Reverse IP Lookup

[DonnaDuncan]

I have a client that has over 90,000 incoming links from a single IP address. I can't figure out who's linking to them.

I've used several different reverse IP lookup tools and can tell that the server is in Europe and ISP is AT&T Global Network Services Nederland B.V.. (http://www.ip-adress.com/reverse_ip/194.196.0.36) Says there's 0 hosts on that IP.

Any suggestions?

[FedeEinhorn]

How did he notice the links?

[DonnaDuncan]

The links are logged in Google Webmaster Tools.

[AndersS]

Hi Donna!

According to one of the websites I used, I found that the IP range is owned by At&t Global Network Services Nederland B.v as you said.

Using http://www.iplocationtools.com/194.196.0.36.html I found that this IP is reproted to belong to apple.com. Same goes when going to http://ipaddress.is/194.196.0.36#.U85nh7HzlyI

Does that make any sense?

Best regards,
Anders

[DonnaDuncan]

Hi Anders.

Thanks for helping. I notice that too, yet can't seem to find any evidence of Apple linking to my client.

I also used the link DTOX tool to see if they had a record of 90k incoming links from a single source. No luck.

I emailed at&t global network to see if they could help, and they want to see server logs of abusive links. I don't have that. All I have is an entry in Google webmaster tools saying we have 90,000 incoming links from 194.196.0.36.

I'm feeling stuck if you have any other suggestions. You or anyone else viewing this post....

[AndersS]

Hi Donna!

I know this is really a longshot, but i found this: http://www.zdnet.com/blog/apple/icloud-bug-creates-thousands-of-duplicate-bookmarks/12084. Given that the IP is supposed to be registered to Apple, and that it does not appear to have a host. Could it perhaps be that this is an iCloud server that has a ton of links/bookmarks to your site? I know it's a stretch but still...

If you click on the entry in GWT, are you able to see what subpages are linking your way? And are the links to your site direct links, or do they show as "via intermediate links"? If so, then it could be that someone has scraped your site. Or could it be that your client (or you clients hosting provider) has some sort of backup server or test/staging environment that resides on this IP and that for some reason was available to GoogleBot? See http://webmasters.stackexchange.com/questions/54100/gwmt-show-non-existent-backlinks-via-intermediate-link.

This is just me guessing, to please don't take this as definitive answers/solutions...
I hope you'll figure it out. Please share if you find the answer to this.

[DonnaDuncan]

Hi Anders.

You've put some thought and research into this and I really appreciate it. Thank you!

The duplicate bookmarks article is interesting and a possible root cause. I can't see what host or pages are linking to my client's site at all. I just know there are 90,160 inbound links from a single source (at 1194.196.0.36) to the home page. But the second discussion you posted seems like it might be a feasible explanation as well. Just no way to know for sure...

I'm wondering if I should ignore or disavow these links. I don't see any drastic change in visitor behavior recently, but given the client is fairly new, I  have no idea how long these links have been around. What do people think? Should I ignore or disavow?

Thanks again Anders!

Donna

[AndersS]

Hi!

Have a look at this video: https://www.youtube.com/watch?v=eFJZXpnsRsc

According to Matt Cutts here, you will not do anything wrong with disavowing the links.
My 2 cents...

Good luck, hope this helps!

Anders

[DonnaDuncan]

Perfect video to answer my last question.

Thank you.