Where Is This Website Hosted? How to Find Out (5 Methods)

To find where a website is hosted, you follow the domain to an IP address and then find out which network owns that address. Some methods also read the response headers, which name the platform behind the site. This guide covers five methods and works through three real domains, checked on 12 October 2026.

Quick Answer: To see where a website is hosted, enter the domain in our hosting check. It resolves the IP address, names the network that owns it with its autonomous system number (ASN), and reads the response headers for platforms like Vercel or Shopify. By hand, run dig for the IP, look the IP up on ipinfo.io, and check the headers with curl -sI. If the answer is Cloudflare, the site sits behind a content delivery network (CDN) and the real host is hidden.

Four companies behind one domain

"Who hosts this website?" often has four different answers. A domain can be registered at one company, use a second for DNS, a third for email and a fourth for the web server. Know which one you need before you start.

People usually mean the first row. The other three are still useful, because they sometimes point back to the host. Small sites often keep everything at one company, as the Hostinger example below shows.

Why you might want to know

You may be researching how a competitor runs a fast site, or qualifying leads if you sell hosting or agency work. You may be planning a migration and need to know what the current setup is. Or a site is down, and you need to know whose status page to check. The method is the same in each case.

Method 1: Use a hosting checker

A hosting checker runs the DNS, IP, header and registration lookups for you and puts the answers side by side. Enter a domain below:

Our hosting check reports each layer on its own line:

• Network: the company that owns the IP address, with its ASN (for example AS13335 for Cloudflare)
• CDN: a CDN or reverse proxy in front of the site, if there is one
• Platform: a hosting platform, site builder or store that runs the site, such as Vercel, Netlify, Shopify or WP Engine
• DNS provider: the company that answers DNS queries, read from the NS records
• Email provider: the company that receives mail, read from the MX record with the lowest priority
• Registrar: the company that holds the registration, read from RDAP, or from port 43 WHOIS for registries without RDAP

It also lists the evidence behind each answer (an ASN, a CNAME target, a header) and a confidence level. A known platform or a plain hosting network gets high confidence. A cloud network gets medium, because the server could belong to any of that cloud's customers. A CDN gets low, because the origin host is hidden.

The rest of this guide shows how to collect the same evidence yourself.

Method 2: DNS lookup

DNS tells you where the domain points. Three record types matter for hosting:

• A and AAAA records give the IPv4 and IPv6 addresses that answer for the site. You trace these to a network in Method 3.
• CNAME records point a name at another name. The target often names the platform: cname.vercel-dns.com, *.netlify.app, shops.myshopify.com.
• NS records name the DNS provider. That is often, but not always, the host.

Run a lookup in a terminal:

dig +short example.com A
dig +short example.com NS
dig +short www.example.com CNAME

On Windows, nslookup example.com works too. Without a terminal, use the DNS lookup tool.

Nameservers follow naming patterns that point to a provider:

A nameserver names the DNS provider, not the web host. Plenty of sites use Cloudflare or Route 53 for DNS and host somewhere else. For more on record types, see DNS records explained.

Method 3: IP and ASN lookup

Every IP address belongs to a block that a network announces to the rest of the internet. That network has an ASN. The ASN owner is the closest thing to a direct answer to "where is this website hosted".

Look up the IP from Method 2 with the IP lookup tool or with ipinfo from the command line:

curl -s https://ipinfo.io/203.0.113.10

The org field holds the ASN and its owner, such as AS47583 Hostinger International Limited. RIPEstat shows the announced prefix and the origin ASN for any IP, and it works for addresses outside Europe too.

Read the result with care:

• A hosting network (Hostinger, OVHcloud, Hetzner) usually means the site runs on that company's servers.
• A cloud network (Amazon, Google Cloud, Azure) tells you the data center, not the customer. A platform such as Vercel may run there.
• A CDN network (Cloudflare, Fastly, Akamai) means the IP belongs to a proxy. The real server is somewhere else. See Why does it say Cloudflare? below.
• An anycast address is announced from many locations at once. Its geolocation is a label in the database, not the place where the server is. How to check website server location covers that in detail.

