| Current resolved IP | Users who only need to know who gets hit first right now | A or AAAA records, current ASN, and edge-platform labels | It only describes the entry layer and cannot automatically reveal true hosting | Low | Best as the first-glance result |
| CDN, WAF, or frontage platform | Users who need to explain why traffic lands on Cloudflare or another edge network first | CNAME chains, HTTP traits, Anycast, and frontage-platform behavior | It still does not equal the true origin or final seller | Low-medium | Best as the middle-layer explanation |
| True origin and final hosting | Users who need the real server and responsibility boundary | DNS chain, historical records, subdomains, HTTP headers, mail, and platform clues | The workflow is slower and often ends in high confidence rather than absolute certainty | Medium | Best as the final decision layer |