To find out who hosts a website, look up the IP address its domain points to, then find which network owns that IP address; the owner is usually the hosting company or the cloud it runs on. Response headers often name a managed host or CDN directly, such as Kinsta, WP Engine, Vercel or Cloudflare. When a CDN like Cloudflare sits in front, the IP belongs to the CDN, and the real host behind it stays hidden to outsiders by design.
This guide is for site owners who have lost track of where their site lives, agencies taking on a client, and anyone who needs to send an abuse or copyright report to the right company. It shows the manual method, what each answer does and does not tell you, and the free tools that do it in one step. Knowing the host is one part of knowing what a site is built with; the guide to CMSs and how to tell which one a site uses covers the software side.
Quick answer
- Get the IP address:
dig +short A example.comornslookup example.com. - Find the owner of the IP: a WHOIS or RDAP lookup of the address names the network, such as Hetzner, OVHcloud, Amazon or Google Cloud.
- Read the response headers: managed hosts and CDNs often name themselves, for example
x-kinsta-cache,wpe-backend,x-vercel-id,cf-ray. - If the IP belongs to Cloudflare, Fastly or another CDN, the origin host is hidden. Only the site owner, or the CDN in response to an abuse report, can tell you who it is.
- Do it in one step with the free hosting speed test, which names the host or CDN and times the server.
Host, CDN, registrar, DNS: four different companies
"Who is behind this website" has several answers, and they are often different companies:
| Role | What it does | How to find it |
|---|---|---|
| Web host | Runs the server that builds and sends the pages | IP owner, response headers |
| CDN | Caches and delivers pages from servers near the visitor, in front of the host | IP owner, response headers |
| Domain registrar | Sold and renews the domain name | Domain WHOIS or RDAP |
| DNS provider | Answers where the domain points | NS records |
| Email provider | Handles mail for the domain | MX records |
A small business site might be registered at one company, use Cloudflare for DNS and CDN, be hosted on a managed WordPress host, and send email through Google Workspace. Each lookup below answers one of these questions, so be clear which one you need.
Step 1: find the IP address
Every website's domain points to one or more IP addresses in DNS, through an A record (IPv4) or AAAA record (IPv6). From a terminal:
dig +short A example.com
dig +short AAAA example.com
nslookup example.comOn Windows, nslookup example.com works in Command Prompt or PowerShell. If the result is a host name rather than an address, the domain uses a CNAME, and the name itself is often a clue: a www record pointing to shops.myshopify.com, cname.vercel-dns.com or *.wpengine.com tells you the platform before you look up any address.
Check both the bare domain and www; they sometimes point to different places.
Step 2: find who owns the IP address
IP addresses are handed out in blocks to networks, and every block has a registered owner. Look it up with a WHOIS or RDAP query of the address, not the domain:
whois 203.0.113.10Without a terminal, the regional internet registries run free lookups on their websites (ARIN for North America, RIPE NCC for Europe, APNIC for Asia-Pacific, and LACNIC and AFRINIC), and they redirect you to the right one. The fields that matter are the organisation name and the network name; for a cloud or hosting company, that is your answer.
Each network also has an autonomous system number (ASN), which groups all its address blocks. Hosting detection tools, including getReport's, look up the ASN because it identifies the provider cleanly: AS24940 is Hetzner, AS16276 is OVHcloud, AS14061 is DigitalOcean.
A reverse DNS lookup, dig +short -x 203.0.113.10, sometimes adds a host name that names the provider or even the plan. Many servers have none, so treat it as a bonus.
When the IP owner is a big cloud
If the address belongs to Amazon Web Services, Google Cloud or Microsoft Azure, the site may be hosted there directly, or through a managed host that rents servers from them. Kinsta, for example, runs on Google Cloud. The headers in the next step usually settle which.
Step 3: read the response headers
Headers are the short lines a server sends before each page. Open your browser's developer tools (F12), go to the Network tab, reload the page, click the first request and read Response Headers. From a terminal, curl -sI https://example.com prints them.
Headers that name a host or CDN:
| Header | Points to |
|---|---|
cf-ray, server: cloudflare | Cloudflare (CDN) |
x-amz-cf-id, via: … cloudfront | Amazon CloudFront (CDN) |
x-served-by: cache-…, x-fastly-request-id | Fastly (CDN) |
x-kinsta-cache | Kinsta |
wpe-backend | WP Engine |
x-vercel-id, server: Vercel | Vercel |
x-nf-request-id, server: Netlify | Netlify |
x-shopid, x-shopify-stage | Shopify |
x-wix-request-id | Wix |
x-github-request-id with server: GitHub.com | GitHub Pages |
The server header may also name the web server software, such as nginx, Apache or LiteSpeed. That tells you the software, not the company: thousands of hosts run nginx. LiteSpeed is a hint towards hosts that use it, but not proof.
