Popular tools

Theme

GET/api/v2/hosting

Hosting check API

Who hosts a website: the host and its evidence, the CDN in front, DNS and email providers, registrar, certificate CA and abuse contact.

GEThttps://dnsrobot.netBase URL/api/v2Version/hostingEndpoint?domain=Parameters
200 OKRecorded 2026-10-25. Send it to run the request live.
{
  "query": {
    "domain": "github.com"
  },
  "state": "unknown",
  "zone": "github.com",
  "host": null,
  "cdn": null,
  "address": {
    "ip": "140.82.112.3",
    "version": 4,
    "asn": 36459,
    "network": "GitHub",
    "asName": "GITHUB - GitHub, Inc., US",
    "prefix": "140.82.112.0/24",
    "country": "US"
  },
  "addresses": {
    "apex": [
      {
        "ip": "140.82.112.3",
        "version": 4,
        "asn": 36459,
        "network": "GitHub",
        "prefix": "140.82.112.0/24",
        "country": "US"
      }
    ],
    "www": [
      {
        "ip": "140.82.114.3",
        "version": 4,
        "asn": 36459,
        "network": "GitHub",
        "prefix": "140.82.114.0/24",
        "country": "US"
      }
    ]
  },
  "wwwCname": [
    "github.com"
  ],
  "originHints": [],
  "dnsHost": {
    "id": "ns1",
    "name": "NS1"
  },
  "nameservers": [
    "dns1.p08.nsone.net",
    "dns2.p08.nsone.net",
    "dns3.p08.nsone.net",
    "dns4.p08.nsone.net",
    "ns-1283.awsdns-32.org",
    "ns-1707.awsdns-21.co.uk",
    "ns-421.awsdns-52.com",
    "ns-520.awsdns-01.net"
  ],
  "email": {
    "provider": {
      "id": "microsoft-365",
      "name": "Microsoft 365"
    },
    "mx": [
      "github-com.mail.protection.outlook.com"
    ],
    "senders": [
      {
        "id": "microsoft-365",
        "name": "Microsoft 365"
      },
      {
        "id": "google-workspace",
        "name": "Google Workspace"
      },
      {
        "id": "zendesk",
        "name": "Zendesk"
      },
      {
        "id": "salesforce",
        "name": "Salesforce"
      },
      {
        "id": "mailchimp",
        "name": "Mailchimp"
      },
      {
        "id": "marketo",
        "name": "Marketo"
      },
      {
        "id": "sendgrid",
        "name": "SendGrid"
      }
    ]
  },
  "registrar": {
    "name": "MarkMonitor Inc.",
    "url": "http://www.markmonitor.com"
  },
  "certificate": {
    "issuer": "Sectigo",
    "expires": "2027-01-11T23:59:59Z"
  },
  "site": {
    "finalUrl": "https://github.com/",
    "redirects": [
      {
        "url": "https://github.com/",
        "status": 200
      }
    ],
    "server": "github.com",
    "cms": []
  },
  "parkedBy": null,
  "abuse": {
    "email": "noc@github.com",
    "network": "GitHub, Inc."
  },
  "checkedAt": "2026-10-25T08:13:05.364Z",
  "tookMs": 3695
}
Jump to a section

How it works

Traces a website from what it shows publicly. One round of DNS (the name and www with their CNAME chains, NS, MX, TXT, and the mail., webmail., cpanel., ftp. and direct. names that often skip a CDN), then side by side each address's network (Team Cymru), the homepage (redirects followed, headers and markup read), the newest certificate in Certificate Transparency (Cert Spotter) and the registrar (the WHOIS lookup), then the abuse desk of the main address's network.

The host comes with a confidence and the evidence it rests on: the network, the address block's registrant, response headers, CNAME targets, a site builder, nameservers. A platform (Vercel, Shopify, Kinsta) wins over the cloud it runs on, named in runsOn; equal fits drop to low confidence with the others in alternatives. Nameservers alone never name the host of a site on a network no known provider owns.

Behind a CDN the origin's address is never returned: it would let attacks go around the CDN. state is behind_cdn when only the CDN can be seen, and names that skip it come back in originHints with their network only. answeredFrom is the CDN location that answered our request, near our server, not the origin.

