Pivot map
Pivot from here
Outputs from Whois hosting this can become inputs for the next tool. These are the most relevant follow-on pivots in the library.
A global, open, stable, and secure Internet that serves the entire Asia Pacific community
ARIN is a nonprofit, member-based organization that administers IP addresses & ASNs in support of the operation and growth of the Internet.
AbuseIPDB provides IP reputation data and community abuse reports for identifying malicious hosts in network and threat investigations.
AccountKiller provides direct deletion links and step-by-step instructions for removing accounts on hundreds of websites and social platforms.
Investigator Use
Whois Hosting This is a free online tool that identifies the hosting provider, data center, and name server configuration for any domain or IP address. By combining WHOIS lookups with IP geolocation and hosting provider attribution data, it answers the most basic question in infrastructure investigation: where is this site actually hosted?
What investigators use Whois Hosting This for: quickly identifying which hosting company or cloud provider is responsible for a domain, discovering the data center location associated with an IP, finding name server providers to understand DNS management relationships, and gathering basic infrastructure context for any web property under investigation.
What it exposes: the hosting company name and organization, IP address and geolocation, reverse DNS hostname for the IP, name server provider and configuration, and sometimes ASN and network block information. Results are presented without requiring an account or login.
In fraud and phishing investigations, quickly identifying the hosting provider is a prerequisite for any abuse reporting or takedown action. When a phishing site or fraudulent web property is discovered, Whois Hosting This identifies who to report it to, what abuse contact to use, and whether the host has a reputation for acting on abuse complaints.
Hosting provider intelligence: repeat investigations against multiple suspicious domains may reveal a pattern where a threat actor consistently uses the same hosting provider. Budget hosting and bulletproof hosting providers appear repeatedly in criminal infrastructure. Identifying these patterns helps predict where future infrastructure from the same actor will appear.
Limitations: Whois Hosting This reports the hosting organization that owns the IP space — which may be a cloud provider like AWS or Azure rather than the actual website host. Sites using Cloudflare or other CDNs show Cloudflare's infrastructure rather than the origin server. For origin IP discovery, use historical DNS data from SecurityTrails or DNS History.
In a workflow: use Whois Hosting This as a quick identification step after encountering a suspicious domain. Once the hosting provider is identified, pivot to Shodan to discover what other sites are hosted on the same IP, and check SecurityTrails for historical hosting changes that may reveal the real infrastructure behind CDN protection.
Before You Pivot
Capture the target, search terms, and why this source is relevant before you leave the page.
Archive volatile pages, save screenshots, and keep timestamps for anything that may change.
Treat one tool as a lead source. Confirm important findings with independent sources.
Related tools
ARIN is a nonprofit, member-based organization that administers IP addresses & ASNs in support of the operation and growth of the Internet.
Free online network tools, including traceroute, nslookup, dig, whois, ping, and our own Domain Dossier and Email Dossier. Works with IPv6.
An open source intelligence tool to crawl the graph of certificate Alternate Names
Finds certificates and subdomains using Certificate Transparency data. An alternative to crt.sh that presents the information a bit differently.
DNS History archives historical DNS records, letting investigators track IP changes, hosting migrations, and infrastructure pivots over time.
DNS Twister generates and monitors domain permutations for typosquatting detection, brand protection, and phishing infrastructure discovery.