Who hosts this website?

Enter a domain to see the host or CDN behind it, who runs its DNS and email, and the proof for each answer.

Try:

Results for pages.github.com

Checked 2026-11-14live lookup91 ms

Hosting platform

GitHub Pages

The site runs on GitHub Pages, a hosting platform, with Fastly in front of it.

Hosting platformHigh confidence

DNS provider

NS1 (IBM), Amazon Route 53

dns1.p08.nsone.net

Microsoft 365 (Exchange Online)

github-com.mail.protection.outlook.com

Network

Fastly, Inc.

AS54113 · United States

Addresses

Every address is listed in the details

Also seen on the web side: Fastly.
The name has 8 addresses; the first 6 were examined.

Evidence2

Provider	Kind	Clues
GitHub Pages	Hosting platform	185.199.111.153 is in GitHub Pages's published address ranges (185.199.108.0/22) 185.199.108.153 is in GitHub Pages's published address ranges (185.199.108.0/22) 185.199.109.153 is in GitHub Pages's published address ranges (185.199.108.0/22) 185.199.110.153 is in GitHub Pages's published address ranges (185.199.108.0/22) 2606:50c0:8002::153 is in GitHub Pages's published address ranges (2606:50c0:8000::/46)
Fastly	CDN or proxy	AS54113 (Fastly, Inc.) serves 6 of 6 addresses

DNS and network data were enough, so the site itself was not contacted.

Addresses6

Address	Network	Country	Provider
`185.199.111.153`	Fastly, Inc. AS54113	United States	GitHub Pages
`185.199.108.153`	Fastly, Inc. AS54113	United States	GitHub Pages
`185.199.109.153`	Fastly, Inc. AS54113	United States	GitHub Pages
`185.199.110.153`	Fastly, Inc. AS54113	United States	GitHub Pages
`2606:50c0:8002::153`	Fastly, Inc. AS54113	United States	GitHub Pages
`2606:50c0:8003::153`	Fastly, Inc. AS54113	United States	GitHub Pages

DNS provider8

DNS is split between NS1 (IBM) and Amazon Route 53, which is how a domain stays up if one provider fails.

Nameserver	Provider	Matched
`dns1.p08.nsone.net`	NS1 (IBM)	`nsone.net`
`dns2.p08.nsone.net`	NS1 (IBM)	`nsone.net`
`dns3.p08.nsone.net`	NS1 (IBM)	`nsone.net`
`dns4.p08.nsone.net`	NS1 (IBM)	`nsone.net`
`ns-1283.awsdns-32.org`	Amazon Route 53	`^ns-\d+\.awsdns-\d+\.(com\|net\|org\|co\.uk)$`
`ns-1707.awsdns-21.co.uk`	Amazon Route 53	`^ns-\d+\.awsdns-\d+\.(com\|net\|org\|co\.uk)$`
`ns-421.awsdns-52.com`	Amazon Route 53	`^ns-\d+\.awsdns-\d+\.(com\|net\|org\|co\.uk)$`
`ns-520.awsdns-01.net`	Amazon Route 53	`^ns-\d+\.awsdns-\d+\.(com\|net\|org\|co\.uk)$`

Email provider1

Email is handled by Microsoft 365 (Exchange Online).

Priority	Mail server	Provider
0	`github-com.mail.protection.outlook.com`	Microsoft 365 (Exchange Online)

Report abuse

Report spam, phishing or attacks to the network that serves the site. When a CDN is in front, report to the CDN: it can pass the report on to its customer.

Provider: GitHub Pages
Network: US-GITHUB-20170413, 185.199.108.0/22
Abuse mailbox: [email protected]
For address: 185.199.111.153

