IP Search Reveals Something Strange

Discussion in 'Site & Server Administration' started by Chiara, Sep 28, 2005.

  1. #1
    I wasn't sure where to post this, so here goes:

    I did a search on my IP in MSN and came up with something disturbing. I used the "IP: xxx xxx search". I have a dedicated server. What I am seeing is a load of sites that appear with my content. They have their own domain names but titles for my pages come up.

    The URL that shows under the title is like this:

    notmysite. com/ url.php?q=my topic

    When I hover my mouse over the search result, it shows something like this:

    http: // www .not my site.com/out.html?t=1&u=http%3A%2F%2Fwww. mysite .com/page .html

    (Where it says "not my site", that is the strange sites's URL... it starts with their URL and then does the "=" and then my site url appears.

    Okay, but when I click on the search result, it goes directly to my site.

    I'm baffled. It looks like they are up to no good, but what is it? What benefit do they get by sending traffic to my site like that??

    What am I missing and should I be concerned? There are 15 sites besides mine that come up under my IP address and redirect to me. wtf? :confused:
     
    Chiara, Sep 28, 2005 IP
  2. nevetS

    nevetS Evolving Dragon

    Messages:
    2,544
    Likes Received:
    211
    Best Answers:
    0
    Trophy Points:
    135
    #2
    It could be that they are using redirects to your site for a number of reasons:

    1) To spoof PR
    2) To try to steal your search rankings.
    3) To proxy into your site because they can't get to it directly.

    Seems to me that if they were trying to spoof PR or steal your rankings, they wouldn't do it with an out.html file. Probably proxying into your site - but I'd be wary and do a little more research.
     
    nevetS, Sep 28, 2005 IP
  3. Chiara

    Chiara Peon

    Messages:
    330
    Likes Received:
    8
    Best Answers:
    0
    Trophy Points:
    0
    #3
    Thanks for your response. What is proxying into a site? Why wouldn't the be able to get to it directly?
     
    Chiara, Sep 28, 2005 IP
  4. Chiara

    Chiara Peon

    Messages:
    330
    Likes Received:
    8
    Best Answers:
    0
    Trophy Points:
    0
    #4
    I just looked again. Most of them use an out.html file but a couple use a q=keyword thing.
     
    Chiara, Sep 28, 2005 IP
  5. NetMidWest

    NetMidWest Peon

    Messages:
    1,677
    Likes Received:
    151
    Best Answers:
    0
    Trophy Points:
    0
    #5
    NetMidWest, Sep 28, 2005 IP
  6. my3cents

    my3cents Peon

    Messages:
    332
    Likes Received:
    12
    Best Answers:
    0
    Trophy Points:
    0
    #6
    I would report it to MSN. I have the exact same problem on Yahoo. Sent a message to their SPAM hotline email and they responded saying they would investigate.

    I don't think there is a whole lot you can do yourself. But if you figure something out, be sure to keep us posted!

    Good luck.
     
    my3cents, Sep 28, 2005 IP
  7. Chiara

    Chiara Peon

    Messages:
    330
    Likes Received:
    8
    Best Answers:
    0
    Trophy Points:
    0
    #7
    Thanks, I just reported it to MSN. I found a site about page hijacking that said to do a server header checker and it says the links are 302 redirects. I haven't checked all of them.
     
    Chiara, Sep 28, 2005 IP
  8. nevetS

    nevetS Evolving Dragon

    Messages:
    2,544
    Likes Received:
    211
    Best Answers:
    0
    Trophy Points:
    135
    #8
    proxying is basically going to one server and seeing the content somewhere else - like www.virtualbrowser.com - there are a couple of open source scripts that do that kind of a thing - people use them for anything from surfing from work to getting past high school internet filters. If this is the case, the pages should not be getting indexed, so you've done nothing wrong in reporting them.

    The Keyword parameter seems a little shady too - you probably rank pretty high for that keyword. With that bit of info, I'd really lean towards them trying to steal your site's rankings.
     
    nevetS, Sep 28, 2005 IP
  9. NetMidWest

    NetMidWest Peon

    Messages:
    1,677
    Likes Received:
    151
    Best Answers:
    0
    Trophy Points:
    0
    #9
    http://forums.digitalpoint.com/showthread.php?t=28895

    Complaints about rankings plummeting...

    A search on Google for allinurl:netmidwest is showing some really bad signs...

    I don't like the looks of this...

    You can knock out most of those proxies by emailing the webhost or the upline providers, if you get no response. Most do not allow such proxies. Complaining about the 302 bug, and the possiblility of it stealing rank, along with the url above for resources on Darrin Ward's site might help in the others. Also, follow the advice Claus gives... http://clsc.net/research/google-302-page-hijack.htm#009 get a dedicated IP, link absolutely, etc.
     
    NetMidWest, Sep 28, 2005 IP
  10. Chiara

    Chiara Peon

    Messages:
    330
    Likes Received:
    8
    Best Answers:
    0
    Trophy Points:
    0
    #10
    I do have a dedicated IP so I thought that made me safer from stuff like this. MSN responded and asked for more info. I'm waiting to hear back after they look into it.
     
    Chiara, Sep 29, 2005 IP
  11. Chiara

    Chiara Peon

    Messages:
    330
    Likes Received:
    8
    Best Answers:
    0
    Trophy Points:
    0
    #11
    Well, since reporting this to MSN I've lost my Top 10 positions with MSN and am only receiving 50% of my usual traffic from them. Just a coincidence, I hope. They have not addressed the problem yet.
     
    Chiara, Sep 30, 2005 IP
  12. NetMidWest

    NetMidWest Peon

    Messages:
    1,677
    Likes Received:
    151
    Best Answers:
    0
    Trophy Points:
    0
    #12
    NetMidWest, Sep 30, 2005 IP