McAfee SiteAdvisor Blog

(Thanks go to our tech team for spearheading this inquiry.)

Look around the SiteAdvisor team, and there’s always someone with a furrowed brow. We’re constantly discovering new scams and surreptitious online behavior. Today we'll explore a hosting practice we call “IP bunkmating." (Others call it “host multiplexing" or “IP sharing.")

Web sites are all stored on servers, and each server has an IP address. When more than one site is located at the same IP address, it could mean one of two things:
1) The hosting company decided not to allocate a unique address to each of their clients. (This isn’t a bad idea for many sites, and it’s required by some IP registries’ rules.)
2) One organization is running multiple sites on the same server. This is easier for them – fewer physical servers mean less to set up and less to maintain.

In the first case, there’s generally no relationship between the sites that happen to share a server. If you care to learn more about Web sites sharing IP addresses, you can read spyware researcher Ben Edelman’s related article. But in the second case, there’s an increased likelihood that sites will be similar. After all, a company with one “red" site might well have other bad business practices too, possibly extending into unrelated ventures. Below are some examples of sites we found based on their similarities with sites we already rated as red.

The IBIS Umbrella

IBIS is a known provider of what many people would consider adware, spyware or other unwanted programs. According to spywareguide.com, the IBIS Toolbar logs URLs of webpages, shows ads, changes browser home pages, and overwrites affiliate tracking. Many, but not all, of the sites hosted on the ip address 146.82.109.220 are registered to or have business partnerships with IBIS. Some of these sites are: (links go to respective SiteAdvisor site details pages)

IBIS Bunkmates

404-errorpage.com
bestjobsguide.com
bestphonesguide.com
bigromantic.com
financeadvisor.com
fitnessandhealth.com
guideforyou.com
internetandcomputers.com
mp3radio.com
seekerbar.com
spywarelinkcentral.com
travelandyou.com
ways2business.com
websearch.com
websecurityguard.com

Though the labels of Web destinations like financeadvisor.org, fitnessandhealth.us, and bigromantic.com imply a specific site focus, all these sites act as poorly executed placeholders for an IBIS-operated search engine, websearch.com. This certainly isn't illegal, but it is misleading. You won't see Google redirecting to its search engine from "timetoeatthedonuts.com".

The designers at Websearch.com seem to be big fans of Yahoo!’s layout. Is it possible that websearch.com is mimicking Yahoo!’s familiar front page design in order to trick users into feeling confident about interacting with their site? Archived front-page images for Websearch.com indicate this is a recent design change.

Websearch.com and Yahoo! feature similar layouts. Red, Blue, Green, & Purple Rectangles are superimposed to highlight similar regions.

Seekerbar.com, another IBIS site, features an identical front page to Websearch.com. We've examined this phenomena before: it's cheap to register new domain names, and even new ip addresses. Redesigning complete Web sites is much more expensive. So profit-minded toolbar and adware distributors tend to re-use design, text, and programming code to save time and money.

Websearch.com may look like Yahoo! on the surface, but don't try to compare the reputations of the two sites in terms of safety. According to Websearch.com, they have "seized distribution" (from their Toolbar page, we think they meant ceased) of the IBIS-developed Websearch toolbar, which received an 8 out of 10 nuisance score from SpywareGuide.com because it "Logs activity, uses stealth installation and removal is difficult." Besides developing the ruthless Websearch toolbar, SpywareGuide.com awarded two other IBIS products (Huntbar and IBIS Toolbar) 6 out of 10 nuisance scores for showing ads, stealth tactics, and logging Web page URLs.

Currently, websearch.com and seekerbar.com are redirecting all toolbar queries and top-navigation bar links to a toolbar from Crawler, which is also developed by IBIS. Crawler.com is currently rated red by SiteAdvisor because of its relationship to IBIS, but it will likely earn a yellow rating in the future barring software or EULA policy changes. (Our tests of the Crawler toolbar indicate a yellow rating would apply because the toolbar automatically opts users in to a homepage switch during the install sequence.)

Linda Tripp Has Something In Common With SheMales

There are plenty of instances where Web sites share an IP address even though they actually have no business relationship and nothing in common. For example, FamilyCareGiversOnline.com is bunked with smut and adware hawker Portale93.com. We see no sign of any relationship between these two sites; rather, they’re both just renting server space from Lunarpages.com.

Some of our history teacher readers may have come across the helpful resource HistoryTeacher.net. This site shares an IP address with sexybabesx.com, which is loaded with videos that conceal adware. There’s no apparent connection between these two sites beyond their host and IP address.

Speaking of an obscured motive, recall Linda Tripp, who uncovered the Lewinsky/Clinton affair in 1998. Her Web host paired LindaTripp.com with beautyshemale.com on the same ip address (67.15.35.182) together with another site that is too outrageous for us to reference. We assume this is all an unfortunate coincidence.

Unexpected consequences can result from a Web site sharing its IP address with sketchy neighbors. For example, when major mail providers detect spammers, the spammer’s IP address is frequently added to a “block list" that prevents delivery of future e-mail originating from the same IP address. Sounds great – until you consider multiple servers all sharing an IP. IP-based blocking can cause blocking of legitimate e-mail sent from an unaffiliated entity that merely happens to share that same IP address.

For example, HistoryTeacher.net is an excellent educational resource that shouldn’t be grouped together with pornographic content by spam filters that check for IP addresses. Furthermore, we assume Linda Tripp would like to have her e-mails delivered. (She probably sends thank you e-mails to everyone that sends “legal fund donations" via her site’s online form.) For the highest level of reliability, a Web site will want to ensure it has its own IP address.

The moral of this tale is twofold:
• IP address mapping can help uncover groups of related sites that are trying to mask their affiliation. This is one of SiteAdvisor’s many research tools for hunting down related "red" and "yellow" sites.
• If you’re sharing an IP address, get to know your neighbors. Having a legitimate site located on the same server as a crass or dishonest Web venture can be embarrassing and might restrict your ability to reach the widest possible audience.

Make Us Laugh, Get A SiteAdvisor T-Shirt

We’d love to hear your own discoveries about ‘strange bedfellows’ sharing the same IP address. We'll send a SiteAdvisor t-shirt to anyone who submits an entry that makes us laugh out loud.