Can someone explain this to me?

NegativeONE · Post by **NegativeONE** » Sat Jul 08, 2006 12:48 pm

Hello there chums,
I'm the admin of a flash site called negativeflash.com and while I was rifling through my list of top referrers the other day, I couldn't help but notice this one - http://www.negativeflash.com/~libriuma/ ... wtopic.php .
It definitely wasn't anything I'd uploaded or put together myself, and when I followed the link, it lead here. It doesn't seem related to the subject matter of my site in any way, so I'm not sure I understand the situation. Moreover, how does it appear that it's hosted on my space, by that linking URL?

Hotfoot · Post by **Hotfoot** » Sat Jul 08, 2006 1:17 pm

I smell something bad. Don't anyone click on that link.

Post by **B4UTRUST** » Sat Jul 08, 2006 1:20 pm

Moved from Out of Character to Great Hall where it is more appropriate.

Alright, lets try to address these issues.

The reason for this is the following:
1) ADMHosting, our provider. We(our sites that is) are shared on the same system and through the same IP address.
2) This results in a "layered" approach to hosting, I suppose you could say. In other words we share the same IP address and as a result our sites appear to be linked in such a regard. How exactly this works I'm not sure, I could do a few inquries with some of my more technical savants for a better explination.
3) Thus, if someone were to type in our shared IP address with the subdomain link of ~libriuma they are linked to the Librium Arcana homepage.

As for why your domain acts as a linker as well, I can only assume you were the first or primary site hosted on the particular server we are both resident on. My suggestion in this case is to contact ADM support if you feel this is a technical issue that needs resolving. I know some of the members here at Librium do indeed access the site via IP address since their work places do block the site, myself included on occassion.

I hope this helps to resolve your questions. Feel free to contact me or any of the other administrators if you have further questions. Also, if you are intending to stay on as a member of the Librium comunity please make an introduction in the approrpiate thread which is stickied in the Great Hall.

Administrator,
B4UTRUST

Destructionator XV · Post by **Destructionator XV** » Sat Jul 08, 2006 9:55 pm

2) This results in a "layered" approach to hosting, I suppose you could say. In other words we share the same IP address and as a result our sites appear to be linked in such a regard. How exactly this works I'm not sure, I could do a few inquries with some of my more technical savants for a better explination.

All our sites, including the admhosting.net site, are on the same server, located at address 66.45.237.250.

When you go to one of the sites, your browser sends along what page you want and the host you want.

For example, when you navigate to http://libriumarcana.com/phpBB2/index.php , your browser sends the following to the server located at 66.45.237.250 on port 80:

GET /phpBB2/index.php HTTP/1.1
Host: libriumarcana.com
(and some other irrelevant information to this discussion)

The program on the server (the Apache HTTPD program) receives this information and does the following:

Looks up host libriumarcana.com in its configuration file, to learn its www files directory (which is /home/libriuma/public_html ).

It changes to that directory, and looks up the requested file (in this case, /phpBB2/index.php )

If finds the file /home/libriuma/public_html/phpBB2/index.php, does some processing on it (for a php file, it runs the script, for normal html files, it just dumps the contents), and sends the output back to the user's browser along with some additional information (like cookies and such).

Well, that is how it works, but now lets look at the special case of the ~ character in a folder name.

In most Linux shells (the server runs Linux), the ~ character when used as a folder means the user's home directory ( /home/username in most configurations). If you type ~username, it will bring you to the home of that username, no matter what user you are logged in as.

When the Apache server sees that symbol, it interpretes it as meaning the home www directory of that user. So, ~libriuma will be translated to /home/libruma/public_html . This is a common convience system used on many shared hosts.

Now, let's see what happens when you go to, for example,

http://www.admhosting.net/~libriuma/phpBB2/

First, the browser connects to the shared server, 66.45.237.250. It sends the following request:

GET /~libriuma/phpBB2 HTTP/1.1
Host: www.admhosting.net
(some more info that we don't care about)

So again, it looks up www.admhosting.net in its config, and finds its home www directory, which is probably /home/admhosting/public_html (I don't know for sure about the name, but the example remains valid)

It changes to that directory, and asks for the file /~libriuma/phpBB2 .

But remember the ~ symbol means it will look up that username's home instead of just using the normal folder!

So, it gets redirected to /home/libriuma/public_html/phpBB2/ and dumps that file back instead!

That is exactly what happened in your situation. As you can see, the same thing happens when going through admhosting.net/~libriuma/ , and the same thing would happen if you were to go to http://libriumarcana.com/~your_username/

The real question is how that link got in your referers [sic] list in the first place. Next post, I will explain how referers [sic] work in general, and hopefully propose a theory as to why this happened to you.

