The site owner has already proven uncooperative, so aim one level deeper. To find out who hosts a website, resolve the domain to an IP address, look up which network owns that IP in the public WHOIS registries, and send your takedown notice to that network's abuse desk. A normal site takes two minutes. One that is hiding takes detective work.
Aim at the host because the company whose servers physically deliver the content has a legal reason to act that the site owner does not. To keep its safe harbor under 17 U.S.C. § 512(c), a US-connected hosting provider must remove infringing material expeditiously once it receives a valid notice. Every technique below turns on that single mechanism.
Step 1: Resolve the domain name to an IP address
Every server on the internet has a numeric address, and your first job is to see it. From a terminal, `nslookup example.com` on Windows or `dig +short example.com` on macOS and Linux does it; from a browser, Google's public dig interface or any DNS lookup tool works. What you want is the A record, the domain's current IPv4 address. A site may also return an AAAA record over IPv6; either address works for the next step.
Two beginner traps. Do not ping, plenty of networks block ICMP echo while resolving DNS perfectly, so a dead ping proves nothing. And read the full answer: `dig` sometimes shows a CNAME first, meaning the domain points to something like `customers.somehost.com`, which then resolves to the IP. That middle name is often the hosting provider's own hostname and a free hint worth writing down.
Load-balanced sites return different addresses on different lookups. Any returned IP identifies the network, unless the network is a reverse proxy, in which case skip ahead to the Cloudflare section.
Step 2: Find the network that owns the IP
IP addresses belong to networks, and ownership is public record in the five regional internet registries: ARIN for North America, RIPE NCC for Europe and the Middle East, APNIC for Asia-Pacific, LACNIC for Latin America, AFRINIC for Africa. Start with ARIN's WHOIS regardless of where the site seems to live; if the address belongs to another region, the record says so and points you to the right registry.
Three fields carry the answer. `NetRange` or `CIDR` shows the block the organization controls. `OrgName` is the legal entity. `netname` is a short label for the block and often the most revealing field of the three: hosting companies name their ranges after themselves, so an unfamiliar netname is your first flag of a small provider or worse. Most records also list an abuse contact, which can save you the entire next step.
Interpret with care, though, because `OrgName` is not always the commercial host you can complain to. Data centers lease racks to hosting brands, hosting brands lease servers to resellers, and the network owner may sit two layers above whoever sold the infringer an account. Complain to the network owner anyway: operators forward abuse mail downstream, and a report at the top of the chain carries more weight than one lost at the bottom. Shared hosting, hundreds of unrelated sites on one IP, is normal and changes nothing; the network owner is still your recipient.
Step 3: Find the abuse desk and the DMCA agent
Knowing the network is half the job. The notice still has to land on a desk that acts. Start with the abuse contact from the WHOIS record. If it is missing, the decades-old convention in RFC 2142 calls for an `abuse@` mailbox at every provider's domain, and nearly every commercial host maintains one, a web form, or both. Larger providers publish dedicated DMCA or legal pages spelling out exactly how they want notices submitted.
For a US-connected provider there is a sharper target. Safe harbor is conditioned on designating a copyright agent with the US Copyright Office and publishing that agent's details, 17 U.S.C. § 512(c)(2), and the Office runs a searchable directory of DMCA agents. Notice delivered to the designated agent is the kind the statute rewards: under § 512(c), the material comes down expeditiously, or the provider faces the copyright owner's lawsuit without the safe harbor protection it depends on.
None of it helps if the notice is defective. A complaint typed into a contact form is not a notice; the statutory elements: identification of the copyrighted work, of the infringing material, a good-faith statement, a signature, are what start the clock. See how to draft a DMCA takedown notice that meets those requirements, then send the same notice to every host you identify.
When the trail ends at Cloudflare: finding the origin server
Sometimes step 2 hands you Cloudflare, or a rarer name like Akamai, Fastly, or Amazon CloudFront, instead of a host. These are reverse proxies. Cloudflare is overwhelmingly the common case, because its free tier hides the origin server's address from every public resolver, exactly what sites expecting takedown notices want. A proxy must forward traffic to something, so the host still exists; the job becomes finding the address behind it. Four techniques, in the order worth trying:
- Historical DNS. The domain pointed somewhere before it was proxied. Services such as SecurityTrails and ViewDNS archive past A records; find the most recent non-Cloudflare entry. Origins are lazy about moving, so the old address frequently still serves the site.
- Certificate search. TLS certificates are published to public logs. crt.sh indexes them by domain, and Censys goes further, associating each certificate with the IP addresses that actually served it. A proxied domain appearing on a non-Cloudflare address in those results is a leak.
- Subdomains and mail. The main domain may be proxied while `mail.example.com` or a forgotten `dev.example.com` resolves straight to the origin. Any email the site sends you, a newsletter, a form reply, carries the sending server's IP in its headers. Sloppy operators de-anonymize themselves.
- Filing with Cloudflare itself. Cloudflare is not the host and removes nothing, but its abuse intake forwards reports to both the site operator and the hosting provider behind it. The responses your report triggers frequently name the host outright.
Confirm a candidate origin before filing: with a command-line HTTP client such as curl, send a request to the candidate IP while setting the Host header to the site's domain. If that machine answers with the site's content, you have the origin. One exception: domains using Cloudflare for DNS only, without the proxy, show the real host back in step 2, and none of this detective work is needed.
