deepsand

The Domain Name is, via the Name Server, translated into an IP Address; any parameters following the Domain Name are then appended to that IP Address.

If the hostserver at that IP Address has a resource that matches that requested, it will serve it up. And, as the default page require no parameters, a bare IP Address will yield that default page on that IP Addresses's hostserver.

OK, now I just ran a test on my own static IP address. Unfortunately, there is only one domain at that static IP address. In my test, a request to that IP address returned the default page of my domain. My browser showed http://my.IP.address/ in the address bar.

Can the problem be summarized as numerous unrelated domains with incorrect DNS records pointing to a server with Alan's home page as the default for that IP address? Is the problem caused by the hosting company's incorrect server settings?

I appreciate your explanations because many of us put in a lot of time following this thread, and it would be a pity if we could not come away with a concrete understanding of the problems.

[Terry Van Horne]

Throw into the scenario the explaination of deepsand plus the fact it is a windoze server which the ISA server onlinedesigns has confirmed had a misconfigured host header which ISA Server the windoze firewall allowed the IP to be IMO, accessed by Iuser. That is why the content looked mirrored, it was!

AVC I have to make the assumption that you are used to a NIX environment. IMO, you seemed to be comparing apples to oranges. How a windoze server is setup and runs is very different from NIX especially if they haven't gone for the Apache webserver (sucks big time, leaks like a sieve) on windows. I'm trying not to dis you but it's pretty hard not to when you cling to calling people liars for apparently no reason other than your inability to accept it was an error on the part of the hosting company. Shit happens... let it go.

[Terry Van Horne]

I would like to add the following info to this discussion because I think this is an issue easily avoided. M$ changed the defaults for much of it's webserver and outside/remote software. In early editions everything was wide open in the last few editions this stuff was entirely locked down. ISA (windoze firewall) is a pig to configure. 1 problem is that you can only bind 1 IP to ISA and the rest is done through host headers that have to work with a number of access rules on the ISA server. When my brother, an admin of a large windoze network with a lot of remote access, spent about 5 minutes reading this thread and said "ISA server problem" the domain records don't mean anything, he told me about the whois and since I had to register a domain... I decided to test his theory on domain info. I had been registering domains in other peoples names for years and never gave it a second thought... until my discussion with him.

Bottom line if you are on windoze sweep the IP to see what is hosted on the IP. DNSstuff.com has some of the best tools I've come across for verifying DNS configuration and IP info.

[Terry Van Horne]

Originally Posted by ddfrench

OK, now I just ran a test on my own static IP address. Unfortunately, there is only one domain at that static IP address. In my test, a request to that IP address returned the default page of my domain. My browser showed http://my.IP.address/ in the address bar.

Ok understand that this problem is a hosting problem, IMO, quite possibly windoze specific in that in this case it was an ISA/host header misconfiguration. 1 IP is cool and Good but does not protect you from this unless the host header and ISA server knows only to show that domain. Personally, we do it using an internal 10. system but... that requires a VPN to author.

Originally Posted by ddfrench

Can the problem be summarized as numerous unrelated domains with incorrect DNS records pointing to a server with Alan's home page as the default for that IP address?

No, it's all about the host settings, IMO, why AVC's participation was noise interfering with the signal. What was there doesn't matter and the bad DN IP pointer does not work if the host header is correct.

Originally Posted by ddfrench

Is the problem caused by the hosting company's incorrect server settings?.

IMO, the only way this can happen!

[ddfrench]

There were a lot of inexplicable facts that were introduced in the thread, so I don't blame anyone for challenging what was said. I couldn't accept a lot of what was written, and aside from what I can currently verify, I still question some of the early responses.

Today, when I did a reverse-IP lookup, there were 25 domains on Alan's dedicated IP address. Before knowing about the Windows server settings, I questioned the claim that most of the domains were owned by third parties. How could they add their domain to Alan's hosting account? (We now have an explanation.)

If so many domains became mirrors of Alan's website, wouldn't a few of the domain name owners wonder why their website was broken or advertising a taxi service? Now, these domains are advertising a hosting company. If this has been going on for months, why wasn't the problem reported by at least a few of the domain owners? The same DNS server contained the IP address errors.

