This is horrible! I just found wireshark and it is GeoIP.Info location! The packets showed the contents of my request, even when it has gone through tor and the source and destination were all correct. I cannot tell about netcrafttoolbar, nor about showip. Still learning to use wireshark. Do these two also leak dns?