Registry vs registrar vs ISP vs hosting.

"GoDaddy is my hosting." "My ISP is Bluehost." "The registrar took the website down." Every one of those sentences mixes up two different things, and the confusion is not harmless — it is the reason abuse reports land in the wrong inbox, stolen domains take weeks to recover, and people pay a takedown request no one can act on. Four separate organisations usually stand behind a single website, each controlling a different layer, each reachable at a different door. This article draws the four lines clearly: registry, registrar, ISP, and hosting — what each one actually controls, how to find them for any domain, and who to complain to when something goes wrong.

The four layers, in one breath

Before the details, hold this analogy in your head. A domain name is like a phone number, and:

• The registry is the phone company that owns the whole numbering plan — every number under one area code, and the master directory that says which numbers exist.
• The registrar is the shop where you bought your number and where you go to change your details or move it elsewhere.
• The ISP is the line into your house that lets you make calls at all.
• The hosting is the building the call actually reaches — where the thing you are trying to talk to physically lives.

Different companies, different jobs. You can buy your number from one shop, run your line through another, and have it ring a building owned by a third. That is exactly how the web works, and untangling it is a core OSINT skill covered across our suspicious-domain guides.

Registry: who operates the TLD

A registry is the organisation that operates a top-level domain (TLD) — the .com, .org, or .es at the end — and maintains the single authoritative database of every domain registered under it. The registry runs the TLD's own DNS servers and holds the delegation for each domain: the record that says "to find example.com, go ask these nameservers." There is exactly one registry per TLD, and no domain under that TLD exists unless the registry's database says it does.

Above the registries sits ICANN, the non-profit that coordinates the global naming system and sets policy for generic TLDs. Its IANA function maintains the root zone — the master list that tells the world which organisation runs each TLD. If you ever want to know who really operates a TLD, the IANA root database is the authoritative source. A few real examples:

Note the common trap: Red.es operates .es, the Spanish public body that runs the registry. A company like Nominalia is not the registry — it is a registrar, one of the shops that sells .es names on Red.es's behalf. Country-code TLDs (.es, .uk, .de) follow national rules rather than ICANN's, but the structure is the same: one operator, one authoritative database.

Registrar: where you buy and manage the domain

A registrar is the company you actually buy a domain from and manage it through. It is accredited by the registry (and, for gTLDs, by ICANN) to sell names and to push changes into the registry's database using a protocol called EPP. When you register my-shop.com, the registrar takes your order and writes the entry into Verisign's .com registry. You never talk to Verisign; you talk to your registrar. Familiar names:

• GoDaddy and Namecheap — mass-market registrars.
• Cloudflare Registrar — sells names at wholesale cost, no markup.
• OVH — a registrar that is also a large hosting company (a bundling that fuels the confusion below).

Here is the critical point: the registrar controls your registration, not your content. Through the registrar you set the registrant contact details (what shows in WHOIS), you choose which nameservers the domain delegates to, you renew or transfer the name, and you set the locks that stop it being stolen. The registrar can also suspend a domain — placing it on clientHold so it resolves nowhere — which is exactly the lever used against phishing and malware domains. What the registrar cannot do is edit the pages on your website. Those live somewhere else entirely.

ISP: who gives you connectivity

Your Internet Service Provider is the company that connects you to the internet — the fibre or cable into your home or office. Movistar (Telefónica) in Spain, Vodafone across Europe, Comcast in the US: these are ISPs. An ISP controls the things between your device and the rest of the network:

• Your access link and the public IP address you browse from.
• By default, the DNS resolver your devices ask — unless you switch to a public one like 1.1.1.1 or 8.8.8.8.
• Sometimes network-level blocks — several countries force ISPs to DNS-block court-listed piracy or fraud sites.

An ISP does not host websites for the public and is almost never the same thing as a hosting company. When someone says "my ISP is Bluehost," they mean their host is Bluehost — Bluehost sells hosting, not home internet connections. The ISP matters in an investigation only in two cases: it is the network a residential attacker's traffic comes from, and it is the resolver that can be lied to (the DNS-spoofing risk we trace in How networks work).

Hosting: where the site actually lives

The hosting provider is where the website's files and server physically live — the machine that answers when a browser connects to the site's IP address and asks for a page. This is the layer that serves content. Examples span the whole market:

• AWS, Hetzner, and DigitalOcean — cloud and dedicated-server providers where you rent capacity.
• Shared-hosting companies (many of which also sell you a domain in the same checkout).
• An organisation's own data centre — Wikipedia, for instance, hosts itself.

Hosting vs registrar — the confusion that costs you

These two get merged constantly because one company often sells both in the same basket. GoDaddy will happily register your domain and host your site. But they remain two separate services with two separate control panels and two separate abuse teams. The clean way to keep them apart:

The registrar controls the name. The host controls the machine the name points to. You can move your hosting to a new company tomorrow and keep the same registrar, or move your domain to a new registrar and never touch the server. They are independent.

This independence is why "the registrar took the website down" is usually wrong. A registrar suspends the name, so the address stops resolving; the host removes the content, so the files are gone. Different action, different company, different report.

