Where our data comes from
Every upstream service that powers a diagnostic on this site — what it provides, and how fresh the data is.
CheckItNowTools does not maintain proprietary reputation feeds. We combine well-established public sources and present them with a consistent UI. If a result surprises you, this page should explain where the answer came from. For how we interpret these inputs, see our methodology.
IP intelligence
Public IP geolocation, ASN, and ISP attribution are derived from open IP databases queried over HTTPS at request time.
| Source | Used for | Update cadence |
|---|---|---|
| ipapi.co | IP, city/region/country, ISP, ASN, timezone | Real-time on lookup |
| RIPEstat (best-effort) | ASN routing and prefix data | Real-time on lookup |
DNS resolution
All DNS lookups run over DNS-over-HTTPS (DoH) to avoid leaking queries through your local resolver and to ensure consistent results across regions.
| Source | Used for | Update cadence |
|---|---|---|
| Cloudflare DNS (1.1.1.1) | A, AAAA, MX, TXT, NS, CNAME, SOA, CAA, PTR records | Real-time, edge-cached per TTL |
| Google DNS (8.8.8.8) | Cross-resolver verification when results conflict | Real-time |
WHOIS / RDAP
Domain ownership, registrar, and registration timestamps come from the registrar's RDAP endpoint when available, with WHOIS as fallback.
| Source | Used for | Update cadence |
|---|---|---|
| RDAP (IANA-bootstrapped) | Registrar, registration/expiration dates, nameservers, DNSSEC status | Real-time on lookup |
| WHOIS (port 43) | Fallback when RDAP is unavailable | Real-time |
Blacklists / reputation
We query a curated panel of established DNSBLs (DNS-based Block Lists) in parallel. Reputation is the count of lists that flag a target divided by the total queried.
| Source | Used for | Update cadence |
|---|---|---|
| Spamhaus ZEN | Composite spam / exploit list | Continuous (Spamhaus-maintained) |
| SpamCop | User-reported spam sources | Continuous |
| Barracuda Reputation Block List | Mail server reputation | Continuous |
| SORBS | Open-relay and exploited host detection | Continuous |
| DroneBL, UCEPROTECT, others | Broader reputation coverage | Continuous |
TLS / SSL certificates
Certificate inspection performs a real TLS handshake to the host and reports the leaf certificate, expiration, issuer, and SAN list.
| Source | Used for | Update cadence |
|---|---|---|
| Live TLS handshake (your request) | Leaf certificate, expiration, SANs, issuer | Real-time |
HTTP / security headers
HTTP header diagnostics issue a real HEAD/GET against the target and score the response against the OWASP Secure Headers project recommendations.
| Source | Used for | Update cadence |
|---|---|---|
| Live HTTP request (your request) | Status code, headers, redirects | Real-time |
| OWASP Secure Headers Project | Scoring rubric for header best practices | Reference; mirrored quarterly |
Network / latency
Ping, port-check, and reachability tests are executed from our edge functions, not from your browser, so results reflect server-to-server reachability.
| Source | Used for | Update cadence |
|---|---|---|
| Edge runtime (Cloudflare Workers) | HTTP ping, TCP port reachability, traceroute hops where supported | Real-time |
Last reviewed: June 2026. Sources change — if a feed is deprecated or replaced we update this page within one release cycle.