Package: wtfis
wtfisPassive hostname, domain and IP lookup tool for non-robotsWTF is it?wtfisis a commandline tool that gathers information about a domain, FQDN or IP address using various OSINT services. Unlike other tools of its kind, it's built specifically for human consumption, providing results that are pretty (YMMV) and easy to read and understand.This tool assumes that you are using free tier / community level accounts, and so makes as few API calls as possible to minimize hitting quotas and rate limits.The project name is a play on "whois".Data SourcesServiceUsed in lookupRequiredFree TierVirustotalAllYesYesPassivetotalAllNoYesIP2WhoisDomain/FQDNNoYesIPWhoisIP addressNoYes (no signup)ShodanIP addressNoNoGreynoiseIP addressNoYesURLhausAllNoYes (no signup)VirustotalThe primary source of information. Retrieves:Hostname (FQDN), domain or IPLatest analysis stats with vendor detailReputation score (based on VT community votes)Popularity ranks (Alexa, Cisco Umbrella, etc.) (FQDN and domain only)Categories (assigned by different vendors)Resolutions(FQDN and domain only)Last n IP addresses (default: 3, max: 10)Latest analysis stats of each IP aboveWhoisFallback only: if Passivetotal creds are not availableVarious whois data about the domain itselfPassivetotal (RiskIQ)Optionally used if creds are provided. Retrieves:WhoisVarious whois data about the domain itselfPassivetotal is recommended over Virustotal for whois data for a couple of reasons:VT whois data format is less consistentPT whois data tends to be of better quality than VT. Also, VT's registrant data is apparentlyanonymized.You can save one VT API call by offloading to PTIP2WhoisOptionally used if creds are provided and Passivetotal creds are not supplied. (i.e. second in line for Whois information)WhoisVarious whois data about the domain itselfAs above, IP2Whois is recommended over Virustotal if a Passivetotal account cannot be obtained.IPWhoisDefault enrichment for IP addresses. Retrieves:ASN, Org, ISP and GeolocationIPWhois should not be confused with IP2Whois, which provides domain Whois data.ShodanAlternative IP address enrichment source. GETs data from the/shodan/host/{ip}endpoint (seedoc). For each IP, retrieves:ASN, Org, ISP and GeolocationList of open ports and servicesOperating system (if available)Tags (assigned by Shodan)GreynoiseSupplementary IP address enrichment source. Using itscommunity API, wtfis will show whether an IP is in one of Greynoise's datasets:Noise: IP has been seen regularly scanning the InternetRIOT: IP belongs to a common business application (e.g. Microsoft O365, Google Workspace, Slack)More information about the datasetshere.In addition, the API also returns Greynoise'sclassificationof an IP (if available). Possible values arebenign,malicious, andunknown.URLhausURLhausis a crowd-sourced database of reported malicious URLs. This enrichment provides insight on whether the queried hostname or IP is being or was used for malware distribution via HTTP or HTTPS. Data that is provided include:Count of currently online and total malware URLsWhether the hostname or IP is currently in theDNSBLandSURBLpublic blocklistsAll tags that have been assigned to the URL throughout its history in the URLhaus databaseInstall$ pip install wtfisTo install viaconda(from conda-forge), seewtfis-feedstock.To install viabrew:brew install wtfisSetupwtfis uses these environment variables:VT_API_KEY(required) - Virustotal API keyPT_API_KEY(optional) - Passivetotal API keyPT_API_USER(optional) - Passivetotal API userIP2WHOIS_API_KEY(optional) - IP2WHOIS API keySHODAN_API_KEY(optional) - Shodan API keyGREYNOISE_API_KEY(optional) - Greynoise API keyWTFIS_DEFAULTS(optional) - Default argumentsSet these using your own method.Alternatively, create a file in your home directory~/.env.wtfiswith the above declarations. See.env.wtfis.examplefor a template.NOTE: Don't forget tochmod 400the file!Usageusage: wtfis [-h] [-m N] [-s] [-g] [-u] [-n] [-1] [-V] entity

positional arguments:
  entity                Hostname, domain or IP

options:
  -h, --help            show this help message and exit
  -m N, --max-resolutions N
                        Maximum number of resolutions to show (default: 3)
  -s, --use-shodan      Use Shodan to enrich IPs
  -g, --use-greynoise   Enable Greynoise for IPs
  -u, --use-urlhaus     Enable URLhaus for IPs and domains
  -n, --no-color        Show output without colors
  -1, --one-column      Display results in one column
  -V, --version         Print version numberBasically:$ wtfis FQDN_OR_DOMAIN_OR_IPand you will get results organized by panel, similar to the image above.Defanged input is accepted (e.g.api[.]google[.]com).If supported by the terminal, theAnalysisfield and (if using PT) headings in the whois panel are clickable hyperlinks that point to the appropriate pages on the VT or PT website.Shodan enrichmentShodan can be used to enrich the IP addresses (instead of IPWhois). Invoke with the-sor--use-shodanflag.If supported by the terminal, theServicesfield is a clickable hyperlink that takes you to the Shodan web interface.Greynoise enrichmentTo enable Greynoise, invoke with the-gor--use-greynoiseflag. Because the API quota is quite low (50 requests per week as of March 2023), this lookup is off by default.TheGreyNoisefield name is also a hyperlink (if terminal-supported) that points to the IP entry in the Greynoise web interface, where more context is shown.URLhaus enrichmentUse the-uor--use-urlhausflag to enable URLhaus enrichment for hostnames, domains and IPs.TheMalware URLsfield name is a hyperlink (if terminal-supported) that takes you to the specific URLhaus database page for your query.Display optionsFor FQDN and domain lookups, you can increase or decrease the maximum number of displayed IP resolutions with-m NUMBERor--max-resolutions=NUMBER. The upper limit is 10. If you don't need resolutions at all, set the number to0.To show all panels in one column, use the-1or--one-columnflag.Panels can be displayed with no color with-nor--no-color.DefaultsDefault arguments can be defined by setting theWTFIS_DEFAULTSenvironment variable. For example, to use shodan and display results in one column by default:WTFIS_DEFAULTS=-s -1If an argument is inWTFIS_DEFAULTS, then specifying the same argument during command invocationnegatesthat argument. So in the example above, if you then run:$ wtfis example.com -sthen Shodan will NOT be used.Note that maximum resolutions (-m N, --max-resolutions N) cannot be defined in defaults at the moment.Dockerwtfis can be run from a Docker image. First, build the image (using the includedDockerfile) by running:$ make docker-imageThe image will have the latesttaggedversion (not necessarily from the latest commit) wtfis. This ensures that you are getting a stable release.Two ways you can run the image:Ensure.env.wtfisis in your home directory and set with the necessary envvars. Then simply run:$ make docker-runThis is an alias to$ docker run --env-file=${HOME}/.env.wtfis -it wtfisNote that each definition must NOT have any spaces before and after the equal sign (FOO=bar, notFOO = bar).Altenatively, you can set the environment variables yourself, then run, e.g.:$ docker run -e VT_API_KEY -e SHODAN_API_KEY -it wtfis