How to find out who hosts a website

The quick way

Run the domain through a WHOIS check and read two things: the nameservers, which tell you who runs the site's DNS, and the registrar, which tells you where the domain name itself was bought. Then run the same domain through a trace or a ping to get the IP address it resolves to, and look that address up. Those two lookups give you the usual answer in under a minute, and they are the same two lookups the manual method does by hand.

The manual way: domain to IP to owner

Four commands cover the whole chain:

dig +short www.example.com          # domain -> IP address(es)
dig +short NS example.com           # who answers DNS for the domain
whois 93.184.216.34                 # who owns that IP block
dig +short -x 93.184.216.34         # reverse DNS name for the address

Read them in order. The first gives you one or more A records. If you get a CNAME pointing at something like *.cloudfront.net or *.azureedge.net, you have already found a CDN rather than an origin server. The second names the DNS provider, often a different company from both the registrar and the host. The third is the important one: the WHOIS record for an IP address is held by a regional internet registry rather than a domain registrar, and it names the organization the address block is assigned to, along with its ASN (autonomous system number) and an abuse contact. The fourth often returns a hostname that gives the provider away even faster, because hosts tend to name their machines after themselves.

On Windows, nslookup example.com and nslookup -type=ns example.com do the first two steps without installing anything.

Registrar, DNS provider and host are three different things

This is where most confusion starts. A single site routinely involves three separate companies:

• The registrar sold the domain name and is who you contact about renewals, transfers and locks. It appears in the domain's WHOIS record.
• The DNS provider answers queries for the domain. It appears as the nameservers. Many sites move DNS to a third party while leaving the domain at the original registrar.
• The host runs the machine that serves the content. It appears in the WHOIS record of the IP address, not of the domain.

So a nameserver line is not a hosting address. Read it as "who answers DNS queries for this domain", nothing more. Email adds a fourth party: the MX records (dig +short MX example.com) point at whoever handles mail, which is frequently a different provider again.

When the host is a CDN, and how to see past it

If the IP lookup returns a CDN or a large cloud edge network, you have found the edge rather than the origin. That is the CDN working as designed: it terminates the connection at an edge node near the visitor and fetches from the origin behind the scenes, and the origin address is deliberately not published. A few things still help:

1. Check other records on the same domain. MX records and subdomains such as mail., ftp., cpanel. or direct. often bypass the CDN and resolve straight to the origin network.
2. Look at response headers. curl -I https://example.com/ frequently shows server, via or vendor-specific headers that name the edge provider, and sometimes the stack behind it.
3. Read the ASN, not just the company name. Two providers can resell capacity from the same underlying network, and the ASN tells you whose network it really is.
4. Accept the limit. If the origin is properly locked behind the CDN, no public lookup will reveal it, and treating a guess as fact is worse than saying "fronted by a CDN".

The same caution applies to the historical output of any lookup. Records change when a site migrates, and a cached or archived answer can be months out of date, so re-run the lookup rather than trusting a screenshot.

What the lookups are good for

• Judging a hosting provider before you migrate, by checking who hosts sites you consider comparable to yours.
• Finding the right abuse contact when traffic, spam or an attack traces back to an address.
• Confirming a migration finished, by checking that the domain now resolves into the new provider's network from several locations.
• Working out whether an outage is yours or your provider's, since a whole address block going quiet is not a problem with your application.

When the answer changes

These lookups tell you where a site lives today. They will not tell you when the answer changes, and it does change: a nameserver edit, an expired domain or a migration gone half-finished can all break a site while the server itself is perfectly healthy. Continuous monitoring watches DNS records, domain expiry and availability together and alerts when any of them moves. The WHOIS check runs a lookup now, how to read a WHOIS record goes through the fields in detail, and DNS propagation is the next step after changing where the domain points.