Knowledge is power—and perhaps the best way to acquire that knowledge is by using OSINT, or Open Source Intelligence. OSINT entails gathering information from open sources in order to gauge threats, conduct investigations, or simply become better informed about a target system. Among the numerous OSINT tools out there, one that is both simple and effective is Wtfis—a command-line interface tool that makes multi-step domain and IP investigations seamless and human-readable. In this post, we'll demystify what Wtfis is, how it works, and how you can begin using it to enhance your cybersecurity investigations. Prefer watching instead of reading? Here’s a quick video guide Prefer watching instead of reading? Here’s a quick video guide Prefer watching instead of reading? Here’s a quick video guide Prefer watching instead of reading? Here’s a quick video guide https://youtu.be/yuOoh6xqkGs?embedable=true https://youtu.be/yuOoh6xqkGs?embedable=true What is Wtfis? Wtfis is a new command-line OSINT tool that allows you to search for information on IP addresses, hostnames, and domains in an easy-to-read format. Even its name, which is a joke on "What the F* is," amusingly reveals the tool's primary purpose—determining exactly what some internet domain or IP address is, where it originates from, and what it does. Unlike most tools, which spit raw JSON or junk results, Wtfis tries to give you helpful insights within a clean and readable format. It's meant for humans—rather than computers. Why Use Wtfis? Human-Friendly Output: Parsing is no longer a problem for those messy terminal dumps. Clear sections and easy-to-read output await you.
API Integrations: It sources data from a variety of providers such as VirusTotal, Whois, IPinfo, among others.
Great for Recon and Triage: Whether red teaming in recon or blue teaming to respond to alarms, it serves to quickly pick out suspicious signs.
Open Source: You can use it for free, inspect it freely, and make changes as you see fit. Human-Friendly Output: Parsing is no longer a problem for those messy terminal dumps. Clear sections and easy-to-read output await you. API Integrations: It sources data from a variety of providers such as VirusTotal, Whois, IPinfo, among others. Great for Recon and Triage: Whether red teaming in recon or blue teaming to respond to alarms, it serves to quickly pick out suspicious signs. Open Source: You can use it for free, inspect it freely, and make changes as you see fit. Installing Wtfis You can download Wtfis from GitHub straight away. You need Python 3.8+ and pip. Here is a quick start guide: Clone the Repo https://github.com/pirxthepilot/wtfis https://github.com/pirxthepilot/wtfis Or Install Directly pip install wtfis pip install wtfis You can now execute the tool with: wtfis openexploit.in # Change the target wtfis openexploit.in # Change the target Or to make it even more convenient, rename it or add it to your PATH for faster access. API Keys Setup To unlock richer results, you can link Wtfis to external data sources. You'll need API keys from services such as: VirusTotal
IPinfo
WhoisXML API
AbuseIPDB VirusTotal IPinfo WhoisXML API AbuseIPDB Once you have your keys, you can set them up with the .env file or environment variables. Sample .env configuration:

VT_API_KEY=openexploit_virustotal_key

IPINFO_TOKEN=openexploit_ipinfo_token

WHOISXML_API_KEY=openexploit_whoisxml_key

ABUSEIPDB_API_KEY=openexploit_abuseipdb_key Sample .env configuration:

