Hosting lookup

Every site leaves public traces of the companies that keep it running. This lookup follows them from the domain name to the network that owns the server, then reads the home page for clues about the software behind it.

Or try wordpress.org, bbc.com

From a name to a company

A domain name points to an IP address through its A record. IP addresses are handed out in blocks, and each block is announced on the internet by one network. That network has an autonomous system number (ASN), which is registered to an organization. Follow the chain and you get something like this:

example.com  →  151.101.1.6  →  AS54113  →  Fastly, Inc.

The lookup resolves the name, asks a public IP-to-ASN database for the network and its registered name, and reads the reverse DNS name of the address, which often contains the provider’s own domain. Then it compares all of that with a list of about sixty hosting companies, cloud platforms and site builders, from Amazon Web Services and Hetzner to Squarespace and Kinsta. If nothing matches, you get the network’s registered name as it stands, and that’s usually enough to search for.

The five cards in the result

Hosting
The owner of the IP address, with the address, its reverse name, the AS number and the country where the block is registered.
CDN
Each network adds its own headers to the responses it serves, and that’s how we recognize it: cf-ray for Cloudflare, x-amz-cf-id for Amazon CloudFront, x-served-by for Fastly, x-vercel-id, x-nf-request-id for Netlify, x-azure-ref for Azure Front Door, and a few more. The Server and Via headers are the fallback.
Platform
First the <meta name="generator"> tag, then fingerprints in the HTML: /wp-content/ for WordPress, cdn.shopify.com for Shopify, data-wf-site for Webflow, __NEXT_DATA__ for Next.js, and so on for sixteen systems. On WordPress it also names the page builder (Elementor, Divi, WPBakery, Beaver Builder, Bricks, Oxygen or the block editor). The web server and the PHP version show up when the headers give them away.
DNS
The domain’s name servers and the provider they belong to, for example ns-123.awsdns-45.com for Amazon Route 53.
Email
The MX records and the mail service behind them, such as Google Workspace, Microsoft 365, Proton Mail or Zoho. If the mail server has the same IP address as the website, the card says so.

When the answer is a CDN

A content delivery network stands in front of the real server and answers for it. The IP address you see belongs to the CDN, and the verdict reads “Behind Cloudflare, which hides the real host”. Nothing has gone wrong there. The origin server’s address is kept private on purpose, so attacks can’t go around the CDN.

If the site is yours and you need the origin, look at the DNS records inside the CDN account, at your hosting invoices, or at subdomains that skip the CDN. Names such as mail., ftp. or cpanel. often point straight at the server, and you can run them through this lookup too.

Two notes the result may add

PHP version no longer updated. You’ll see this when the X-Powered-By header reports PHP older than 8.1. Those releases don’t get security fixes anymore. Most control panels let you switch versions in one screen. Take a backup first and test the site afterwards.

The server shows its version numbers. Automated scanners read the same headers to pick out targets with known flaws. Hiding them takes one line each:

ServerTokens Prod        # Apache
server_tokens off;       # nginx
expose_php = Off         # php.ini

What you can’t see from outside

  • Many small hosting companies rent their machines from big ones. A site sold by a local agency can correctly show Hetzner or Amazon, because that’s who owns the address.
  • The country is the one on record for the IP block. Large networks move addresses between data centers, so take it as a strong hint.
  • We only read the home page, and only the first address when there are several.
  • A site built to order, or one that removes its generator tag and fingerprints, shows as “Custom or not recognized”.

The host isn’t the registrar. The company that rents you the domain name can be someone else entirely, and the domain health report names it.

Questions people ask

How do I find out who hosts a website?

Look up the domain’s IP address, then the network that owns that address. This page does both, and when it knows the network it swaps the registered name for the one the company usually goes by.

Is the hosting company the same as the domain registrar?

Not necessarily. The registrar rents you the name, the DNS provider publishes its records, and the host runs the server. One company can do all three, but they’re often three separate accounts. The domain dependency map lays them out on one sheet.

Why does the lookup show Cloudflare and not the real host?

The site sends its traffic through Cloudflare, so the public IP address is Cloudflare’s. The server behind it is hidden on purpose and can’t be read from outside.

How can I tell if a site runs on WordPress?

Look in the page source for paths containing /wp-content/ or /wp-includes/, or for a generator tag that names WordPress. The Platform card reports it and adds the page builder when it can.

Is the country shown the place where the server physically is?

It’s the country the IP block is registered in. For a host that works in one country, that’s the same thing. For a global cloud or a CDN, the machine that answers you may be somewhere else.

I lost the login to my own hosting. Can this help?

It gives you the names to search for in old invoices and mailboxes, meaning the host, the DNS provider and the mail service. Each of them has an account recovery process that starts from the email address on file.

Related checks