Step 4: check the name servers and MX records
dig +short NS example.com
dig +short MX example.comName servers show who runs the domain's DNS. *.ns.cloudflare.com means Cloudflare; names containing a registrar's or host's brand usually mean that company. DNS is often at the registrar or the host, so it is a useful hint, but DNS and hosting can be at different companies.
MX records show where email goes: smtp.google.com or aspmx.l.google.com for Google Workspace, a host ending in mail.protection.outlook.com for Microsoft 365. That is the email provider, not the web host.
When a CDN hides the real host
If the IP address belongs to Cloudflare, Fastly, Akamai, Sucuri, Imperva or another CDN or security proxy, you have found the CDN, not the host. Visitors connect to the CDN, which fetches pages from the origin server behind it, and the origin's address is deliberately kept private. That is part of what these services sell: protection against attacks aimed at the origin.
There is no reliable, legitimate way for an outsider to see through it. Old DNS records or mail headers sometimes reveal a former origin address, but it may be out of date, and trying to bypass a CDN's protection is exactly what it is there to prevent. What you can do instead:
- For abuse, phishing or copyright complaints, report to the CDN. Cloudflare, for example, has an abuse form and forwards reports to the hosting provider behind the site.
- For your own site, look in your CDN dashboard for the origin address, or at who sends your hosting invoices.
- For a client's site, ask for access to the CDN and hosting accounts; you will need them anyway.
The CDN basics guide explains what that layer does for speed and security.
Who registered the domain?
A WHOIS or RDAP lookup of the domain (not the IP) shows the registrar, the registration and expiry dates, and the name servers. Since the GDPR took effect in 2018, the owner's name and contact details are usually redacted or replaced by a privacy service, so expect "REDACTED FOR PRIVACY". Registrars still offer a way to contact the owner or to report abuse.
Find the host in one step
The hosting speed test does steps 1 to 3 at once. It resolves the address, looks up the network that owns it through its ASN, and reads the headers that name managed hosts such as Kinsta, WP Engine, SiteGround, Netlify, Vercel and Shopify. Headers win over the network, because "Kinsta" is more useful to you than "Google Cloud". When a CDN sits in front, it says so and does not guess the host behind it.
It also times the server's first byte from Frankfurt and, once at least 50 sites on the same host have been checked, compares your time with theirs:
The CMS detector lists the CDN, hosting platform and web server among everything else a page reveals, and every full getReport report includes that list:
What a web server's headers give away
While you are reading headers, look at server and X-Powered-By. A value such as Apache/2.4.29 or PHP/7.2.24 tells anyone the exact software versions, which is how automated scanners pick targets. If it is your own site, hide the version numbers and, more importantly, update the software.
The guide to Server and X-Powered-By headers has the one-line fix for common servers.
Common mistakes
- Taking Cloudflare for the host. Cloudflare in the headers or IP owner means a CDN is in front; the host is somewhere else.
- Confusing the registrar with the host. Buying a domain at one company and hosting at another is normal.
- Reading
nginxorApacheas a company name. It is software, used by many hosts. - Checking only the bare domain.
wwwcan point somewhere else, and the site visitors actually use is the one that counts. - Trusting a single signal. Combine the IP owner with the headers before you name a host, especially on big clouds.
Questions people ask
Can you find the real host of a website behind Cloudflare?
Not reliably, and not from the outside by design. Cloudflare answers with its own IP addresses and keeps the origin server private. Old DNS records sometimes show a former address, but it may be out of date. For abuse or copyright problems, report to Cloudflare, which forwards the report to the hosting provider. For your own site, the origin is in your Cloudflare dashboard.
How do I find the hosting provider from an IP address?
Run a WHOIS or RDAP lookup on the IP address, from a terminal with whois or on a regional internet registry's website such as ARIN or RIPE NCC. The organisation and network name show who owns the address block, usually the host or the cloud it runs on. A reverse DNS lookup of the address sometimes names the provider too.
Is the domain registrar the same as the web host?
Not necessarily. The registrar sold you the domain name; the host runs the server that serves the pages. Many companies offer both, which is why they are often confused, but a domain registered at one company can point to a server anywhere. A WHOIS lookup of the domain shows the registrar; the IP address and headers show the host.
Why does a website's IP address belong to Amazon or Google?
Because the site runs on their cloud, either directly or through a managed host that rents servers there. Many hosting companies, including managed WordPress hosts, build on Amazon Web Services or Google Cloud. Check the response headers: a header such as x-kinsta-cache or wpe-backend names the company you would actually deal with.
How do I report a website to its hosting company?
Find the host from the IP address owner and the headers, then use the host's abuse contact, which is listed in the WHOIS record of the IP address, often as an abuse email address. If the site is behind a CDN such as Cloudflare, report it to the CDN instead; it forwards reports to the host. Include the exact URLs and what is wrong.