VT_API_KEY=openexploit_virustotal_key

IPINFO_TOKEN=openexploit_ipinfo_token

WHOISXML_API_KEY=openexploit_whoisxml_key

ABUSEIPDB_API_KEY=openexploit_abuseipdb_key The more APIs you hook up, the richer your results will be. How to Use Wtfis Investigating a Suspicious Domain Investigating a Suspicious Domain Let's say you get a suspicious-looking domain in a phishing email: openexploit.in (it's my domain, but for now just assume) To investigate, you'd do: wtfis openexploit.in wtfis openexploit.in Wtfis will spit out a clean report, potentially containing: Whois information (registrar, creation date, contact email)
IP resolution (which IP addresses it resolves to)
Hosting provider and ASN
Geolocation information (country, city)
Threat intelligence (flags from VirusTotal, AbuseIPDB)
Passive DNS history (previous IPs used)
Subdomains Whois information (registrar, creation date, contact email) IP resolution (which IP addresses it resolves to) Hosting provider and ASN Geolocation information (country, city) Threat intelligence (flags from VirusTotal, AbuseIPDB) Passive DNS history (previous IPs used) Subdomains Checking a Suspicious IP Checking a Suspicious IP You see an unfamiliar IP 56.60.161.97 in your firewall logs. Run: wtfis 56.60.161.97 wtfis 56.60.161.97 You might see: ISP name and location
ASN information
Domain names hosted
Threat level score (if it shows up in abuse databases)
Reverse DNS records ISP name and location ASN information Domain names hosted Threat level score (if it shows up in abuse databases) Reverse DNS records This is extremely helpful during incident response, threat hunting, or vulnerability scans. JSON Output JSON Output # Get JSON output
wtfis openexploit.in --json # Get JSON output
wtfis openexploit.in --json Export to Markdown # export Wtfis output to a Markdown
wtfis openexploit.in > openexploit-osint-report.md # export Wtfis output to a Markdown
wtfis openexploit.in > openexploit-osint-report.md Best Use Cases for Wtfis Phishing Analysis: Use it to profile domains in suspicious emails.
Threat Hunting: Correlate unknown IPs and domains observed in logs or alerts.
Red Team Reconnaissance: Map target infrastructure through passive DNS and subdomain discovery.
Malware Analysis: Rapidly scan C2 servers or IOC lists derived from malware samples.
Security Blogging or Reporting: Convert raw indicators into intelligence-ready presentations for blogs, reports, or dashboards. Phishing Analysis: Use it to profile domains in suspicious emails. Threat Hunting: Correlate unknown IPs and domains observed in logs or alerts. Red Team Reconnaissance: Map target infrastructure through passive DNS and subdomain discovery. Malware Analysis: Rapidly scan C2 servers or IOC lists derived from malware samples. Security Blogging or Reporting: Convert raw indicators into intelligence-ready presentations for blogs, reports, or dashboards. User Tips Utilize in scripts or automation workflows—Wtfis has JSON output (--json) support for parsed structuring.
Pipe results into Markdown for readable intelligence briefs.
Layer with other tools such as amass, dnsx, or nmap for multi-layered insights.
Use API quotas and rate limits judiciously. Certain services place caps on free tiers. Utilize in scripts or automation workflows—Wtfis has JSON output (--json) support for parsed structuring. Pipe results into Markdown for readable intelligence briefs. Layer with other tools such as amass, dnsx, or nmap for multi-layered insights. Use API quotas and rate limits judiciously. Certain services place caps on free tiers. Limitations to Remember Wtfis is potent, but it's no magic bullet. There are a couple of limitations: API Dependence: Certain features won't function without API keys.
No Real-Time Traffic Inspection: It's OSINT, not a sniffer.
Static Analysis Only: It won't run malware or click links.
Data Freshness: Certain APIs cache data for performance. API Dependence: Certain features won't function without API keys. No Real-Time Traffic Inspection: It's OSINT, not a sniffer. Static Analysis Only: It won't run malware or click links. Data Freshness: Certain APIs cache data for performance. Always treat OSINT tools as pieces of a larger puzzle. Conclusion Tools like Wtfis offer an edge. It combines the depth of traditional OSINT with the elegance of human-friendly design—making it easier for both beginners and pros to get meaningful answers, fast. If you haven’t already, give it a spin, and consider integrating it into your daily toolkit. You’ll be surprised at how much you can uncover with a single command.

Certain

Unlock OSINT Skills with Wtfis: A Beginner-Friendly Guide to Domain and IP Lookups

About Author

Comments

TOPICS

THIS ARTICLE WAS FEATURED IN

Related Stories

A Beginner’s Guide to Reconnaissance in PenTesting

Windows Sticky Keys Exploit: The War Veteran That Never Dies

06/02/2018: Biggest Stories in the Cryptosphere

0-Days are on the Rise and that Means a Lot More Work for SOC Teams

Time Bombs Inside Software: 0-Day Log4Shell is Just the Tip of The Iceberg

The Noonification: How the Liver Transplant System Changed Forever (11/25/2023)

A Beginner’s Guide to Reconnaissance in PenTesting

Windows Sticky Keys Exploit: The War Veteran That Never Dies

06/02/2018: Biggest Stories in the Cryptosphere

0-Days are on the Rise and that Means a Lot More Work for SOC Teams

Time Bombs Inside Software: 0-Day Log4Shell is Just the Tip of The Iceberg

The Noonification: How the Liver Transplant System Changed Forever (11/25/2023)

Light-Mode

Classic

Newspaper

Minty

Dark-Mode

Neon Noir

Minty

HN StartUps