A name that doesn't exist or has no A/AAAA record is a finding (state: nxdomain or no_address, the rest null); one that points to a private address is a 422. A source that didn't answer leaves its part empty and is named in warnings.

Answers kept: Kept an hour (a minute when a source didn't answer), shared with the Hosting Checker page; `Cache-Control: max-age` says how long this answer has left.

Query parameters

  • domainstringrequired
    The website's domain name; a URL is fine and a leading www. is dropped (the check looks at the name and its www together).

Response fields

200 with this JSON object, plus tookMs, and incomplete with warnings when a source failed. Fields marked optional appear only when they apply.

  • queryobjectalways
    What was looked up, normalised (lower case, no trailing dot, IDNs as Punycode).
    • domainstringalways
      The domain checked: lower case, Punycode, no www., no trailing dot.
  • statestringalways
    The verdict: a host found (hosted), only the CDN in front visible (behind_cdn), the site forwards to another domain (redirect), a parked domain (parked), no host recognised (unknown), the site didn't answer (unreachable), no such domain (nxdomain), or no A/AAAA record (no_address).

    one of "hosted", "behind_cdn", "redirect", "parked", "unknown", "unreachable", "nxdomain", "no_address"

  • zonestringalways
    The registrable domain (example.co.uk for shop.example.co.uk).
  • hostobject or nullalways
    The hosting provider, null when none is recognised.
    Show 8 fields
    • idstringalways
      Stable provider id (vercel, aws, hostinger).
    • namestringalways
      The provider's name.
    • kindstringalways
      What the provider sells.

      one of "shared", "managed_wp", "managed", "cloud", "vps", "builder", "paas", "cdn", "commerce", "billing", "helpdesk", "docs", "status", "courses", "newsletter"

    • websitestring or nullalways
      The provider's website.
    • confidencestringalways
      How sure the detection is: high (the network or a header proves it), medium, low (one weak signal, or several providers fit equally).

      one of "high", "medium", "low"

    • evidencearray of objectsalways
      The signals the detection rests on, strongest first.
      Show 3 fields
      • typestringalways
        What matched: the address's network (asn), the address block's registrant (block), an address the provider gives customers (ip), a response header (header), a page Cloudflare made itself (worker), a CNAME target (cname), a site builder that only runs there (cms), a nameserver (ns).

        one of "asn", "block", "ip", "header", "worker", "cname", "cms", "ns"

      • valuestringalways
        The matched value: AS15169 GOOGLE, x-vercel-id, the CNAME target, the nameserver…
      • detailstringalways
        The signal in a sentence.
    • alternativesarray of stringsalways
      Other providers that fit the same evidence equally well (confidence is then low).
    • runsOnstring or nullalways
      The cloud or VPS network a platform runs on (Amazon Web Services under Vercel).
  • cdnobject or nullalways
    The CDN or security proxy in front of the site, null when there is none.
    Show 4 fields
    • idstringalways
      Stable CDN id (cloudflare, fastly, cloudfront, akamai).
    • namestringalways
      The CDN's name.
    • evidencearray of objectsalways
      The signals the detection rests on, strongest first.
      Show 3 fields
      • typestringalways
        What matched: the address's network (asn), the address block's registrant (block), an address the provider gives customers (ip), a response header (header), a page Cloudflare made itself (worker), a CNAME target (cname), a site builder that only runs there (cms), a nameserver (ns).

        one of "asn", "block", "ip", "header", "worker", "cname", "cms", "ns"

      • valuestringalways
        The matched value: AS15169 GOOGLE, x-vercel-id, the CNAME target, the nameserver…
      • detailstringalways
        The signal in a sentence.
    • answeredFromstring or nullalways
      The CDN location that answered our request (an IATA airport code from its own header, e.g. FRA): near our server, not the origin.
  • addressobject or nullalways
    The address the site was served from (the CDN's own behind a CDN), with its network; null when the check stopped at DNS.
    Show 7 fields
    • ipstringalways
      The address.
    • versionintegeralways
      IP version.

