Hosting fingerprints — signatures & sources

How dedenne identifies a backend. Each entry: the signal it keys on and where that signal is observable. Add new providers here first, then mirror the check in scripts/dedenne.mjs.

Web host

Host	Signal	Where
WP Engine (GES)	IP in `141.193.213.10/.11/.20/.21`	A record. WPE’s “Global Edge Security” is Cloudflare-fronted, so ASN/Server read “Cloudflare” — the IP is the tell.
WP Engine (classic)	`wpengine` in CNAME / cookies / `X-Powered-By`	CNAME to `.wpengine.com` / `.wpenginepowered.com`; response cookies
WP Engine (Flywheel)	32-char hex `Host-Header` response header	Flywheel = a WP Engine company hosted on GCP; without this it misreads as “Google Cloud”
Wix	`Server: Pepyaka`; `wixstatic.com` / `parastorage.com` preconnects	Response header + body
Squarespace	`squarespace` in headers/body; `static1.squarespace.com`
Shopify	`shopify` header; `cdn.shopify.com`
Hostinger	`Server: hcdn`; ASN `AS-HOSTINGER`; NS `*.dns-parking.com`
Kinsta / Pantheon	`kinsta` / `pantheon` in headers or ASN org
Raw cloud (AWS/GCP/DO)	IP→ASN org string	Team Cymru DNS. A bare cloud usually means self-managed or an agency other than us.
Cloudflare (origin hidden)	`cf-ray` / `Server: cloudflare`, IP not a WPE GES edge	Client’s own Cloudflare account proxying an unseeable origin → REVIEW, never FAIL

CDN / edge

WPE Global Edge (Cloudflare) (GES IPs) · Cloudflare (cf-ray) · Fastly (x-served-by) · Akamai (x-akamai-transformed).

Email (MX)

protection.outlook.com → Microsoft 365 · aspmx.l.google.com → Google Workspace · zoho → Zoho · ppe-hosted / pphosted / barracuda → Proofpoint/Barracuda · mimecast → Mimecast · hostinger → Hostinger. Email provider often diverges from web host — a useful independent signal.

CMS / platform

WordPress (wp-json rel link, wp-content, x-redirect-by: WordPress) · Wix · Squarespace · Shopify · Webflow · HubSpot (hs-sites) · Drupal · Joomla.

Registrar + dates (RDAP)

RDAP base is TLD-aware to stay reliable under batch load:

.com / .net → https://rdap.verisign.com/<tld>/v1/domain/<domain>
.org → https://rdap.publicinterestregistry.org/rdap/domain/<domain>
everything else → https://rdap.org/domain/<domain> (follows the bootstrap redirect)

One retry on empty/failure. Fields: registrar (entities[roles=registrar].vcard fn), registration date, last changed (recent = likely transfer), expiry.

Sources

WP Engine Global Edge Security edge IPs — WP Engine support docs (GES DNS setup).
Flywheel Host-Header hash — observed on every Flywheel-hosted response; stable per-site.
Team Cymru IP→ASN over DNS — origin.asn.cymru.com / asn.cymru.com TXT (no key, no rate account).
RDAP — IANA RDAP bootstrap; registry endpoints above.

Maintenance: WP Engine occasionally adds GES ranges — keep WPE_GES_IPS current, and re-verify the Flywheel header assumption if false positives/negatives appear.