CNAMEs not handled correctly for some hosting providers (e.g. WIX)

Hi, can anyone explain why the same website gives different results?

analysing > [ http:// KSAQETARSPEED.COM ] givs me Hosting Provider>Wix

analysing > [ http:// ] givs me Hosting Provider>Google Cloud

Registry Domain ID: 2775463773_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois[.]wix[.]com


WIX is the domain registrar.

Google Cloud Platform is the hosting company.

In this case, It looks like Wix is basically just reselling GCP’s servers.

Nevermind, I was incorrect. :frowning:

Hi @omar8000 thanks for reporting!

This definitely looks to be a problem with Phish Report’s abuse contact matching.

It’s true that ksaqetarspeed[.]com and www[.]ksaqetarspeed[.]com resolve to different IP addresses but these both should be showing up as hosted by Wix.

I’ve logged a bug ticket to improve the matching logic to handle this situation.