Method 4: WHOIS and RDAP lookup

Registration data names the registrar, the nameservers and the registration dates. It does not name the web host. Use it to fill in the registrar row of the table above, and to confirm the nameservers.

RDAP is the structured replacement for WHOIS. ICANN requires all gTLD registries and registrars to run RDAP, and since 28 January 2025 they no longer have to run WHOIS. Some country-code registries still only offer port 43 WHOIS.

Look a domain up with the WHOIS lookup tool, ICANN Lookup, or the command line:

whois example.com
curl -sL https://rdap.org/domain/example.com

Most registrations now hide the owner's name and address behind privacy services. The registrar and nameservers stay visible.

Method 5: HTTP response headers

Response headers often name the platform outright. Run:

curl -sI https://example.com

Or open your browser's developer tools (F12, or Cmd+Option+I on a Mac), go to the Network tab, reload the page and click the first request.

Headers are optional and easy to change, so treat them as strong hints that need a second signal. A server: nginx header tells you the web server software, not the company. Headers do confirm a platform when the IP only names the cloud underneath it, as the Vercel example shows.

Three worked examples

All output below is real, from lookups run on 12 October 2026. Trimmed lines are marked with .... IP addresses can differ for you, because large sites return different addresses to different resolvers.

Example 1: cal.com, behind Cloudflare

DNS first:

$ dig +short cal.com A
104.18.1.62
104.18.0.62
$ dig +short cal.com NS
carter.ns.cloudflare.com.
linda.ns.cloudflare.com.
$ dig +short cal.com MX
1 aspmx.l.google.com.
5 alt1.aspmx.l.google.com.
...

Then the IP:

$ curl -s https://ipinfo.io/104.18.1.62
{
  "ip": "104.18.1.62",
  "city": "San Francisco",
  "region": "California",
  "country": "US",
  "org": "AS13335 Cloudflare, Inc.",
  ...
  "anycast": true
}

The headers and registration data:

$ curl -sI https://cal.com
HTTP/2 200
cf-ray: a494290bcb3fecba-WAW
server: cloudflare
...
$ whois cal.com
   Registrar: GoDaddy.com, LLC
   Name Server: CARTER.NS.CLOUDFLARE.COM
   Name Server: LINDA.NS.CLOUDFLARE.COM

What each signal says:

• The A records belong to AS13335, Cloudflare. RIPEstat shows them inside the 104.18.0.0/20 prefix.
• anycast: true means the San Francisco location only describes one Cloudflare data center.
• cf-ray and server: cloudflare confirm the request went through Cloudflare's proxy.
• The NS records put DNS at Cloudflare and the MX records put email at Google Workspace. The registrar is GoDaddy.

Conclusion: cal.com uses Cloudflare as a CDN, so the origin host does not show in public DNS. The hosting check sums this up as "cal.com is behind Cloudflare, which hides the origin host. DNS by Cloudflare. Email by Google Workspace." It lists Cloudflare as the CDN and the network, with low confidence, and GoDaddy as the registrar.

Example 2: nextjs.org, on Vercel

DNS first:

$ dig +short nextjs.org A
155.121.1.3
$ dig +short nextjs.org NS
ns1.vercel-dns.com.
ns2.vercel-dns.com.
$ dig +noall +answer www.nextjs.org
www.nextjs.org.  60  IN  CNAME  7db0c515ced5a8a7.vercel-dns.com.
7db0c515ced5a8a7.vercel-dns.com. 60 IN A 155.121.1.3

Then the IP. ipinfo and the address registry disagree, and both are right:

$ curl -s https://ipinfo.io/155.121.1.3
{
  "ip": "155.121.1.3",
  "city": "Walnut",
  "region": "California",
  "country": "US",
  "org": "AS16509 Amazon.com, Inc.",
  ...
  "anycast": true
}
$ whois 155.121.1.3
NetRange:       155.121.0.0 - 155.121.255.255
NetName:        VERCEL-14
OrgName:        Vercel, Inc

ARIN lists Vercel as the holder of the address block. RIPEstat shows the 155.121.1.0/24 prefix announced by AS16509, which is Amazon. So Vercel holds the addresses, and Amazon's network carries the traffic.