Network owners and countries: IP geolocation by DB-IP · CC BY 4.0

Structured result (JSON) · 7.7 KB

{
  "host": "pages.github.com",
  "domain": "github.com",
  "dns": {
    "status": "ok",
    "cnames": [
      "github.github.io"
    ],
    "minTtl": 912
  },
  "verdict": {
    "kind": "platform",
    "summary": "The site runs on GitHub Pages, a hosting platform, with Fastly in front of it.",
    "provider": {
      "id": "github-pages",
      "name": "GitHub Pages",
      "kind": "platform"
    },
    "originHidden": false,
    "confidence": "high",
    "others": [
      "Fastly"
    ]
  },
  "web": [
    {
      "ip": "185.199.111.153",
      "version": 4,
      "asn": {
        "number": 54113,
        "organization": "Fastly, Inc.",
        "range": "185.199.108.0/22"
      },
      "country": {
        "code": "US",
        "name": "United States"
      },
      "provider": {
        "id": "github-pages",
        "name": "GitHub Pages",
        "kind": "platform"
      },
      "evidence": [
        "In GitHub Pages's published address ranges (185.199.108.0/22)",
        "Network AS54113, Fastly, Inc."
      ]
    },
    {
      "ip": "185.199.108.153",
      "version": 4,
      "asn": {
        "number": 54113,
        "organization": "Fastly, Inc.",
        "range": "185.199.108.0/22"
      },
      "country": {
        "code": "US",
        "name": "United States"
      },
      "provider": {
        "id": "github-pages",
        "name": "GitHub Pages",
        "kind": "platform"
      },
      "evidence": [
        "In GitHub Pages's published address ranges (185.199.108.0/22)",
        "Network AS54113, Fastly, Inc."
      ]
    },
    {
      "ip": "185.199.109.153",
      "version": 4,
      "asn": {
        "number": 54113,
        "organization": "Fastly, Inc.",
        "range": "185.199.108.0/22"
      },
      "country": {
        "code": "US",
        "name": "United States"
      },
      "provider": {
        "id": "github-pages",
        "name": "GitHub Pages",
        "kind": "platform"
      },
      "evidence": [
        "In GitHub Pages's published address ranges (185.199.108.0/22)",
        "Network AS54113, Fastly, Inc."
      ]
    },
    {
      "ip": "185.199.110.153",
      "version": 4,
      "asn": {
        "number": 54113,
        "organization": "Fastly, Inc.",
        "range": "185.199.108.0/22"
      },
      "country": {
        "code": "US",
        "name": "United States"
      },
      "provider": {
        "id": "github-pages",
        "name": "GitHub Pages",
        "kind": "platform"
      },
      "evidence": [
        "In GitHub Pages's published address ranges (185.199.108.0/22)",
        "Network AS54113, Fastly, Inc."
      ]
    },
    {
      "ip": "2606:50c0:8002::153",
      "version": 6,
      "asn": {
        "number": 54113,
        "organization": "Fastly, Inc.",
        "range": "2606:50c0:8000::/46"
      },
      "country": {
        "code": "US",
        "name": "United States"
      },
      "provider": {
        "id": "github-pages",
        "name": "GitHub Pages",
        "kind": "platform"
      },
      "evidence": [
        "In GitHub Pages's published address ranges (2606:50c0:8000::/46)",
        "Network AS54113, Fastly, Inc."
      ]
    },
    {
      "ip": "2606:50c0:8003::153",
      "version": 6,
      "asn": {
        "number": 54113,
        "organization": "Fastly, Inc.",
        "range": "2606:50c0:8000::/46"
      },
      "country": {
        "code": "US",
        "name": "United States"
      },
      "provider": {
        "id": "github-pages",
        "name": "GitHub Pages",
        "kind": "platform"
      },
      "evidence": [
        "In GitHub Pages's published address ranges (2606:50c0:8000::/46)",
        "Network AS54113, Fastly, Inc."
      ]
    }
  ],
  "providers": [
    {
      "id": "github-pages",
      "name": "GitHub Pages",
      "kind": "platform",
      "evidence": [
        "185.199.111.153 is in GitHub Pages's published address ranges (185.199.108.0/22)",
