OSINT workspace
Email headers record the route a message took. The analyzer reads them in your browser; an address check queries only the domain part, never the name before the @ sign.
The research file lives in this tab's session memory only.
Reads the route a message took (oldest hop first, with the delay at each hop), the authentication results, DKIM signatures, mismatches between From, Return-Path and Reply-To, and the addresses and domains found. Addresses and domains become links into the other workspaces.
Sent: nothing. The headers are read as text in your browser. They are not uploaded.
Checks the syntax of an email address, then looks at the domain only: mail servers (MX), SPF and DMARC. The part before the @ sign is never sent.
Sent: Only the domain part of the address (the text after the @ sign), as MX, A and TXT queries.
Goes to: cloudflare-dns.com, dns.google. The request goes from your browser straight to the source; ZEKASTRA servers do not see it. The source sees the query and your IP address.
Tests whether a password appears in known breach data without sending the password. Your browser computes the SHA-1 hash and sends only its first 5 characters; the comparison happens on this page.
Sent: The first 5 characters of the password's SHA-1 hash. The password itself is never sent, stored or logged, and the field is emptied right away.
Goes to: api.pwnedpasswords.com. The request goes from your browser straight to the source; ZEKASTRA servers do not see it. The source sees the query and your IP address.
Have I Been Pwned answers this when you open it and enter your own address there. ZEKASTRA does not send addresses there.