Malte ZanderContents
You find a fake site's host in three steps: resolve the domain to its IP address, look up that address's network records at the responsible internet registry and read the network operator and abuse contact there. If the IP belongs to a CDN such as Cloudflare, that isn't the host but an intermediary that forwards your report. Record the time and result, because IP addresses can change quickly.
- IP addresses are managed worldwide by five regional internet registries: AFRINIC, APNIC, ARIN, LACNIC and RIPE NCC (RIPE NCC).
- Since 2013, the RIPE NCC has required all address ranges it allocates and assigns to carry an abuse contact in the "abuse-c" attribute (RIPE NCC).
- If a site sits behind Cloudflare, Cloudflare forwards reports to the host and gives it the origin IP (Cloudflare).
- Since 28 January 2025, RDAP has been the authoritative source of registration data for generic domains (ICANN).
What's the difference between a registrar and a host?
The registrar manages the name, the host the content. A domain such as your-brand-login.com is registered with a registrar, while the page behind it sits on a hosting provider's server. Often these are two different companies in two different countries. A takedown needs both: the registrar to suspend an abusive domain and the host to remove content and the account. You find the registrar in the domain's RDAP data and the host through the IP address.
How do you find the host, step by step?
Step 1: resolve the domain to an IP address
Look up the domain's A records, and AAAA records for IPv6. Commands such as nslookup or dig do this, as do many DNS tools on the web. Also check the exact subdomain from the phishing link, because your-brand.example.com can point to a different server than example.com. Record every address with date and time.
Step 2: look up the IP's network records
Every IP address belongs to an address block that one of the five regional registries has allocated to a network operator. For Europe and the Middle East, that's the RIPE NCC; for North America, ARIN. An RDAP or WHOIS query at the responsible registry gives you the network name, organisation and abuse contact. Tools such as the RIPE Database or RIPEstat also show the autonomous system that routes the block.
Step 3: read the abuse contact
In the RIPE Database, it's in the "abuse-c" attribute, with an address in the "abuse-mailbox" field. That address is the official channel for abuse reports to this network. Write to it rather than to every contact of the network.
How do you spot a CDN or a proxy?
When the network records name a CDN as the holder, such as Cloudflare. The CDN then sits between visitors and the host, and the actual server stays hidden. Other clues are the CDN's name servers and response headers with typical identifiers of the service. In that case, report through the CDN's abuse form, which forwards your report to the host. The steps are in Taking down a site behind Cloudflare or another CDN.
How do you recognize platforms and site builders?
From the address and the network together. If the fake sits on a subdomain of a website builder, a cloud storage service or a form service, the platform itself is the host. It can remove the content directly, and the report belongs in its abuse form. The registrar of the platform's domain is the wrong recipient here, because the domain belongs to the platform and is legitimate.
| Finding | Who is the host? | Where to report |
|---|---|---|
| IP belongs to a hosting company | That company | Abuse contact from the network records |
| IP belongs to a CDN | Unknown, behind the CDN | The CDN's abuse form |
| Subdomain of a site builder or cloud storage | The platform | The platform's abuse form |
| Several IPs in different networks | Possibly several | All network operators, or first check whether a CDN is in front |
What are the pitfalls?
Four common ones:
Changing addresses: operators change DNS records, sometimes several times a day. A lookup is a snapshot. Repeat it before every report.
Geo-DNS: visitors may get different addresses depending on their location. Note where you queried from.
Reassigned networks: some address blocks are reassigned to customers. The network operator is then the host's provider. Report to the listed abuse contact anyway; it forwards.
Hacked websites: if the fake sits on a genuine, hacked website, that website's host is the right recipient, together with the site owner. More in Host, registrar or DNS.
What goes into the evidence package?
IP addresses with the time of the lookup, the registry's full response with network name, organisation and abuse contact, and for CDNs the service's identifier. Save the raw data of the query, not just your summary. That way you can later prove where the site was when you reported it. The full list is in Securing evidence of a fake website.
How does AI Fraud Protect help?
AI Fraud Protect identifies the registrar, host, DNS provider and CDN for every find automatically and adds the network data to the evidence package. Reports are prepared for the right contacts, through the CDN's own route where one is in front. A person reviews and sends every message, and open cases stay on the follow-up list until the fake is gone.
Start the free fraud scan for a short report within 48 hours, or request a demo to see detection, evidence and takedown in the app.
FAQ
Can I find the host through the fake site's imprint?
No. Imprints and contact details on fakes are usually invented or copied from you. Rely on the IP address and the network records.
What if the host sits in a country without a working abuse department?
Then the registrar and browser warnings are your strongest levers. A suspended domain makes the site unreachable wherever the server is.
May I examine the fake site's server myself?
You may look up public data such as DNS, network records and certificates. Beyond that, don't do anything: no scans, no login attempts, no interference.
Is the host also responsible for the scammers' emails?
Not necessarily. Where a domain's email goes is shown by its MX records, and that can be another provider. More in DNS records explained.
Sources
ICANN: launching RDAP, sunsetting WHOIS, 27 January 2025