Published by DomainIQ Team on May 1, 2026
This case didn’t start with malware, phishing emails, or a breached server. It started with an invoice.
A vendor claimed to be providing “hosting services” on invoices sent to hundreds of small businesses. The invoice looked reasonable. The terminology sounded technical enough. And because hosting is often poorly understood by most people, the claim went largely unchallenged.
Until someone asked a simple question:
Is this company actually hosting our website?
What followed revealed a very common and dangerous pattern: a party presenting itself as a hosting provider to small businesses without providing any actual services.
In simple terms, this was payment fraud. But how do you prove it?
Hosting is one of those terms that gets stretched far beyond its actual meaning.
When people talk about hosting a site, they often blur the line between:
Invoices reinforce this confusion. Once “hosting” appears as a line item, it carries an implied authority that is difficult to question because most people don’t know where to look.
The key problem: Most businesses struggle to verify who is hosting their website unless the business owner is very hands-on, or technically savvy.
Stripped of buzzwords, hosting means: storing the files (text, pictures, everything else) that make up a website on a computer, and connecting those files to the Internet where people can find them.
A hosting company either owns or rents the computers where these files are stored, and provides services that ensure those files are connected to the Internet.
That activity leaves evidence. At minimum, it shows up in:
An IP address is a set of alphanumerical characters assigned to a device connected to a network. For example, your home internet router connects you to the Internet. That router has a unique IP address. The same is true for computers that store files that make up your website. When someone visits your website, their devices need the exact address where your website files are stored, or they will not be able to visit it.
If someone claims they are hosting your website, the IP address serving your domain should connect back to infrastructure they operate. At the very least, they should be able to tell you the IP address that hosts your website.
Luckily, with domainIQ, it’s very easy to find your website’s IP address:
https://domainiq.com/domain?example.com#/dns_history
For example, if you are hosting your website on GoDaddy and the invoice comes from CompanyXYZ, then likely they are trying to impersonate your hosting provider.
In order for internet users to find what they need online, the world has to rely on something call the Domain Name System. The DNS is a set of technologies and protocols that make sure that internet traffic is properly connected. Nameservers are a part of that complex ecosystem and are specialized servers that act like directories.
When someone types your website address into their browser, nameservers tell their device which IP address to go to.Think of nameservers like a building directory. They are not the office door you are looking for, but they tell you where to find it. Your hosting provider will have to either operate or control the nameservers for your website in order for people to connect to it.
A nameserver will generally hint at who operates the site that your domain is on, and if you do not know who your hosting provider is, this may serve as a useful data point.
With DomainIQ, you can:
If the nameservers do not align with the company claiming to host your website, that mismatch is a red flag.
When someone claims they are your hosting provider, three questions immediately matter:
Answering these questions highlights the evidence you should be seeing when someone claims they are hosting your website.
If you’re not sure who the hosting provider is for your domain then contact us with your domain name. We’ll use our tools to establish the likely hosting provider.