I'm trying to figure out how a program communicates with its website. I've edited my hosts file so that their website points to my computer and set up a script that logs every time it's accessed.
But the program is still able to function at times and I'm thinking it's because it's going to another website I don't know about or a subdomain of their main website.
How would I find exactly what page on the Internet a program tries to access?
Use a net sniffer like Wireshark Capture some traffic, Find the HTTP requests (or TCP three-way handshakes) then use "Follow TCP Stream" to see what exactly is happening on each connection.
For just a quick look without going into a packet capture, I always keep a SysInternals program called TCPView in my bin dir. Fire that up for a look at where it is trying to go. Obviously for a more in-depth look at it's request, wireshark/windump is the answer.
One of the peculiarities of MSWindows is that winsock.dll allows sockets to be reconciled against individual programs quite easily - most MSWindows firewalls (Kerio, ZoneAlarm etc) allow you to specify which programs are allowed to connect to which servers / ports. Its been some time since I played with these tools but IIRC Kerio certainly allows limited logging - all you'll see is the server/port it has connected to though but this approach would complement use a wiretap (e.g. wireshark) to capture details of the conversation.
If you specifically want to monitor access to a website, I recommend HTTPWatch (http://www.httpwatch.com/) or fiddler ( http://www.fiddler2.com/fiddler2/ ). Otherwise , try wireshark or TCPView.