The headers settle it:

$ curl -sI https://nextjs.org
HTTP/2 200
...
server: Vercel
x-powered-by: Next.js
x-vercel-cache: HIT
x-vercel-id: fra1::cle1::n9d85-1791787706202-9044b17563cf

What each signal says:

• The ASN says Amazon Web Services. On its own, that would only tell you "some AWS customer".
• The www CNAME points at vercel-dns.com, and the NS records are Vercel's.
• server: Vercel and x-vercel-id confirm that Vercel served the response.
• The MX records point at Google Workspace, and RDAP names Tucows Domains Inc. as the registrar.

Conclusion: nextjs.org is hosted on Vercel, which runs on Amazon's network here. The hosting check reports "nextjs.org is hosted on Vercel (Amazon Web Services)", with Vercel as the platform, Amazon Web Services (AS16509) as the network, and high confidence. The evidence list shows the ASN and the two Vercel headers.

This example shows why an IP lookup alone can mislead. Many platforms (Vercel, Netlify, Heroku, Render) run on someone else's cloud, and only the headers or CNAME name the platform.

Example 3: kvietkos.lt, on Hostinger shared hosting

kvietkos.lt is the site of a small flower shop in Lithuania. DNS first:

$ dig +noall +answer kvietkos.lt A kvietkos.lt NS kvietkos.lt MX www.kvietkos.lt
kvietkos.lt.      56     IN  A      2.57.91.254
kvietkos.lt.      56     IN  A      84.32.84.245
kvietkos.lt.      86400  IN  NS     ns1.dns-parking.com.
kvietkos.lt.      86400  IN  NS     ns2.dns-parking.com.
kvietkos.lt.      14400  IN  MX     1 SMTP.GOOGLE.COM.
www.kvietkos.lt.  296    IN  CNAME  www.kvietkos.lt.cdn.hstgr.net.

Then the IP:

$ curl -s https://ipinfo.io/2.57.91.254
{
  "ip": "2.57.91.254",
  "city": "New York City",
  "region": "New York",
  "country": "US",
  "org": "AS47583 Hostinger International Limited",
  ...
  "anycast": true
}

The headers:

$ curl -sI https://kvietkos.lt
HTTP/2 200
x-powered-by: PHP/8.2.34
platform: hostinger
panel: hpanel
server: hcdn
x-hcdn-cache-status: DYNAMIC
...

And the registration. The .lt registry has no RDAP service in the IANA bootstrap file, so this one needs port 43 WHOIS:

$ whois -h whois.domreg.lt kvietkos.lt
Domain:     kvietkos.lt
Registered: 2023-12-08
Registrar:  HOSTINGER operations, UAB
Nameserver: ns1.dns-parking.com
Nameserver: ns2.dns-parking.com

What each signal says:

• The IP belongs to AS47583, Hostinger. RIPEstat shows the 2.57.91.0/24 prefix announced by the same ASN.
• The www CNAME points at hstgr.net, and server: hcdn is Hostinger's own CDN. That explains the anycast flag and the short TTL on the A records. Repeat the lookup and you get other Hostinger addresses.
• platform: hostinger and panel: hpanel are Hostinger's shared hosting headers. hPanel is Hostinger's control panel.
• dns-parking.com is Hostinger's DNS (RDAP lists Hostinger as that domain's registrar). The registrar is Hostinger too. Email goes to Google Workspace.

Conclusion: kvietkos.lt is on Hostinger shared hosting. Every signal except email points to one company. The hosting check reports "kvietkos.lt is hosted by Hostinger International Limited. DNS by Hostinger. Email by Google Workspace.", with high confidence and Hostinger as the registrar.

The CDN here belongs to the host itself, so it does not hide anything. A third-party CDN does hide the origin, as the next section explains.

Why does it say Cloudflare?

If a lookup names Cloudflare, Fastly or Akamai, the site sits behind a CDN or reverse proxy. Visitors connect to the proxy, and the proxy fetches pages from the real server (the origin). The public DNS only lists the proxy.

