wtfis

wtfis gathers passive hostname, domain, and IP information from public sources.

github.com/pirxthepilot/wtfis
wtfis homepage screenshot

About wtfis

wtfis is an open source command-line tool that gathers information about a domain, fully qualified domain name (FQDN), or IP address. It queries several OSINT services and is designed to present the results in a form that people can read and understand, rather than in raw machine output. The project is written in Python and can be installed with pip, conda, or Homebrew.

VirusTotal is the primary source. Other services add data for specific lookup types: AbuseIPDB for IP reputation, Greynoise for scanning activity, Shodan for open ports and services, URLhaus for malware URL history, and IPWhois, IP2Location, and IPinfo for geolocation and ASN data. The tool is built to assume free-tier or community accounts and makes as few API calls as possible to limit quota and rate-limit use. Each service's API key is an optional environment variable, and lookups are sent to these third-party services.

Key features

  • Hostname, domain, and IP lookups drawing on multiple OSINT services
  • VirusTotal analysis stats, reputation score, categories, and resolution history
  • AbuseIPDB abuse confidence score and report count for IP addresses
  • Geolocation and ASN data through IPWhois, IP2Location, or IPinfo
  • Greynoise checks for internet scanning activity and common business applications
  • Shodan open ports, services, operating system, and tags for IP addresses
Best for: Analysts and developers who want readable command-line domain and IP lookups using free-tier or community accounts.
Good for
  • Output is designed for human reading rather than machine processing
  • Makes few API calls to reduce hitting free-tier quotas and rate limits
  • Open source and installable through pip, conda, or Homebrew
Watch out for
  • Shodan data is listed as not available on a free tier
  • Most data sources require their own API keys, set as environment variables

wtfis at a glance

Type
Open-source project
Pricing
Not confirmed. Check the site
Open source
Yes · Source code
Language
English
Last checked
Oct 6, 2026 · Online when checked
Listed
Oct 5, 2026

wtfis alternatives

Tools and sites you could use instead, ranked by how closely they match.

All 24 alternatives

Popular in Domain, IP & DNS Lookup

Well-known listings from the same topic.

All 44

wtfis FAQ

Do I need API keys for every data source?
No. Each service's API key is an optional environment variable, so wtfis uses only the services you configure.
Where does whois data come from?
IP2Whois is used when its credentials are provided. VirusTotal is used for whois data only as a fallback when IP2Whois credentials are not available.
How can I install wtfis?
It can be installed with pip install wtfis, from conda-forge, or with brew install wtfis.
Is something wrong or out of date?

Tell us and an editor will check it.

Own this website?

Claim the listing and suggest updates yourself. An editor checks every claim first.

Claim this listing