Possibility 1: Geolocation
It could still be ipwhois.io — for me, requests to this service logged in Process Monitor show up as ns102094.ip-147-135-36.us (a US server).
Similarly, running traceroute from servers in different countries using an online tool results in several different ip addresses: 108.181.61.49, 108.181.64.139, 103.126.138.87, 108.181.47.111, 15.204.213.5, and 195.201.57.90. Running a DNS lookup locally results in 147.135.36.89.
Entering any of these IP addresses into my browser's address bar redirects me to https://ipwhois.io/.
Testing
To check whether 92.50.230.15 and 92.50.230.13 are actually the result of a geolocation lookup, you can try the following:
- With the geolocation setting on (it's on by default), create a new note and check to see whether a new connection to 92.50.230.x has been logged.
- Repeat step 1 a few times (is a request logged every time a new note is created?)
- Turn off geolocation in settings
- Repeat step 1 several times
Possibility 2: Images linked to notes
Depending on how you set Joplin up (and whether you imported notes), it's possible it's an image or other resource included in a note.
For example, including the following markdown in a note
results in
