How to find out who hosts a website

RDAP (Registration Data Access Protocol) has replaced WHOIS as the official way to look up who a domain is registered through. The easiest way to use it is ICANN's lookup at lookup.icann.org. Enter the bare domain, for example fake-example.shop, without https:// or any path.

Look for:

• Registrar: the company name and its IANA ID.
• Abuse contact: an email address and often a phone number. This is where your report goes.
• Created / registered date: a very recent date on a site imitating an established business is a red flag worth quoting.
• Name servers: these hint at where DNS is managed. Two names ending in ns.cloudflare.com means Cloudflare.

Country-code domains (.uk, .de, .fr…) are run by national registries with their own lookup services. For .uk the registry is Nominet, which also has its own process for reporting domains used for crime.

The registrar does not host the site. To find the host, first find the IP address the domain points to. On Windows, open a command prompt; on a Mac or Linux, open a terminal:

# Windows
nslookup fake-example.shop

# macOS / Linux
dig +short A fake-example.shop
dig +short NS fake-example.shop
dig +short MX fake-example.shop

The A record is the IPv4 address of the web server. Also note the NS (name servers) and MX (mail servers) records: a lookalike domain with mail servers set up may be sending phishing emails as well as hosting a site.

Prefer a website? Any reputable online DNS lookup tool shows the same records.

Every public IP address belongs to a network, identified by an ASN (Autonomous System Number) and registered with one of five regional internet registries: ARIN (North America), RIPE NCC (Europe, Middle East), APNIC (Asia-Pacific), LACNIC (Latin America) and AFRINIC (Africa).

Two free ways to look an IP address up:

• bgp.he.net shows the ASN, network name and owning organisation.
• The registries' own lookups, or RDAP for IP addresses through rdap.org, show the full record including the abuse contact. In RIPE records it is labelled abuse-mailbox; in ARIN records, OrgAbuseEmail.

The organisation on the record is the hosting provider, or sometimes a larger network that sells space to smaller hosts. Report to the abuse address on the record; if the network is a reseller's upstream, it will pass the report on or act itself.

Many sites, legitimate and fake, sit behind Cloudflare, which proxies traffic so the real server's IP address is hidden. You will know because:

• the name servers end in ns.cloudflare.com;
• the IP addresses fall in Cloudflare's published ranges (listed at cloudflare.com/ips) and the ASN is AS13335;
• the site's responses carry a server: cloudflare header and a cf-ray header.

Reporting to the network you found in step 3 would then just reach Cloudflare. Instead, use Cloudflare's abuse form at abuse.cloudflare.com. Choose phishing if the site impersonates you to collect payments or logins, or the trademark or copyright categories for a copied site. Cloudflare forwards reports to the hosting provider and, for some categories, tells you who the host is, so you can report to them directly too.

Other proxies and CDNs work the same way: if the IP belongs to a CDN, look for that company's abuse process. Meanwhile the registrar, the browser blocklists and search engines do not depend on knowing the host at all.

By now you should have:

1. The registrar's name and abuse email (from RDAP).
2. The registration date.
3. The IP address and, if not proxied, the hosting network and its abuse email.
4. Whether Cloudflare or another proxy sits in front.

That is the address list for your reports. Next, read how to report a fake website for what to send each of them, and use the DMCA notice template for the host.

The free Takedown Pack check runs exactly these lookups (RDAP, DNS, the IP registry and Cloudflare detection) from our servers and shows you the registrar, the host and who to report to in about 20 seconds. No account needed.