[grape_]

That's correct, but it's very difficult to determine the hosting environment if you're using a CDN. I have a write up on my blog at https://www.gra.pe/?p=36. But the idea is that if you know the hosting IP, you now where the IP sits (ASN). If you determine the ASN, you know which provider is being used.

[grape_]

To add to this - what they probably did was run an nslookup or dig against the domains themselves. And whatever IP resolved for those domains, they checked who owned that IP space. With a CDN, it won't show AWS, it'll show the CDN.