It will be interesting to do another reverse-IP lookup in a few months. I wonder how many of these unaffiliated domains will still be advertising the hosting company?

Aside from what we can observe, it's not clear what's really going on.

Perhaps the key lesson is for those of us that have domains on dedicated IP addresses. Enter your IP address in your browser and see what is returned. Do a periodic reverse IP lookup to make sure that there are no unwanted mirrors (as in Alan's case).

[AVC]

Right, it was all just a simple error guys, Terry has proven this as fact.

216.26.128.0-216.26.191.255 PEAK10-LOU-BLK-1
<<216.26.144.192 ccwwinc.com >>216.26.144.194 issimro.com
216.26.128.0/18 TelCove BGP Customer netblock
AS16482 XODIAX Xodiax, LLC
216.26.128.0-216.26.191.255 PEAK10-LOU-BLK-1
216.26.144.193 al-hobayb.net A
al-omair.net A
alansairportcars.com A
alexi-international.com A
alhabash.net A
alomair.net A
alteredfleshtattoo.net A
braceletsonline.net A
cohannethill.net A
fascae.com A
filitheyo.com A
hockleytaxis.com A
host193.216.26.144.empiredatatech.com PTR
nonprofitcity.net A
noveltysongs.com A
rochfordtaxis.com A
therapypooldesign.com A
uknumber1chauffeurs.com A
wolfenwicca.com A

[deepsand]

Originally Posted by ddfrench

If so many domains became mirrors of Alan's website, wouldn't a few of the domain name owners wonder why their website was broken or advertising a taxi service? Now, these domains are advertising a hosting company. If this has been going on for months, why wasn't the problem reported by at least a few of the domain owners? The same DNS server contained the IP address errors.

A look that the Wayback Machine's Archives, links to which I earlier provided, show that the other DNs were inactive from their inceptions. Therefore, there was no reason for the owners of those DNs to be reporting problems.

And, as I also earlier noted, had it been the case that those DNs were to be active ones, and as the mis-mapping of IP Addresses occurred prior to Alan's site having experienced a problem, it stood to reason that one or more of those other DN owners would have already reported the problem, such that it would have been previously repaired & we would not have been having this discussion. Since such had not happened, it was logical to conclude that said other owners were quite oblivious to the problem.

[AVC]

So these were just old sites residing on that IP and the host never took them off or out of the loop and sold this "dedicated IP" to Alan then ?

[deepsand]

There's no evidence that these DNs were actually ever used, only that they were parked.

And, absent a complete hosting record, along with that of IP Address Assignment Transfers, it's not possible to say when & by whose hands this snafu occurred.

[deepsand]

Originally Posted by ddfrench

Quote:
Originally Posted by deepsand
If another Domains Name's Name Server points to 129.42.56.216, anyone going to www.that-other-domain-name.ext will get that IBM page.


In this case yes. However, on a shared server, some default message would be issued; either an error message or an ad or some other customized page.

Firstly, one must make the distinction between a shared server and a shared IP Address. The former is a Physical Device, which may incorporate multiple Logical Devices.; the latter, a Logical Device, pointing to a Physical Device.

A Domain Name is resolved to an IP Address using the top 2 levels only; the 3rd level, e.g. "www" or "ftp," define the Service. An IP Address, together with the Service prefix, denote a specific hostname on a specific physical device.

A single physical server can service multiple IP Addresses, via IP filtering, thus effectively becoming multiple servers; this is known as IP-based virtual hosting, aka dedicated IP hosting.

Name-based virtual hosting, aka shared IP hosting, is the binding of multiple IP Addresses to a single physical host. If such a system receives a request using the IP Address only, it will return the default host. This is done so as to provide backward compatibilty with browsers that do not send the hostname as part of the request. To access a host other than the default using an IP Address requires that the request include the name of that virtual host; i.e., of the form http://127.0.0.1/~virtualhostname.

Therefore, regardless of the type of hosting system, a request made to a valid naked IP Address will return an index page.