      one of 4, 6

    • asninteger or nullalways
      The AS number that announces it.
    • networkstring or nullalways
      The network's operator as people know it.
    • asNamestring or nullalways
      The AS name as registered (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US).
    • prefixstring or nullalways
      The routed block.
    • countrystring or nullalways
      Where the block is registered (ISO 3166-1 alpha-2).
  • addressesobjectalways
    The domain's and www's addresses. Behind a CDN only the CDN's are listed.
    • apexarray of objectsalways
      The domain's own A and AAAA records.
      Show 6 fields
      • ipstringalways
        The address.
      • versionintegeralways
        IP version.

        one of 4, 6

      • asninteger or nullalways
        The AS number that announces it (Team Cymru), null when the lookup didn't answer.
      • networkstring or nullalways
        The network's operator as people know it (Microsoft, Cloudflare).
      • prefixstring or nullalways
        The routed block it is announced in.
      • countrystring or nullalways
        Where the block is registered (ISO 3166-1 alpha-2): the organization's country, not the server's.
    • wwwarray of objectsalways
      www's A and AAAA records.
      Show 6 fields
      • ipstringalways
        The address.
      • versionintegeralways
        IP version.

        one of 4, 6

      • asninteger or nullalways
        The AS number that announces it (Team Cymru), null when the lookup didn't answer.
      • networkstring or nullalways
        The network's operator as people know it (Microsoft, Cloudflare).
      • prefixstring or nullalways
        The routed block it is announced in.
      • countrystring or nullalways
        Where the block is registered (ISO 3166-1 alpha-2): the organization's country, not the server's.
  • wwwCnamearray of stringsalways
    The CNAME targets www points through, in order.
  • originHintsarray of objectsalways
    Behind a CDN: names that skip it, with the network they point to (never the address).
    • namestringalways
      The name (mail.example.com).
    • networkstringalways
      The network it points to.
    • asnintegeralways
      That network's AS number.
  • dnsHostobject or nullalways
    Who runs the domain's nameservers (Cloudflare, Amazon Route 53, NS1), null when unknown.
    • idstringalways
      Stable lower-case id of the company or product, e.g. google-workspace.
    • namestringalways
      Its name as people write it.
  • nameserversarray of strings or nullalways
    The zone's NS records, sorted; null when the check stopped at DNS.
  • emailobject or nullalways
    Who handles the domain's email; null when the check stopped at DNS.
    • providerobject or nullalways
      The mailbox provider recognised from the MX hosts, null when none is recognised.
      Show 2 fields
      • idstringalways
        Stable lower-case id of the company or product, e.g. google-workspace.
      • namestringalways
        Its name as people write it.
    • mxarray of stringsalways
      The MX hosts, lowest preference first (at most five).
    • sendersarray of objectsalways
      Services the SPF record lets send mail for the domain (its include terms), in order.
      Show 2 fields
      • idstringalways
        Stable lower-case id of the company or product, e.g. google-workspace.
      • namestringalways
        Its name as people write it.
  • registrarobject or nullalways
    The registrar, from the WHOIS lookup; null when the registry didn't say.
    • namestringalways
      The registrar's name.
    • urlstring or nullalways
      The registrar's website.
  • certificateobject or nullalways
    The newest unexpired certificate for the name in Certificate Transparency; null when none was found or the log didn't answer.
    • issuerstringalways
      The issuing CA as people know it (Let's Encrypt, Sectigo).
    • expiresstringalways
      When that certificate expires (ISO 8601 UTC).
  • siteobject or nullalways
    What the homepage answered; null when it didn't answer or the check stopped at DNS.
    Show 4 fields
    • finalUrlstringalways
      Where the redirects ended.
    • redirectsarray of objectsalways
      Each answer on the way, the final one last.
      Show 2 fields
      • urlstringalways
        The URL asked.
      • statusintegeralways
        The HTTP status.
    • serverstring or nullalways
      The final answer's Server header.
    • cmsarray of objectsalways
      Site builders and CMSs recognised in the page and headers.
      Show 2 fields
      • idstringalways
        Stable lower-case id of the company or product, e.g. google-workspace.
      • namestringalways
        Its name as people write it.
  • parkedByobject or nullalways
    The parking service, when the domain is parked.
    • idstringalways
      Stable lower-case id of the company or product, e.g. google-workspace.
    • namestringalways
      Its name as people write it.
  • abuseobject or nullalways
    The abuse desk of the network the site is served from (its RIR record); null when it has none.
    • emailstringalways
      Abuse email address.
    • networkstring or nullalways
      The network's registered holder.
  • checkedAtstringalways
    When the sources were asked (ISO 8601 UTC). A kept answer is older than the request.

