Skip to main content
nebty
ende
Free Trial
Free hosting & DNS lookup

Who is hosting the site impersonating you?

Paste the domain of a fake website, phishing page, or lookalike. The tool reads back who actually hosts it, plus the IP, the registrar, the mail setup, and the nameservers. That is the trail a takedown request follows.

Try an example:
Example result Sample data

yourbrand-login.example

Hosting

Example Hosting Ltd.

Primary IP
203.0.113.24
ASN
AS64500
Abuse contact
[email protected]

Registration

Example Registrar Inc.

Created
3 days ago
Expires
in 1 year
Abuse contact
[email protected]

FAQ

Frequently asked questions

Short answers about the lookup and what to do with its result.

Your question is not on the list? Ask Benedikt directly
How do I find out who is hosting a website?
Enter the domain at the top of this page. The tool reads the website's public DNS and registration records and shows the hosting provider that serves its IP address, along with the registrar, the nameservers, and the mail servers. You do not need an account or any technical setup.
How do I find out who is hosting a fake or phishing website?
Paste the fake domain into the lookup. The hosting provider it returns is who you send an abuse report to so the page gets removed, and the registrar is who you contact about the domain itself. If you would rather not chase that down, nebty runs the full takedown for you.
What is a hosting provider, and how is it different from the registrar?
The hosting provider runs the servers and network that serve the website's content. The registrar is the company the domain name was bought through. A takedown usually starts with the hosting provider because they can pull the content fastest, while the registrar can act on the domain name when the host will not.
What does the ASN tell me?
An ASN (Autonomous System Number) identifies the network that announces the site's IP address on the internet. It is the most reliable way to name the real operator behind an IP, because the company that owns the IP and the brand shown on the website are often not the same.
What are nameservers and MX records?
Nameservers are the DNS servers that answer where a domain points, which often reveals the DNS or CDN provider in use. MX records list the mail servers that receive email for the domain, and the detected mail provider, for example Google Workspace or Microsoft 365, is derived from them.
What do the domain dates and status codes mean?
The creation and expiry dates come from the domain's registration record. A very recent creation date is a common sign of a throwaway impersonation domain. The status codes, such as "client transfer prohibited", are EPP states set by the registrar that control whether the domain can be transferred, updated, or deleted.
Where does the data come from, and is it accurate?
Everything is read live from public sources: DNS for the IP, mail, and nameserver records, RDAP for the registrar and dates, and Team Cymru to map the IP to its network owner. Some country-code domains do not publish registrar data, so a few fields can be empty, and the tool says so when that happens.
Is the lookup free?
Yes. The lookup is free and needs no account. It is also available as an MCP server, so you can run the same lookups straight from Claude, ChatGPT, or Codex.

Model Context Protocol

Use it from your AI agent

The same lookup runs as a free MCP server. Connect it once, then ask your agent to look up domains for you.

Server URL

https://tools.nebty-id.com/mcp

Claude, ChatGPT, and Codex are trademarks of their respective owners. nebty is not affiliated with, endorsed by, or sponsored by Anthropic or OpenAI.

Claude
  1. Open Settings, then Connectors, and choose Add custom connector.
  2. Give it any name and paste the server URL above. Leave authentication empty.
  3. Add it. The domain-info tool shows up right away.

Then ask, for example: "Use domain-info to look up github.com."

ChatGPT
  1. On a paid plan, open Settings, then Apps, then Advanced, and turn on Developer mode.
  2. Go to Settings, then Connectors, then Create. Paste the URL and leave authentication empty.
  3. In a chat, open the + menu, choose Developer mode, and pick the connector.
Codex
  1. Add it from the terminal, then ask Codex to use the domain-info tool:
codex mcp add open-services --url https://tools.nebty-id.com/mcp

Or add it to ~/.codex/config.toml:

[mcp_servers.open_services]
url = "https://tools.nebty-id.com/mcp"