        "185.199.108.153 is in GitHub Pages's published address ranges (185.199.108.0/22)",
        "185.199.109.153 is in GitHub Pages's published address ranges (185.199.108.0/22)",
        "185.199.110.153 is in GitHub Pages's published address ranges (185.199.108.0/22)",
        "2606:50c0:8002::153 is in GitHub Pages's published address ranges (2606:50c0:8000::/46)"
      ]
    },
    {
      "id": "fastly",
      "name": "Fastly",
      "kind": "cdn",
      "evidence": [
        "AS54113 (Fastly, Inc.) serves 6 of 6 addresses"
      ]
    }
  ],
  "headers": {
    "status": "not_needed"
  },
  "dnsHosting": {
    "status": "found",
    "nameservers": [
      {
        "name": "dns1.p08.nsone.net",
        "provider": {
          "id": "ns1",
          "name": "NS1 (IBM)",
          "kind": "dns"
        },
        "pattern": "nsone.net"
      },
      {
        "name": "dns2.p08.nsone.net",
        "provider": {
          "id": "ns1",
          "name": "NS1 (IBM)",
          "kind": "dns"
        },
        "pattern": "nsone.net"
      },
      {
        "name": "dns3.p08.nsone.net",
        "provider": {
          "id": "ns1",
          "name": "NS1 (IBM)",
          "kind": "dns"
        },
        "pattern": "nsone.net"
      },
      {
        "name": "dns4.p08.nsone.net",
        "provider": {
          "id": "ns1",
          "name": "NS1 (IBM)",
          "kind": "dns"
        },
        "pattern": "nsone.net"
      },
      {
        "name": "ns-1283.awsdns-32.org",
        "provider": {
          "id": "route53",
          "name": "Amazon Route 53",
          "kind": "dns"
        },
        "pattern": "^ns-\\d+\\.awsdns-\\d+\\.(com|net|org|co\\.uk)$"
      },
      {
        "name": "ns-1707.awsdns-21.co.uk",
        "provider": {
          "id": "route53",
          "name": "Amazon Route 53",
          "kind": "dns"
        },
        "pattern": "^ns-\\d+\\.awsdns-\\d+\\.(com|net|org|co\\.uk)$"
      },
      {
        "name": "ns-421.awsdns-52.com",
        "provider": {
          "id": "route53",
          "name": "Amazon Route 53",
          "kind": "dns"
        },
        "pattern": "^ns-\\d+\\.awsdns-\\d+\\.(com|net|org|co\\.uk)$"
      },
      {
        "name": "ns-520.awsdns-01.net",
        "provider": {
          "id": "route53",
          "name": "Amazon Route 53",
          "kind": "dns"
        },
        "pattern": "^ns-\\d+\\.awsdns-\\d+\\.(com|net|org|co\\.uk)$"
      }
    ],
    "providers": [
      {
        "id": "ns1",
        "name": "NS1 (IBM)",
        "kind": "dns"
      },
      {
        "id": "route53",
        "name": "Amazon Route 53",
        "kind": "dns"
      }
    ],
    "summary": "DNS is split between NS1 (IBM) and Amazon Route 53, which is how a domain stays up if one provider fails."
  },
  "email": {
    "status": "found",
    "mx": [
      {
        "preference": 0,
        "exchange": "github-com.mail.protection.outlook.com",
        "provider": {
          "id": "microsoft-365",
          "name": "Microsoft 365 (Exchange Online)",
          "kind": "mail"
        },
        "pattern": "mail.protection.outlook.com"
      }
    ],
    "providers": [
      {
        "id": "microsoft-365",
        "name": "Microsoft 365 (Exchange Online)",
        "kind": "mail"
      }
    ],
    "summary": "Email is handled by Microsoft 365 (Exchange Online)."
  },
  "abuse": {
    "ip": "185.199.111.153",
    "network": "US-GITHUB-20170413, 185.199.108.0/22",
    "email": "[email protected]",
    "provider": "GitHub Pages"
  },
  "notes": [
    "The name has 8 addresses; the first 6 were examined."
  ],
  "data": {
    "city": {
      "builtAt": "2026-11-01T02:52:26.000Z",
      "release": "2026-11"
    },
    "asn": {
      "builtAt": "2026-11-01T02:52:43.000Z",
      "release": "2026-11"
    }
  },
  "attribution": {
    "text": "IP geolocation by DB-IP",
    "url": "https://db-ip.com",
    "license": "CC BY 4.0",
    "licenseUrl": "https://creativecommons.org/licenses/by/4.0/"
  }
}