Errors

  • 422 target_not_allowed A private or special-use name (.local, .internal…), or a domain that points to a private or reserved address.

Plus the errors every endpoint can return: 400 for a missing or unreadable parameter, 429 past the limit, 503 when every source failed.

Code samples

curl "https://dnsrobot.net/api/v2/hosting?domain=github.com"
const params = new URLSearchParams({ domain: "github.com" });
const res = await fetch(`https://dnsrobot.net/api/v2/hosting?${params}`);
const data = await res.json();
if (!res.ok) throw new Error(data.error.message);
console.log(data.host);
import requests

r = requests.get(
    "https://dnsrobot.net/api/v2/hosting",
    params={"domain": "github.com"},
    timeout=30,
)
data = r.json()
if not r.ok:
    raise RuntimeError(data["error"]["message"])
print(data["host"])
package main

import (
	"encoding/json"
	"fmt"
	"net/http"
	"net/url"
)

func main() {
	q := url.Values{"domain": {"github.com"}}
	res, err := http.Get("https://dnsrobot.net/api/v2/hosting?" + q.Encode())
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()
	var data map[string]any
	if err := json.NewDecoder(res.Body).Decode(&data); err != nil {
		panic(err)
	}
	if res.StatusCode != http.StatusOK {
		panic(data["error"])
	}
	fmt.Println(data["host"])
}
<?php
$query = http_build_query(["domain" => "github.com"]);
$context = stream_context_create(["http" => ["ignore_errors" => true, "timeout" => 30]]);
$data = json_decode(file_get_contents("https://dnsrobot.net/api/v2/hosting?" . $query, false, $context), true);
if (isset($data["error"])) {
    throw new RuntimeException($data["error"]["message"]);
}
print_r($data["host"]);
require "net/http"
require "json"

uri = URI("https://dnsrobot.net/api/v2/hosting")
uri.query = URI.encode_www_form(domain: "github.com")
data = JSON.parse(Net::HTTP.get(uri))
raise data["error"]["message"] if data["error"]
puts data["host"]
// Cargo.toml: reqwest = { version = "0.13", features = ["blocking", "json"] }, serde_json = "1"
fn main() -> Result<(), Box<dyn std::error::Error>> {
    let res = reqwest::blocking::get("https://dnsrobot.net/api/v2/hosting?domain=github.com")?;
    let ok = res.status().is_success();
    let data: serde_json::Value = res.json()?;
    if !ok {
        return Err(data["error"]["message"].to_string().into());
    }
    println!("{}", data["host"]);
    Ok(())
}
using System.Text.Json;

using var http = new HttpClient();
var res = await http.GetAsync("https://dnsrobot.net/api/v2/hosting?domain=github.com");
var data = JsonDocument.Parse(await res.Content.ReadAsStringAsync()).RootElement;
if (!res.IsSuccessStatusCode)
    throw new Exception(data.GetProperty("error").GetProperty("message").GetString());
Console.WriteLine(data.GetProperty("host"));

