Do you think the site is showing up at the ip address because the domain is penalized? Rather than this being the cause of the penalty?
You say "penalty" as if something else is going on, which is why I was even slightly hesitant about my diagnosis.
Lots of people use the word "penalty" when they should be saying that the rankings dropped. Penalty implies breaking Google guidelines. Do you have reason to think you've done that?
Possibly, the backlinks to your domain name could have been devalued and/or the link(s) to your IP might have gotten a boost somehow, and that could be the cause. Or perhaps, particularly if you've seen this before, you're on the edge and there's been an algo tweak. But unless you have good reason to suspect a penalty, I wouldn't put that first on the list.
In any event, your domain is being seen as a dupe because your content is showing up under multiple urls, and you are splitting your link vote... so you've got to correct the canonical situation no matter what else you do. Why not do that first, and then see what happens?
If you can have it done via mod_rewrite, I think you're likely to be better off than by using the canonical link element, but I'm hearing from some experienced SEOs that they're surprised how well the canonical element is working.