How DNS ties them together

DNS is the connective tissue between all four layers, and following the chain is the whole game. When a browser looks up my-shop.com:

1. Your device asks your ISP's resolver (or a public one).
2. The resolver asks the registry for .com, which returns the nameservers you set at your registrar.
3. Those nameservers — run by your registrar, by Cloudflare, or by your host — return the A/AAAA record: the IP address of the hosting server.
4. The browser connects to that IP, and the host serves the page.

Read that backwards and you have your investigative map. The nameservers tell you who runs DNS; the IP tells you who hosts; the WHOIS record tells you the registrar; the TLD tells you the registry. Four questions, four answers.

The master table: who controls what

How to find each one for any domain

Four artefacts, four lookups. None of them touch the target's server aggressively, so this is safe, passive OSINT.

1. Registrar and registry — WHOIS / RDAP

WHOIS (and its modern JSON successor, RDAP) returns the sponsoring registrar and creation date. Use the official ICANN Lookup in a browser, or rdap.org from the command line, which redirects you to the right registry's RDAP server automatically:

$ curl -s https://rdap.org/domain/wikipedia.org | jq '.entities[].roles, .events'
["registrar"]              # sponsoring registrar (e.g. MarkMonitor Inc.)
registration 2001-01-13

The TLD itself (.org) tells you the registry — Public Interest Registry — with no lookup needed. We break down every field in What is WHOIS and how to read it.

2. DNS — nameservers

dig NS shows who answers DNS for the domain, which is often your first clue about the registrar or DNS host:

$ dig +short NS wikipedia.org
ns0.wikimedia.org
ns1.wikimedia.org
ns2.wikimedia.org

Wikimedia runs its own nameservers. A scam domain will more often show *.cloudflare.com, a bulk registrar's nameservers, or a throwaway DNS host — a signal in itself.

3. Hosting and ISP — the IP, then the ASN

Resolve the domain to an IP, then find who owns that IP. Every network on the internet has an Autonomous System Number (ASN) — a unique ID for the operator that announces the address block. Look it up with ipinfo.io or a WHOIS of the IP, and confirm the network on Hurricane Electric's BGP toolkit:

$ dig +short A wikipedia.org
208.80.154.224             # exact address varies by region
$ curl -s https://ipinfo.io/208.80.154.224 | jq '.org'
"AS14907 Wikimedia Foundation, Inc."

That single line answers "who hosts this?" The ASN is the network operator: an IP in AS16509 means Amazon (AWS), AS24940 means Hetzner, AS14061 means DigitalOcean, AS13335 means Cloudflare. A residential IP instead maps to an ISP's network — AS7922 is Comcast, AS3352 is Telefónica (Movistar) — which tells you the address belongs to a home connection, not a hosting provider. ViewDNS bundles many of these lookups (reverse IP, DNS records, WHOIS) into one web page if you prefer clicking to typing.

A worked example, end to end

Take wikipedia.org and walk the four layers in order:

1) TLD is .org        -> Registry:  Public Interest Registry (PIR)
2) rdap.org           -> Registrar: MarkMonitor Inc.
3) dig NS             -> DNS:       ns0/ns1/ns2.wikimedia.org (self-run)
4) dig A -> ipinfo.io -> Hosting:   AS14907 Wikimedia Foundation (self-hosted)

Reading it: PIR operates the .org registry; MarkMonitor is the registrar Wikimedia buys the name through; Wikimedia runs its own DNS and its own servers, so hosting and DNS are the same organisation here — there is no third-party host. And crucially, your ISP (say Comcast or Movistar) appears nowhere in this chain — it is only the network carrying your request to reach Wikipedia, not part of Wikipedia's stack at all.

Now contrast a scam site. The same four steps might yield: registry Verisign (.com), registrar a bulk reseller with the name registered three days ago, nameservers on a free DNS host, and an A record landing in AS16509 (Amazon) or a bulletproof host. Suddenly you know exactly which three doors to knock on — and, from the table above, which one can actually pull the content. That is the full method in How to investigate a suspicious domain.

Who to report to — routing an abuse complaint

Match the problem to the layer that can fix it, or your report dies in the wrong queue:

• Your domain was stolen or hijacked (unauthorised transfer, registrant changed) — go to your registrar first; they can lock and reverse it. If the registrar is unresponsive, escalate to the registry and to ICANN's transfer-dispute process.
• An abusive website (phishing, malware, a scam store) — report to the hosting provider's abuse team, because they can remove the content or the server. In parallel, report to the registrar, which can suspend the domain for DNS abuse. Our guide on reporting a scam website walks through both.
• Network abuse (attacks, scanning, or spam coming from an IP) — find the IP's ASN and report to that network's abuse contact. If it is a residential address, that is the ISP.
• Copyright — send a DMCA notice to the host, which controls the files.

To find the right address, RDAP records list an abuse contact for both domains and IP blocks, and abuse.net maps a domain to its registered abuse mailbox (whois -h whois.abuse.net example.com). Send evidence — URLs, timestamps, screenshots — to the layer that owns the lever, and your report gets acted on instead of ignored.

The one-line summary

Registry runs the TLD; registrar sells you the name; ISP connects you to the internet; host runs the machine the name points to. Four companies, four control panels, four abuse desks. Learn to read WHOIS, dig, and an ASN lookup, and you can place any website's four layers in about a minute — which is the difference between a takedown that works and an email no one can act on.

Frequently asked questions