Eight of my sites are on one box. Is anyone actually getting caught for this or is it folklore

I've been running eight sites off a single 8GB VPS for about two years. Same IP, same nginx, same everything. Six of them link out to two money sites.

Every guide says don't do this. I have never once seen a case where somebody could show that the shared IP was the thing that did it, as opposed to everything else that was also true about their setup.

What I actually have running:

server_name  site1.tld;   root /srv/site1;
server_name  site2.tld;   root /srv/site2;
...

Eight vhosts, one cert per domain, different registrars for five of the eight, different CMSes on three, genuinely different content on all of them because I paid for it.

My question is the failure-mode one. If this breaks, how does it break, and how would I know? Not 'you'll get deindexed' - what's the actual observable? Because in two years the observable has been nothing at all, and I'd like to know whether that's because it's fine or because I don't know what to look for.

Is not the IP that kill you, is everything else that is same on that box. Anyway why you take the risk for 5 dollar a month, split it.

I run same as you before, 12 site one server. Never problem in three years. Then i move them anyway because is cheap insurance.

The IP is the least interesting thing you share and people fixate on it because it is the one thing they know how to change.

What actually ties a set of sites together, roughly in order of how hard it is to fix:

Outbound link pattern. Six sites linking to two targets is the entire footprint. Everything else in this thread is noise next to that. You could put all eight on separate continents and the pattern is unchanged, because the pattern is not in the infrastructure, it is in the graph.

Registration and renewal timing. Five registrars is good. Eight domains that all renew in the same fortnight is not, and people never think about it.

Analytics, ad, and verification identifiers. One property ID across two sites is a hard join and it does not decay.

Certificate SANs. If any two of your domains ended up on the same certificate you have published the relationship in a public log that is permanently searchable and that nobody ever checks. You said one cert per domain, so fine, but issuance timestamps for eight certs from the same issuer in the same hour are also a record.

Template and content fingerprints. Same theme, same plugin set, same image compression settings, same writer.

Your threat model here is not really a crawler. It is a competitor who wants to file a report and needs three minutes to build the picture. Almost everything above is visible to them without touching your server, which is why the shared IP is not the part I would worry about.

renewal dates. never once thought about that and it's obvious

The shared-IP rule is a genuine artefact and I can tell you where it came from, because I was buying hosting when it was true.

Around 2010 to 2013 there were maybe a dozen hosts that everyone in this game used, and the network deindexations of that era hit whole IP ranges at once. Not because sharing an IP was itself a signal, but because if you were on one of those ranges you were, statistically, a network - the ranges were 90% us. Taking out the range was a cheap and accurate move.

So the folklore is 'don't share an IP' when the actual lesson was 'don't be on infrastructure whose customer base is entirely people doing what you're doing'. Those are very different rules and only one of them still matters. A generic VPS at a large provider today is sitting in a range with a few thousand ordinary businesses on it, and you are invisible in a way that was impossible in 2012.

What I'd add to nullroute's list, which is otherwise the best summary of this I've read: eight sites that all went live within a few months of each other and have never had a single link from anywhere outside your own eight. That's the shape. The hosting is incidental.

Has anyone in this thread got a case where a network went down and the shared IP was demonstrably the cause? Or are we all agreeing it's folklore based on nothing?

I sell hosting alongside domains so treat this accordingly, but no, I haven't got one, and I've asked around for years.

What I have got is the other version. Twice now a customer has had a network go dark and in both cases they were on a provider that specifically markets itself for this purpose - the sort where the signup page uses the words private blog network. That's old_growth_seo's point exactly. It isn't the address, it's the neighbourhood, and the neighbourhoods that get cleared are the ones that advertise.

So I'll happily tell PipelineRat that his eight-on-one-box is not the risk he thinks it is. What I'd still charge him for is diversity for a different reason: one box is one failure, one billing dispute, one abuse complaint, and eight sites gone at once with no warning. That's a business risk, not a ranking one, and it's the one I'd actually sell against.

Depends what you're running. If the eight sites are worth less than the hassle of splitting them, don't split them.

14 on one server here, 4 years, nothing

On your actual question - what is the observable - I think the honest answer is that there isn't a clean one, and that is the most important thing to understand about this whole category.

Why you cannot see it

The old failure mode was deindexation, which is loud. You check the index, the sites are gone, you know. That still happens but it is now the rare case. The current failure mode is that the links from your network stop counting, and there is no signal for that anywhere. Your sites stay indexed. They keep their own rankings. Your money site simply does not rank as well as the link count says it should, and you have no baseline to compare against.

This is the reason the shared-IP debate never resolves. Both sides are describing an outcome that neither can observe.

The closest thing to a test

What I would do in your position, and I have done a version of this:

1. Pick two of the six linking sites. Remove their links to the money site entirely, not nofollow them, remove them.
2. Wait eight weeks past the next confirmed crawl of those pages.
3. Measure the money site's rankings on the terms those pages' anchors targeted.

If nothing moves, those two links were already worth nothing, and you have learned something concrete about your network for the price of two links. If rankings drop, they were counting, and the whole footprint question is academic because it is currently working.

I have run this once, on a smaller network, and two of three links turned out to be doing nothing. That was more useful than any amount of arguing about IPs. It is also uncomfortable, which is why nobody does it.

On the config itself

Nothing in what you posted is a problem. Same nginx, same box, separate certs, separate registrars is well past the point of diminishing returns on infrastructure. Spend the effort on nullroute's outbound link pattern instead, which is the only item on his list that I would call urgent.

To answer Ravenstack directly: no. I have never seen a case where shared hosting was isolated as the cause, and I have looked.

What I would not do is conclude from that it is safe. Absence of a documented case in a field where nobody publishes their failures and nobody has a control group is close to no information at all. I am saying it is not the highest item on the list, not that it is off the list.

Ran hexforge's removal test on two of the six. Six weeks past the crawl now.

One of them: nothing. No movement on either term the anchors targeted, no movement on the page at all. That link was decorative and had been for however long.

The other: the target page dropped three positions within about a fortnight and hasn't come back. So that one was carrying something real.

One in two, on a sample of two, which is worth roughly nothing statistically and quite a lot to me practically. I'm going to run it across the other four over the winter rather than all at once.

The box stays as it is. Renewal dates I've now staggered, because that one cost me twenty minutes and I couldn't defend not doing it. Never did get an answer to whether the shared IP matters and I've stopped expecting one.