The "default web site" is just that - a "default" web site who's content is displayed if a web site with more specific identifiers is not found. For example:
Web Site A = bound to 192.168.14.8, no host header
Web Site B = bound to 192.168.14.8, host header = siteb.domain.lan
Default Site = bound to "All unassigned IP Addresses", no host header
In DNS, there is an A record for "web.domain.lan" pointing to 192.168.14.8, and a CNAME of "siteb.domain.lan" pointing to "web.domain.lan".
If you point your browser to "http://web.domain.lan", you should see site A content, while "http"//siteb.domain.lan" should display site B's content. There's no way to see the default content in this configuration!
Shut down site B and browse to "http"//siteb.domain.lan" - you'll see Site A's content. This is because Site A is listening on the same IP, and there's no longer an active site with a host header to route the traffic to an alternate site. Since you're going to a specific IP, the web site bound to that IP will display. This is why you never mix sites with and without host headers on a single web IP!
Start up site B - it should display. Shut down site A and brows to Site B - you still see site B. Browse to Site A and you'll see the content from the default web site. This is because there's no site bound only to the IP, and Site B has both the IP and Host Header bound..
The purpose of the default web site is actually to display a generic "site unavailable" message, and possibly a menu to guide the user to a specific alternate site.
Production web sites should always be bound to an IP address when possible (allowing both HTTP and HTTPS traffic). If HTTPS traffic isn't needed, then multiple sites can be bound to a single address and routed to specific sites with host headers. Only the default site should listen on "All unassigned IPs", and it should never use host headers.
In good practice, you assign an IP address to the server hosting the web sites, and then you assign secondary IP addresses to the web server (the software!!) In our environment, where we host several different sites for our different divisions, we have an array of web servers and each has 17 IP addresses..
WebServer1 192.168.16.36 (server IP, for management)
WebServer1a01 192.168.18.16 IP for first web site group
WebServer1a02 192.168.18.17 IP for second web site group
WebServer1a03 192.168.18.18 IP for third web site group
WebServer1a04 192.168.18.19 IP for fourth web site group
(and so on...)
These are the A records in DNS. Since we use SSL, we assign unique IPs to each site. We do have a few informational sites that are all hosted on the last assigned IP address and defined with host headers.
The point of this configuration is that the CNAMES are easily translated into A record names - from internal tech support, the name "WebServer1a03" quickly identifies the host and instance that is having problems, compared to "www.bassfishing.com" which could be on any of 8 web servers in the array.
If you want more details about using sites, host headers, and web server configuration, look at the Best Practice whitepaper on my web site in the Resources section.
Glenn