When I call the PF state inspector, it shows me the protocolled connections. Clicking on the lupe to one connection, there is a nice function for DNS resolution. Unfortunately, when I click on this DNS resolution function, an error is issued (text see below):
available at: https://www.arin.net/whois_tou.html
If you see inaccuracies in the results, please report at
Query terms are ambiguous. The query is assumed to be:
Use "?" to get help.