Where a domain is hosted is evidence, and it is weaker evidence than it looks — because attackers use the same providers everyone else does, for the same reasons.
What hosting tells you
| Observation | Weight | Caveat |
|---|---|---|
| Hosted at a provider with no abuse process | Moderate | It also tells you takedown will fail, which changes the response more than the assessment. |
| Behind a large CDN | None | Almost everything is. It also hides the origin, which is why attackers like it. |
| On the same address as other lookalikes | Moderate to strong | Worthless if the address is shared hosting with thousands of sites. |
| Free hosting or a platform subdomain | Weak | Common for both legitimate small sites and throwaway campaigns. |
| Hosting jurisdiction | Weak | A proxy for how hard takedown will be, not for intent. |
| Infrastructure that changes daily | Strong | Fast-flux behaviour is deliberate evasion and has few innocent explanations. |
Where the evidence stops
- A CDN tells you nothing about the operator. Any one can sign up. The address you resolve belongs to the CDN, not to them.
- Shared hosting poisons IP clustering. Tens of thousands of unrelated sites behind one address makes co-location meaningless.
- Jurisdiction is not intent. Plenty of legitimate businesses host in places with slow abuse processes, and plenty of attackers host in places with fast ones.
What it is actually for
Hosting information is more useful for planning the response than for making the assessment. It tells you who to contact, whether they will act, and how long it is likely to take — which is worth knowing before you spend an afternoon assembling a report for a provider who will not read it.
dig +short A suspicious.example whois -h whois.cymru.com " -v <IP>" # ASN and operator -> who hosts it -> is there a published abuse contact -> have they acted on previous reports That answers "where do I send this", which is the question the next module is about.
Do not let hosting downgrade a finding
A lookalike with an MX record hosted at a reputable provider is not less dangerous for being well hosted — it is easier to take down. Hosting should change your expectation of the response, never your assessment of the threat.