Cloudflare's documentation on proxy status says a query for a proxied record is "answered with Cloudflare anycast IP addresses" instead of the origin address. Only A, AAAA and CNAME records can be proxied. Hiding the origin is one of the reasons people use Cloudflare. The Cloudflare check guide shows how to confirm it, and how to find what CDN a website uses covers the other CDNs.

What you can still learn

• NS records name the DNS provider. Behind Cloudflare, that is usually Cloudflare too.
• MX records can't be proxied, per the same Cloudflare page. They name the email provider. On small sites with cPanel-style hosting, the MX often points to mail.<domain>, and that name often resolves to the hosting server itself.
• Subdomains may be DNS-only. Try mail, webmail, ftp, cpanel, dev and staging. Cloudflare's page on exposed IP addresses says a DNS-only record that points to the same server as a proxied record reveals the origin IP.
• Historical DNS services keep old A records. If the site moved behind Cloudflare later, an older record may show the earlier host.
• Headers from the origin sometimes pass through the proxy, such as x-powered-by, or platform headers like x-vercel-id.

Here is the subdomain check on cal.com:

$ dig +short staging.cal.com
5cf227f494b271f7.vercel-dns-013.com.
64.239.109.65
64.239.123.65
$ dig +short app.cal.com
104.18.0.62
104.18.1.62

app, api and status all resolve to Cloudflare. staging points at Vercel. That tells you cal.com runs at least a staging environment on Vercel. It does not prove the production site is there. Treat any signal like this as a lead, not an answer.

What you can't learn

Often the origin is not visible from outside, and that is by design. A site that proxies every web record, keeps mail at Google or Microsoft and has no stray DNS-only subdomains leaves nothing to trace. Some sites go further. With Cloudflare Tunnel, the origin opens an outbound connection to Cloudflare and needs no publicly routable IP address at all.

In that case the honest answer is "behind Cloudflare, origin unknown". A tool that names a specific host for such a site is guessing. A leaked origin IP is a security problem for the site owner. Use it to understand the setup, not to get around their protection.

Which method should you use?

Start with the hosting check. If the answer is a cloud network or a CDN, check the headers and subdomains by hand. Use RDAP when you need the registrar, for example to transfer a domain or report abuse.

Frequently Asked Questions

How do I find where a website is hosted for free?

Every method in this guide is free. Enter the domain in our hosting check, or run dig for the IP address and look that IP up on ipinfo.io. The org field names the network that owns the server.

Why does the lookup say Cloudflare instead of the real host?

The site uses Cloudflare as a reverse proxy. Proxied DNS records return Cloudflare's anycast addresses, so the origin server's address is not public. NS, MX and DNS-only subdomains can still give hints, but often the origin can't be found from outside.

Why does an IP lookup say Amazon for a site hosted on Vercel?

Vercel and many other platforms run on cloud networks. The IP's ASN names the network that carries the traffic, which is Amazon here. Response headers such as server: Vercel and x-vercel-id, or a CNAME to vercel-dns.com, name the platform.

Is the registrar the same as the hosting provider?

Not necessarily. The registrar sells and manages the domain name, and the host runs the server. cal.com is registered at GoDaddy, uses Cloudflare for DNS and Google for email. kvietkos.lt uses Hostinger for hosting, DNS and registration, and Google for email.

Does the server location tell me where the host is based?

No. Geolocation estimates where the server with that IP address sits, not where the hosting company has its head office. For anycast addresses, many data centers share the address, so the city is only a label in the database.

Is it legal to look up where a website is hosted?

Yes. DNS records, IP registration data and RDAP results are public by design. Network administrators, security teams and hosting companies look them up every day.

Wrapping up

A website's host is the network that owns its IP address, unless a platform or a CDN sits in front of it. Response headers and CNAME records name the platform, and NS, MX and RDAP name the DNS provider, email provider and registrar. To see every layer for one domain with the evidence, enter it in our hosting check.

Related articles

• How to Check If a Domain Uses Cloudflare
• How to Find What CDN a Website Uses
• Website Server Location: How to Find Where a Server Is Located
• How to Check DNS Records for Any Domain