Short Answer? Name-based virtual hosting allows IP address accesses to web servers to be treated differently from hostname accesses to the same web servers. And many web systems administrators “dead end” IP address accesses for basic security reasons. Additionally, “Forbidden” messages are not typically sent by IP address access being blocked; my gut tells me some web server firewall is detecting IP address access and stopping it dead in it’s tracks.
Longer Answer? While name-based virtual host setups like the one used in Apache allows multiple hostnames to use the same IP address, that—in and of—itself does not mean you will get a “Forbidden” if you are attempting to access a server via the raw IP address. That said, doing a
curl -I to
www.kickass.to shows that Nginx is being used:
HTTP/1.1 301 Moved Permanently
Date: Tue, 10 Feb 2015 05:46:59 GMT
While I refer to my experience with Apache—which is the most commonly used web server on the Internet—Nginx is gaining traction and allows for similar behaviors to Apache as I describe. Including being able to use ModSecurity. Read on for details; the same basic concepts apply to Apache and Nginx.
When I setup Apache servers with name-based virtual hosts, I do make a very conscious effort to create a “virtual moat” by having the
default Apache config—often set as
000-default in the
sites-enabled directory—to throw all non-hostname/IP-specific access to a literal blank HTML page. The logic being that many malicious pieces of software out there will attempt to “hack” a site by gaining access via the IP address. Why? Easy. Many Apache setups have a default “It works!” page setup at that address. Competent systems administrators will get rid of that page since robots/spiders out to hack a site will specifically look for that kind of “It works!” page as a basic clue that, “Hey! This administrator just tossed a server into production without really cleaning this basic stuff up. Let’s see what exploits can try on this server.” Believe it or not, but dead-ending the
default Apache config is the simplest way to discourage unwanted accesses and DDoS attempts.
But like I said, a “Forbidden” doesn’t smell like an intentional “dead end” to me. Who knows, maybe the systems administrator did “dead end” the
default Apache config into a completely dead or non-existent directory. But whenever I see “Forbidden” in a case like this, it makes me believe that the administrator has ModSecurity installed.
ModSecurity is an Apache web service level module that acts as a firewall between a web server and unwanted traffic. It uses “rule sets” to scan traffic in real-time—as the actual HTTP request is made—and if a pattern of access/behavior checks as “bad” it will throw up a “Forbidden” for that access. And in the case of raw IP addresses, one of the core rules in the ModSecurity core rule set (CRS) is to “Forbidden” any/accesses to RAW IP addresses.
So in my humble opinion, you are seeing a web server using ModSecurity—or a similar firewall tool—react to a raw IP request by just blocking the request entirely as “Forbidden.”
Additionally, you are stating that
www.kickass.to has multiple IP addresses. That tells me some kind of load balancing is happening when requests are made to
www.kickass.to. Anyone setting up a load balanced cluster will definitely make sure their child nodes are fairly bullet proof and inaccessible to unwanted requests. So exactly what I describe above, but even more so.