Location, ISP, and ASN come from the DB-IP Lite databases (City and ASN), kept on our server and updated monthly. Location from an IP database is an estimate, usually right to the city, sometimes only to the country.
Your address in the other family (IPv4 when you connect over IPv6, and the other way round) is detected by your browser through ipify.
Queries go to the registries' WHOIS servers (port 43), starting at IANA and following referrals to the registry and registrar. Registries that no longer answer WHOIS are asked over RDAP, using the server list from IANA's bootstrap.
Name, organisation, country, registration dates, and abuse contact come over RDAP from the RIR that manages the AS number (ARIN, RIPE NCC, APNIC, LACNIC, or AFRINIC).
Announced prefixes, upstreams, and the graph come from RIPEstat, which reads BGP paths from the RIPE RIS collectors. AS names come from RIPE's asnames list, refreshed daily.
Records are queried over DNS-over-HTTPS from Cloudflare, with Google as a fallback. Answers can come from the resolver's cache, for up to each record's TTL.
Worked out on our server from the CIDR prefix you enter. No outside data.