What this checker finds

A website is rarely one thing. The pages might be served by a hosting company, the traffic might pass through a CDN first, the domain's DNS might live with a third company, and email might be handled by a fourth. This page looks at all of them and says which provider is behind each part, instead of making you piece it together from separate tools.

The web side. Every address the site points to, the network that owns it, and whether it belongs to a CDN, a hosting platform, a hosting company or a cloud.
The DNS provider. Read from the nameservers of the domain.
The email provider. Read from the MX records.
The abuse contact. The address to report spam, phishing or attacks to, for the network that serves the site.

How to use it

Enter a domain or a web addressA bare domain such as example.com works, and so does a full address with a path. Only the host name is used. IP addresses are not accepted here: the IP lookup answers for those.
Read the verdictThe headline names the provider and says what kind it is: a CDN, a platform, a host or a cloud. A confidence label says how many independent clues agree.
Check the evidenceOpen the evidence tab to see what each finding rests on, such as a CNAME to a provider's domain, an AS number, a published address range or a response header.

When the origin is hidden behind a CDN

A CDN or reverse proxy such as Cloudflare, Fastly or Akamai answers for the site. Visitors connect to the CDN, and the CDN fetches pages from the real server, the origin. That is why the address you see belongs to the CDN, and why no honest tool can tell you who runs the origin from outside. When we see a CDN, we say "behind Cloudflare" and that the origin is hidden.

We do not try to unmask it. Digging out an origin behind a CDN is a way to attack the site by going around its protection, so this page leaves it alone. If you own the site, your hosting account tells you where the origin is. If you need to report a problem with a site behind a CDN, report it to the CDN's abuse team, which can pass it on.

How the answer is worked out

Clue	What it shows
CNAME chain	A name such as `example.cloudfront.net` or `example.netlify.app` points straight at a CDN or platform.
Published address ranges	Some CDNs publish the ranges they use. An address inside them is theirs.
Network owner (AS number)	The organisation that announces the address. Well-known hosts and clouds are recognised.
Response headers	Headers such as `cf-ray`, `x-amz-cf-id` or `x-vercel-id` give away a CDN or platform. They are read only when the clues above did not already settle it, with one request to the site.
Nameservers and MX hosts	The names of the DNS and mail servers point to those providers.

Network owners and countries come from the free DB-IP Lite databases, credited as "IP geolocation by DB-IP". The provider patterns are a short list kept by hand, so a small host may show as an unrecognised network. In that case its organisation name is still shown, and it is usually the hosting company.

Questions people ask

How can I tell who hosts a website?

Look up the website's IP address and see which network owns it, then check whether the site sits behind a CDN. This page does both: it follows the DNS records, names the owner of each address and reads the DNS and mail providers. When a CDN is in front, the real host is not visible, and the page says so.

Why does it say Cloudflare when my host is somebody else?

Because Cloudflare is in front of your host. Visitors reach Cloudflare's servers, and Cloudflare forwards requests to your real server. Both the address and the headers belong to Cloudflare, so the real host cannot be seen from outside. Your hosting account or the site owner knows who it is.

Can I find the real server behind a CDN?

Not here. We deliberately do not try, because finding an origin that a CDN protects is a first step in attacking it. Site owners can always see their own origin in their hosting dashboard. If you need to reach whoever runs the site, use the abuse contact or the domain's registration data from WHOIS.

Is the host the same as the domain registrar?

No. The registrar sells the domain name and keeps it registered. The host runs the server that delivers the pages. They can be the same company, but often are not. A domain registered at one company can point to a site hosted at another and use DNS from a third.

Who do I report phishing or abuse to?

Report it to the abuse contact of the network that serves the site. The page lists the registry's abuse mailbox for that network, and the provider's own report page when it has one. If a CDN is in front of the site, report to the CDN, which can pass the report on to its customer.

How accurate is the result?

When a CNAME, a published address range or a header names a provider, it is very reliable. When the answer rests on the network owner alone, it points to the hosting company or its reseller. The confidence label shows which case you have, and the evidence tab lists every clue so you can check it yourself.

Does the checker contact the website?

Sometimes, once. If DNS and network data already identify a CDN, platform or host, nothing is sent to the site. Otherwise one HEAD request over https asks for response headers, which never include the page. You can switch the request off in More options. For a full look at the headers, use the HTTP headers checker.

Use it from AI, the API or the command line

Every LookupOwl tool is also a free API and an MCP tool, with no key and no account. This one is website_hosting. Please be kind to the rate limits.

curl

curl "https://lookupowl.com/api/v1/tools/website-hosting?q=www.cloudflare.com"

MCP

claude mcp add --transport http lookupowl https://lookupowl.com/mcp

Description for AI agents · OpenAPI · llms.txt

GitHub Pages

What this checker finds

How to use it

When the origin is hidden behind a CDN

How the answer is worked out

Questions people ask

Use it from AI, the API or the command line

You might also need

IP lookup

Domain report

DNS lookup

IP WHOIS

ASN lookup

HTTP headers & redirects

WHOIS lookup