github.com

GET /api/v2/hosting?domain=github.com
200 OKRecorded 2026-10-25
{
  "query": {
    "domain": "github.com"
  },
  "state": "unknown",
  "zone": "github.com",
  "host": null,
  "cdn": null,
  "address": {
    "ip": "140.82.112.3",
    "version": 4,
    "asn": 36459,
    "network": "GitHub",
    "asName": "GITHUB - GitHub, Inc., US",
    "prefix": "140.82.112.0/24",
    "country": "US"
  },
  "addresses": {
    "apex": [
      {
        "ip": "140.82.112.3",
        "version": 4,
        "asn": 36459,
        "network": "GitHub",
        "prefix": "140.82.112.0/24",
        "country": "US"
      }
    ],
    "www": [
      {
        "ip": "140.82.114.3",
        "version": 4,
        "asn": 36459,
        "network": "GitHub",
        "prefix": "140.82.114.0/24",
        "country": "US"
      }
    ]
  },
  "wwwCname": [
    "github.com"
  ],
  "originHints": [],
  "dnsHost": {
    "id": "ns1",
    "name": "NS1"
  },
  "nameservers": [
    "dns1.p08.nsone.net",
    "dns2.p08.nsone.net",
    "dns3.p08.nsone.net",
    // … 5 more items
  ],
  "email": {
    "provider": {
      "id": "microsoft-365",
      "name": "Microsoft 365"
    },
    "mx": [
      "github-com.mail.protection.outlook.com"
    ],
    "senders": [
      {
        "id": "microsoft-365",
        "name": "Microsoft 365"
      },
      {
        "id": "google-workspace",
        "name": "Google Workspace"
      },
      {
        "id": "zendesk",
        "name": "Zendesk"
      },
      // … 4 more items
    ]
  },
  "registrar": {
    "name": "MarkMonitor Inc.",
    "url": "http://www.markmonitor.com"
  },
  "certificate": {
    "issuer": "Sectigo",
    "expires": "2027-01-11T23:59:59Z"
  },
  "site": {
    "finalUrl": "https://github.com/",
    "redirects": [
      {
        "url": "https://github.com/",
        "status": 200
      }
    ],
    "server": "github.com",
    "cms": []
  },
  "parkedBy": null,
  "abuse": {
    "email": "noc@github.com",
    "network": "GitHub, Inc."
  },
  "checkedAt": "2026-10-25T08:13:05.364Z",
  "tookMs": 3695
}

Shortened for the page: long lists show their first items.

wikipedia.org

GET /api/v2/hosting?domain=wikipedia.org
200 OKRecorded 2026-10-25
{
  "query": {
    "domain": "wikipedia.org"
  },
  "state": "unknown",
  "zone": "wikipedia.org",
  "host": null,
  "cdn": null,
  "address": {
    "ip": "208.80.154.224",
    "version": 4,
    "asn": 14907,
    "network": "Wikimedia Foundation",
    "asName": "WIKIMEDIA - Wikimedia Foundation Inc., US",
    "prefix": "208.80.154.0/23",
    "country": "US"
  },
  "addresses": {
    "apex": [
      {
        "ip": "208.80.154.224",
        "version": 4,
        "asn": 14907,
        "network": "Wikimedia Foundation",
        "prefix": "208.80.154.0/23",
        "country": "US"
      },
      {
        "ip": "2620:0:861:ed1a::1",
        "version": 6,
        "asn": 14907,
        "network": "Wikimedia Foundation",
        "prefix": "2620:0:861::/48",
        "country": "US"
      }
    ],
    "www": [
      {
        "ip": "208.80.154.224",
        "version": 4,
        "asn": 14907,
        "network": "Wikimedia Foundation",
        "prefix": "208.80.154.0/23",
        "country": "US"
      },
      {
        "ip": "2620:0:861:ed1a::1",
        "version": 6,
        "asn": 14907,
        "network": "Wikimedia Foundation",
        "prefix": "2620:0:861::/48",
        "country": "US"
      }
    ]
  },
  "wwwCname": [
    "dyna.wikimedia.org"
  ],
  "originHints": [],
  "dnsHost": {
    "id": "wikimedia-org",
    "name": "wikimedia.org"
  },
  "nameservers": [
    "ns0.wikimedia.org",
    "ns1.wikimedia.org",
    "ns2.wikimedia.org"
  ],
  "email": {
    "provider": null,
    "mx": [
      "mx-in2001.wikimedia.org",
      "mx-in1001.wikimedia.org"
    ],
    "senders": []
  },
  "registrar": {
    "name": "MarkMonitor Inc.",
    "url": "https://www.markmonitor.com/about-us/"
  },
  "certificate": {
    "issuer": "Let's Encrypt",
    "expires": "2027-01-02T18:34:50Z"
  },
  "site": {
    "finalUrl": "https://www.wikipedia.org/",
    "redirects": [
      {
        "url": "https://wikipedia.org/",
        "status": 301
      },
      {
        "url": "https://www.wikipedia.org/",
        "status": 200
      }
    ],
    "server": "ATS/9.2.15",
    "cms": []
  },
  "parkedBy": null,
  "abuse": {
    "email": "abuse@wikimedia.org",
    "network": "Wikimedia Foundation Inc."
  },
  "checkedAt": "2026-10-25T08:13:10.903Z",
  "tookMs": 5449
}

