What happens to what you type into these tools
The short version. No accounts, no ads and no tracking cookies. What you type is used only to run the check you asked for. The tools have no database, so your lookups aren’t saved here. To see which tools people use, we count page views with Cloudflare Web Analytics, which sets no cookies and doesn’t follow individual visitors.
Some checks can only be answered by an outside service (a domain registry, a breach database, an antivirus scanner). Those services receive what you looked up. The tables below list exactly which ones. One needs real care: files and links sent to the Virus & URL scan are kept and shared by VirusTotal.
Nothing you enter leaves your computer.
These run on small Cloudflare Workers. The value you enter is sent to the Worker, which asks the source below and passes the answer back.
| Tool | What is sent | Who else receives it |
|---|---|---|
| IP lookup, My IP, Who is hosting? | The IP address or domain | An IP geolocation and network database |
| Reverse DNS, DiG, MX lookup, DNS health | The domain or IP | Public DNS resolvers (Cloudflare, Google) and the domain’s own name servers |
| DNS propagation check | The domain or host name and the record type. The optional “expected value” stays in your browser | Globalping, whose probes in 16 countries ask their local DNS resolvers (and Quad9 and OpenDNS); Cloudflare and Google public DNS; the domain’s own name servers |
| Blacklist check | The IP address | DNS blacklist operators (Spamhaus, SpamCop, Barracuda and others) |
| Whois lookup | The domain | The registry’s public RDAP server for that domain ending |
| Domain availability | The domain or name | The registries’ public RDAP servers and public DNS; for a few endings, WhoisXML API |
| Domain trust report | The domain | Public DNS, DNS blacklists, registry RDAP / WhoisJSON, certificate logs (crt.sh, Cert Spotter); the scan also connects to the domain’s own website and mail server |
| SSL certificate check | The domain | Nobody else for the main check — Cloudflare connects to the website and reads its certificate; public certificate-transparency logs (Cert Spotter) may also be queried |
| Ping, Quick and custom port scan | The host or IP (and ports) | Nobody else — Cloudflare connects to the target directly, so the target sees connections from Cloudflare |
| Traceroute | The host or IP | Globalping, whose probe network runs the trace |
| Speed test | Test traffic from your browser | Cloudflare’s speed-test servers |
| Tenant ID lookup | The domain or tenant ID | Microsoft’s public sign-in endpoints; reverse look-ups also use Microsoft Graph |
| MAC address lookup | The MAC address | maclookup.app |
| Email breach check | The email address | XposedOrNot; if it doesn’t answer, LeakCheck and Have I Been Pwned. The answer is cached by Cloudflare for up to 6 hours so repeat checks don’t hit those services’ limits |
| Password breach check | Only the first 5 characters of the password’s SHA-1 hash — never the password | Have I Been Pwned (Pwned Passwords) |
| Virus & URL scan | The whole file, or the link | VirusTotal (Google). VirusTotal keeps submitted files and links and shares them with security companies. Don’t submit confidential documents — for those, use Binary file info, which stays in your browser |
| Email header analyzer | The headers are read in your browser. Only the IP addresses and domains found in them are looked up | Public DNS (Team Cymru’s IP-to-network data), our blacklist check, registry RDAP for domain age. Pressing Explain sends a short summary of the findings — not the headers — to Cloudflare Workers AI |
| Domain trust report → Explain | A summary of the scan’s findings | Cloudflare Workers AI |
| Domain trust report → PDF | Nothing — the PDF is created in your browser | Nobody. The PDF library is loaded from the jsDelivr public script CDN the first time you use it |
| Service health, Latest exploits | Nothing — there is no input | We read public status pages and the Exploit-DB feed |
| Contact form | Your name, email and message | Delivered to the site owner by email through Resend |
The whole site and every tool run on Cloudflare. Like any web host, Cloudflare handles your IP address to deliver the page and may keep short-lived technical logs to stop attacks and abuse. Some tools are protected by Cloudflare Turnstile, a check that tells people from bots without image puzzles and without ad tracking.
We use Cloudflare Web Analytics to see how many times each page is viewed, where visitors come from (the referring site) and their rough country, browser and device type. It sets no cookies, keeps nothing in your browser and doesn’t build a profile of you. It doesn’t record the part of the address after the “?”, so the domains, IPs or email addresses you look up are not part of these statistics.
Two conveniences are kept in your own browser (localStorage) and never sent anywhere:
The site sets no cookies of its own; Cloudflare may set a short-lived security cookie (such as __cf_bm) that is used only to tell people from bots.
Use the contact form.
Last updated: 11 October 2026
mrpanos.com