What domain WHOIS reveals: the registrar is not the host
A second, separate lookup tells you who registered the domain. ICANN's official lookup returns the registrar, the creation and expiry dates, and the nameservers. Registrant contact details are widely redacted under privacy rules, but the registrar is always visible, someone accountable has to exist for the name to keep resolving.
The nameserver names are the useful leak. A domain on `ns1.somehost.com` is very likely hosted at somehost, or at least its DNS is. Neutral or vanity nameservers are common, so treat this as a hint to verify, never a conclusion.
Keep the two roles straight, because confusing them costs days. The registrar controls the name; the host controls the pages. Registrars take down whole domains rather than individual URLs, which puts them in the escalation path, not at step one. For the rest of what a registration record reveals, ownership, history, other domains, see finding out who owns a domain.
Bulletproof and offshore hosts: when the WHOIS answer goes dark
Sometimes the network owner has no working abuse contact and no intention of creating one. These providers, bulletproof hosts, in the industry's own vocabulary, exist on purpose, clustered in jurisdictions where abuse mail goes to be ignored. The signs are consistent: a network nobody has heard of, a provider site with no abuse page anywhere, an autonomous system whose other occupants are all piracy and scam sites, and silence two weeks after your notice.
Know why the leverage evaporates so you do not waste it. Notice-and-takedown works because a US-connected provider must act on a proper notice to keep its safe harbor. A provider outside the statute's reach has nothing to lose by ignoring you, and what happens next is driven by the provider's own policy and by local law. Whether the DMCA works internationally is its own question, and the country-by-country guide maps where enforcement realistically lands.
Two moves still apply. Report the site to the network's upstream suppliers, data centers and transit providers police their own acceptable-use policies, and those contracts reach the bulletproof host even when nothing else does. And archive every notice and every non-response; the paper trail feeds the registrar complaints in the next section.
The escalation ladder: pressure beyond the hosting provider
Before climbing, sharpen the record. If the silent host is US-connected, it is gambling: ignoring valid notices risks its safe harbor the moment the copyright owner sues, and safe harbor is further conditioned on reasonably implementing a policy that terminates repeat infringers, 17 U.S.C. § 512(i). Your notice record builds that case; see how repeat-infringer policies work. If the host rejected rather than ignored you, read the stated grounds first, what to do after a takedown is rejected covers the common ones.
The first rung past the host is search. Google and Bing run their own DMCA intake and delist infringing URLs from results, the activity 17 U.S.C. § 512(d) covers, which strips the site's traffic while the page survives. A Google delisting request costs nothing and takes minutes, so run it in parallel with the host notice rather than after it.
The next rung is the registrar. Registrars do not adjudicate copyright, but they are contractually obliged to investigate reports of inaccurate registration data, and many now suspend domains for chronic abuse under their own policies. That lever is platform policy rather than statute, so results vary by registrar and by registry, which is why the documented-notice file matters. A domain hiding its ownership while hosting documented infringement is precisely the complaint they act on.
The last rung is revenue. Pirate sites are businesses with payment processors and advertising networks, and both have policies against monetizing infringement and act on credible reports. Cutting the money does not remove the content, but it removes the reason the content exists.
Quick answers about identifying a website's host
How do I find out who hosts a website for free?
Every technique in this guide costs nothing. DNS tools resolve the domain, the regional registries publish IP ownership free of charge, certificate logs are public records, and the mail-header trick is free too. What commercial tools sell is convenience, bulk lookups, saved history, monitoring, which starts to matter when you track dozens of sites instead of one.
What does it mean when the IP address belongs to Cloudflare?
It means you found the proxy, not the server. Cloudflare relays traffic between visitors and the true host, so public lookups return Cloudflare's network while the origin stays hidden. The host still exists behind it. Pull historical DNS, search certificate logs, check unproxied subdomains and mail headers, or file with Cloudflare directly and let its forwarding reveal the provider.
Is the web host the same company as the domain registrar?
Not usually. The registrar manages the domain name; the hosting provider runs the servers that serve the pages. Some companies sell both, but plenty of sites register their name in one place and host in another. The nameserver names in the domain's WHOIS record often hint at the host, though neutral nameservers hide the trail.
How quickly should a host respond to a DMCA notice?
The statute requires expeditious removal but sets no deadline, so response time depends entirely on the provider. Large US-connected hosts typically disable content within days of a valid notice, smaller ones take longer, and offshore providers may never answer. For realistic expectations across providers and platforms, see how long DMCA takedowns take.
What can I do if the hosting provider ignores me?
Go around it. File delisting requests with the search engines so the pages stop drawing traffic, complain to the registrar about inaccurate registration data or a pattern of infringement, and report the site to its payment processor and advertising networks. Escalation exists precisely because some providers are built to ignore abuse mail.
What to do next
- Resolve the domain to its current IP with `dig`, `nslookup`, or any browser-based DNS tool.
- Paste the IP into ARIN's WHOIS, follow the pointer if another registry owns the block, and note the OrgName, netname, and abuse contact.
- If the network is Cloudflare or a similar proxy, work historical DNS and certificate search for the origin before falling back to the proxy's own abuse form.
- Send a complete, valid DMCA notice to the abuse desk and the provider's designated agent, and keep proof of what you sent and when.
- After two weeks of silence, escalate in parallel: search-engine delisting, the registrar complaint, and the payment and ad-network reports.
- If the detective work is not how you want to spend the afternoon, identifying the host, the registrar, and every platform in between is part of each managed takedown we run, you send the link, we find everyone else. For the self-directed route, the DIY takedown toolkit has the escalation letters pre-drafted.