Behind a CDN (cloudflare.com)

GET /api/v2/hosting?domain=cloudflare.com
200 OKRecorded 2026-10-25
{
  "query": {
    "domain": "cloudflare.com"
  },
  "state": "behind_cdn",
  "zone": "cloudflare.com",
  "host": null,
  "cdn": {
    "id": "cloudflare",
    "name": "Cloudflare",
    "evidence": [
      {
        "type": "asn",
        "value": "AS13335 CLOUDFLARENET",
        "detail": "IP address is on the Cloudflare network (AS13335 CLOUDFLARENET)"
      },
      {
        "type": "header",
        "value": "cf-ray: a4ffc2b0495ef3d0-HYD",
        "detail": "HTTP header cf-ray: a4ffc2b0495ef3d0-HYD"
      }
    ],
    "answeredFrom": "HYD"
  },
  "address": {
    "ip": "104.16.132.229",
    "version": 4,
    "asn": 13335,
    "network": "Cloudflare",
    "asName": "CLOUDFLARENET - Cloudflare, Inc., US",
    "prefix": "104.16.128.0/20",
    "country": "US"
  },
  "addresses": {
    "apex": [
      {
        "ip": "104.16.132.229",
        "version": 4,
        "asn": 13335,
        "network": "Cloudflare",
        "prefix": "104.16.128.0/20",
        "country": "US"
      },
      {
        "ip": "104.16.133.229",
        "version": 4,
        "asn": 13335,
        "network": "Cloudflare",
        "prefix": "104.16.128.0/20",
        "country": "US"
      },
      {
        "ip": "2606:4700::6810:84e5",
        "version": 6,
        "asn": 13335,
        "network": "Cloudflare",
        "prefix": "2606:4700::/44",
        "country": "US"
      },
      // … 1 more item
    ],
    "www": [
      {
        "ip": "104.16.123.96",
        "version": 4,
        "asn": 13335,
        "network": "Cloudflare",
        "prefix": "104.16.112.0/20",
        "country": "US"
      },
      {
        "ip": "104.16.124.96",
        "version": 4,
        "asn": 13335,
        "network": "Cloudflare",
        "prefix": "104.16.112.0/20",
        "country": "US"
      },
      {
        "ip": "2606:4700::6810:7c60",
        "version": 6,
        "asn": 13335,
        "network": "Cloudflare",
        "prefix": "2606:4700::/44",
        "country": "US"
      },
      // … 1 more item
    ]
  },
  "wwwCname": [],
  "originHints": [],
  "dnsHost": {
    "id": "cloudflare-com",
    "name": "cloudflare.com"
  },
  "nameservers": [
    "ns3.cloudflare.com",
    "ns4.cloudflare.com",
    "ns5.cloudflare.com",
    // … 2 more items
  ],
  "email": {
    "provider": null,
    "mx": [
      "mxb-canary.global.inbound.cf-emailsecurity.net",
      "mxa-canary.global.inbound.cf-emailsecurity.net",
      "mxb.global.inbound.cf-emailsecurity.net",
      // … 1 more item
    ],
    "senders": [
      {
        "id": "google-workspace",
        "name": "Google Workspace"
      },
      {
        "id": "mailchimp-transactional",
        "name": "Mailchimp Transactional"
      },
      {
        "id": "zendesk",
        "name": "Zendesk"
      },
      // … 1 more item
    ]
  },
  "registrar": {
    "name": "Cloudflare, Inc.",
    "url": "http://www.cloudflare.com"
  },
  "certificate": {
    "issuer": "Let's Encrypt",
    "expires": "2027-01-09T23:03:29Z"
  },
  "site": {
    "finalUrl": "https://www.cloudflare.com/",
    "redirects": [
      {
        "url": "https://cloudflare.com/",
        "status": 301
      },
      {
        "url": "https://www.cloudflare.com/",
        "status": 200
      }
    ],
    "server": "cloudflare",
    "cms": []
  },
  "parkedBy": null,
  "abuse": {
    "email": "abuse@cloudflare.com",
    "network": "Cloudflare, Inc."
  },
  "checkedAt": "2026-10-25T08:13:12.164Z",
  "tookMs": 1189
}

Shortened for the page: long lists show their first items.