How a host is identified from an address
Hosting leaves a trail in public data. A domain's A and AAAA records give its addresses, every public address belongs to a block assigned to some organisation, and that block is announced to the internet by an autonomous system with a number (ASN). The tool resolves the domain through public resolvers, takes up to three IPv4 and two IPv6 addresses and looks up the owner of each.
The Hosting provider tile shows the organisation recorded for the first address whose owner could be found, with an ASN underneath. For a site on a large cloud that could be Amazon's AS16509 or DigitalOcean's AS14061. This is the network the traffic lands on, which makes it the right party for a network abuse report, though it is not always the company the site owner pays.
DNS, email and platform clues
The DNS provider is inferred from the nameserver hostnames: names ending in ns.cloudflare.com mean Cloudflare DNS, names containing awsdns mean Amazon Route 53, domaincontrol.com means GoDaddy. Email works the same way from MX records, so aspmx.l.google.com reads as Google Workspace and mail.protection.outlook.com as Microsoft 365. About thirty DNS providers and twenty mail providers are recognised.
For the web layer the tool requests https://example.com, falls back to http if that fails, follows redirects and reads up to 300 KB of the response. Headers such as cf-ray, x-amz-cf-id or x-vercel-id identify a CDN or platform. The HTML is searched for markers like wp-content paths (WordPress), cdn.shopify.com (Shopify) and a generator meta tag.
Reading the result
The four tiles are the summary. CDN / proxy reads None detected when no known CDN header was present. Email provider reads No email when the domain has no MX records at all. Under the tiles, the IP addresses table lists each address with an IPv4 or IPv6 tag, Organization, ASN and Location, and each address links to IP Lookup for the full record.
The Web server card shows the HTTP status, the final URL after redirects, the Server and X-Powered-By headers and a row of platform tags. If the site did not answer over HTTPS or HTTP, the card shows the error instead and no CDN can be detected, but the DNS-based results still stand. Nameservers and Mail servers list the raw hostnames, MX hosts in priority order.
Why the origin host can stay hidden
A CDN or reverse proxy terminates the visitor's connection on its own addresses and fetches the page from the origin privately. From outside, the domain resolves only to the proxy, so both the address table and the Hosting provider tile show the CDN. That is by design. The dependable ways to reach the origin's operator are to ask the site owner or, for abuse, to report through the CDN.
Resellers blur things in a similar way. Many managed hosts and site builders rent capacity from the big clouds, so the address owner is the cloud while the customer deals with a brand that appears nowhere in the IP data. Platform tags such as WP Engine, Kinsta, Shopify or Wix, when present, are the better hint in those cases.
Getting useful answers and knowing the limits
Enter the name where the site lives. NS and MX records belong to the registered domain, so a subdomain such as shop.example.com returns its hosting details but usually shows no nameservers and No email. A domain with no A or AAAA record produces an error saying it is not hosted anywhere right now. Sites that rotate addresses can give different results on a second run.
Everything here is inference from public signals, and signals can mislead. Headers can be removed or faked, a self-run Varnish cache sends the same Via header the tool associates with Fastly, and Location is a geolocation estimate that means little for anycast addresses. The host is also not the registrar: WHOIS Lookup shows that, and Reverse IP Lookup lists other sites on the same address.