How to identify the hosting provider of a bare redirect site
A bare redirect site displays little beyond a link such as “Click here to proceed.” The domain may hide an affiliate tracker, traffic gate, location-based redirect, or warning for a harmful destination. With no logo, address or product name, the host cannot be identified from appearance alone.
That emptiness is intentional in many redirect systems. One company may own the domain, another may serve the page through a CDN or redirect platform, and a third may operate the final destination. Shared hosting can place hundreds of unrelated sites on the same IP address.
The useful question is therefore not merely who owns the domain, but which network serves the page containing the link. DNS records, HTTP response headers and IP registration data provide the strongest clues. The registrar’s name alone may lead in the wrong direction.
Start with evidence, keep timestamps and avoid following an unknown destination until its URL and safety are clear. Record the exact address before opening it because redirects can change according to device, location, referrer or time of day.
Start with the page and follow its redirect chain
Open the browser’s developer tools, select the Network panel and reload the page. Look for a 301, 302, 307 or 308 response, then inspect its Location header. A meta refresh or JavaScript redirect may appear as ordinary page content rather than an HTTP redirect, so both the response headers and page source need checking.
Command-line tools can make the sequence easier to record. Run curl -sS -D - -o /dev/null --max-redirs 0 example.test, then repeat with -L and a redirect limit of ten. Replace the placeholder with the suspect domain and save the output. The headers should reveal whether the redirect comes from the server, an intermediary platform or client-side code.
The publisher’s site background can be read alongside these observations. Note every domain in the chain, but keep the hosting question focused on the page displaying the link. The destination operator may be entirely separate from the company that serves the redirect page.
Separate the registrar from the hosting network
Use dig to collect the domain’s A, AAAA, CNAME and nameserver records. A direct A or AAAA address points toward a web server or CDN edge. A CNAME ending in a branded redirect service identifies that service as an intermediary, although the underlying host may remain hidden. Nameservers identify the registrar, not necessarily the company storing the site.
Whois and RDAP records can add registration dates, registrar contacts and domain status. These results are clues rather than proof of control. A newly registered domain, privacy-protected contact or unusual nameserver can increase uncertainty, but none establishes that a particular company hosts the page.
For .com.au and .net.au domains, eligibility rules and registry information are maintained through auDA in Sydney. The available Whois fields vary by domain type and privacy settings, so investigators should compare the registry record with the live DNS response. Broader research context, including the project overview, can help when tracing redirect infrastructure across several domains.
Trace the IP address to its network operator
Resolve the active IP address, then check its RDAP record, autonomous system number and routing origin. These services identify the network announcing that address, which might be a major cloud platform, a local hosting company, an Australian data-centre operator or a consumer internet service provider. A cloud provider’s name does not reveal which customer account activated the redirect.
Reverse DNS can provide another clue. Run dig -x 203.0.113.10 with the address actually observed. The hostname may expose a CDN, known hostnames, or a residential network operated by Optus, Telstra or iiNet. A residential result often means the page is running from a home connection rather than a commercial data centre.
Traceroute paths may pass through an Australian internet exchange such as AIX in Brisbane or WAIX in Perth. That indicates local network infrastructure, not the physical location of the server. Geolocation databases likewise estimate proximity rather than proving a site’s location. A structured set of provider review criteria can help separate network ownership from site ownership before contacting either party.
Build a practical evidence checklist
Create one evidence folder before drawing a conclusion. Capture the exact URL, local and UTC timestamps, a screenshot, the HTML source and all response headers. Record whether the redirection occurred at the server or inside the browser.
- Exact domain, full path, query string and visible destination
- HTTP status code and every Location header received
- A, AAAA, CNAME and nameserver lookup results
- TLS certificate subject, alternative names and issuer
Then compare those observations across DNS, IP and registration records. A provider name should ideally appear in two independent places, such as an RDAP entry and matching certificate or nameserver data.
- Registrar’s legal entity name and current domain status
- Observed IP address, autonomous system and RDAP owner
- Reverse DNS, CDN or redirect-platform identifiers
- Certificate transparency and passive DNS history
Archive the page even when it contains almost nothing. The blank-page archiving guide provides a method for retaining a minimal page with its timestamp. If material includes a person’s name, contact details or payment information, apply the Privacy Act 1988 and Australian Privacy Principles: retain only what is needed and redact identifiers irrelevant to the hosting investigation.
Route the evidence and request action
Contact the hosting provider through its official abuse or security channel rather than an address harvested from the page. A registrar can update domain records or initiate a transfer, but it may have no control over the server. If the IP belongs to an Australian consumer ISP, an abuse request to that network may be the appropriate route.
For suspected phishing, malware or threats, preserve the evidence and report it to ReportCyber. Keep the submission factual and include the complete URL, timestamps, headers and screenshots without unnecessary personal information. Avoid labelling the operator as malicious before the technical evidence supports that conclusion.
Australian businesses may also receive hosting invoices in AUD with 10% GST. Ask for the provider’s legal entity name and ABN, then verify both against the invoice and public business records. Create the evidence folder now, identify the network and legal entity, and send one dated report to the organisation able to disable or correct the redirect. Retain the source files, provider response and case number in case the domain transfers or the page reappears.
