http://spyonweb.com/

  or

http://w3who.net/

They are not always 100% complete, but they are free and have good coverage.

For example, did you know that ycombinator.com also hosts workatastartup.org? http://spyonweb.com/ycombinator.com

You look up the DNS server: http://network-tools.com/default.asp?prog=dnsrec&host=di...

Then a whois record on the DNS: http://whois.domaintools.com/domaincontrol.com

Then a quick Google search shows results like "Note that anything ending in domaincontrol.com or secureserver.net is hosted by godaddy.com and/or wildwestdomains.com! If you have webmail, you can ..."

Another good method is to get the sites IP address (`nslookup` or `dig` are good tools for this. Hell, `ping` will do it for you too). Then head over to bing.com and search for ip:addr.

For example: http://www.bing.com/search?q=ip:174.132.225.106