OSINT workspace
An IP address identifies a network endpoint, not a person. These tools show who the address block is registered to, which network announces it and whether it is reserved, and they never turn an address into a place or a name.
The research file lives in this tab's session memory only.
Shows the address and a few connection details that the web server sees for your request. Behind a VPN or a mobile carrier gateway this is the service's address.
Sent: Nothing beyond the request itself: a plain request to /cdn-cgi/trace on this site.
Goes to: zekastra.com, forensic.zekastra.com. Cloudflare, which serves this site, answers with what it sees. The result is not stored by ZEKASTRA. It only works on the live site.
Checks whether an address is reserved, then reads its registration record, the network that announces it, its reverse DNS name and whether it is a known Tor relay. Choose the sources you want; each one is a separate request.
Sent: The IP address, to the sources you tick. A reserved address (for example 192.168.x.x) is not sent anywhere.
Goes to: rdap.org, cloudflare-dns.com, dns.google, onionoo.torproject.org. rdap.org forwards to the regional registry. The ASN lookup uses Team Cymru's DNS zone through the DNS over HTTPS resolvers above. Each source sees the address and your IP address.
Open the source yourself
Reads the registration record of an autonomous system and its name.
Sent: The AS number.
Goes to: rdap.org, cloudflare-dns.com, dns.google. The request goes from your browser straight to the source; ZEKASTRA servers do not see it. The source sees the query and your IP address.
Calculates network, mask, usable range and host count for IPv4 and IPv6 blocks, tests whether an address is inside a block and splits a block into smaller ones.
Sent: nothing. The calculation runs in your browser.