Ways to Identify Where Your Server is Hosted

If you can access the server remotely, running a Powershell script could be helpful! Just checking if you have the ability to do that. It's also worth mentioning that, back in the day, an old trick to identify servers was to eject the CD-ROM tray to see if it was an actual server with a drive. Seems silly now, but it worked!

For an internal server, you should try running an IP/port scan or checking the ARP tables. Investigate any unknown IPs manually. If it’s external, without a DNS name, you'll probably need to check invoices for all services to identify the provider. If you have a public IP, doing a reverse DNS lookup may show you the hosting provider.

First off, could you clarify if these servers are internal or external? If they’re internal, the simplest thing to do is look up the IP address. That’ll show you where any domain name is routed, if applicable. Just be cautious, sometimes what you think is a server might actually be a border router, so you'll need to trace the routing from there.

When dealing with internal servers, checking the IP or MAC address on your switches is key. If it's external, searching for IP WHOIS data can reveal who owns that IP range, which is usually the hosting company. That's a reliable way to find out who's hosting your server.

Have you tried using nmap or any network monitoring tools? They can help you generate a list of hosts and their MAC addresses. You could then check the MAC addresses against your switch tables to find out what port connects to them. If you have a toner probe, it can also help trace the cable without disconnecting it from the network.