Destructionator XV · Post by **Destructionator XV** » Sat Jul 08, 2006 11:23 pm

Fuck, I'm pissed. Just typed up a complete explaination of HTTP and referers, and the frakking browser discarded my message. Well, I'm just going to cut to my conclusion this time. See RFC 2616 if you really want to know about HTTP.

From the evidence here, I must conclude you are a liar who concocted this and posted here simply as a way to advertise your site. If what you say is true, than many people typed in their address bars that obscure URL, http://www.negativeflash.com/~libriuma/ ... wtopic.php, and on that page, clicked a link back to your site, which is not possible since that is an empty error page.

Unless you can provide more evidence in your defense, such as the query string off the referer, which would include the thread ID, and/or the IP addresses of the people who allegedly went to your site under that referrer so I can cross reference them with our records, I will have to recommend to the administration that you are simply a spamvertiser and should be dealt with as such.

NegativeONE · Post by **NegativeONE** » Mon Jul 10, 2006 2:42 pm

Thanks for your reply, B4UTRUST. That's easily as much explanation as I needed. Above all, I was unaware that you guys were with adm. That alone begins to explain matters.

I'm less fond of the other replies. I don't mean to belittle this forum but I could definitely have chosen much more populated and - for that matter - topical places to advertise my site if that was my interest. The only forum on which I personally advertise my site is the Newgrounds forum, and even the response there doesn't come close to comparing with the traffic generated by the release of one of my games, or the showcasing of a game on a popular site. The effort of signing up to a small forum where you have to wait to have your account approved and concocting some scheme in hopes that a few people will pass through my site is ridiculous.

Here's the list of referrers that brought this all to my attention. Yes, it could have been doctored, but what do I lose if you don't believe me? I've gotten the information I came for. This is for you, Destructionator XV.
http://www.negativeflash.com/referrers.gif

[sic] is by the way the favorite tool of the pretentious. The list is clearly labeled as Referrers, which is the context in which this url was presented to me. Futhermore, be it that it's arranged starting from the most popular and proceeds in a descending order, I really don't see how appending a qualifier like "top" makes it such a misnomer. If you're interested in this forum growing and progressing, try not to bark at every passer by for asking an honest and polite question.

Hotfoot · Post by **Hotfoot** » Mon Jul 10, 2006 3:07 pm

I've found from experience that people don't care how much traffic a forum gets, they'll advertise on it anyway, but that's beside the point. When someone comes in from nowhere with a link that behaves very strangely, I get edgy. Too often it is some jerk trying to infect unsuspecting people iwith some worm or virus. I'm very cautious when it comes to security and such.

Honestly, I don't care about your popularity or what have you. My only concern in posting to this thread was that there was a possible risk from clicking that link, and until more information was revealed, I didn't want anyone clicking on it just to be safe.

Destructionator XV · Post by **Destructionator XV** » Mon Jul 10, 2006 3:27 pm

NegativeONE wrote:I don't mean to belittle this forum but I could definitely have chosen much more populated and - for that matter - topical places to advertise my site if that was my interest.

...

The effort of signing up to a small forum where you have to wait to have your account approved and concocting some scheme in hopes that a few people will pass through my site is ridiculous.

Indeed, though such a scheme would be rather clever.

Yes, it could have been doctored, but what do I lose if you don't believe me?

It could be, but as you pointed out, a little forum like this one wouldn't be worth the trouble. I am now more inclined to believe you since I have some harder evidence than just a stranger's word.

With this evidence, I have decided to amend my analysis slightly. Upon further review, I can dismiss about 90% of those referred hits, because requests for the stylesheet and images would show up on that list too. But that does still beg the question of how such a bizarre URL would come to be used anyways. From our own logs, there is only one user who has accessed this board through that link: you. However, it is true that our logs would only show someone who indeed followed one of those links back to use; any others would only show up on your logs.

I no longer believe you to be a liar as I did, however this situation is still very peculiar.

[sic] is by the way the favorite tool of the pretentious.

It is appropriate for this situation. I spelled it "referer" because that is how it is spelled in the HTTP specification, and is therefore how browsers and servers spell it internally. Adding [sic] to it is the accepted convention meaning I kept the spelling from that source, despite it being incorrect.

NegativeONE · Post by **NegativeONE** » Mon Jul 10, 2006 6:53 pm

Peculiar indeed. Well, at any rate, I've got the answers I was looking for, and I think you're all aware now that my claims and inquiries were genuine. I don't really plan on sticking around, so you're welcome to delete my account and this post if you'd like. Thanks for the replies.

LibriumArcana.Games

Can someone explain this to me?

#1 Can someone explain this to me?

#2

#3

#4

#5

#6

#7

#8

#9