[darkhorse10123]

Sometimes you just need a quick lookup for an IP address or domain to gather basic open-source intelligence (OSINT). Public services like ip-api.com provide free or low-cost lookups for:

• Geolocation (country, city)
  
• ISP/ASN information
  
• Timezone
  
• Approximate coordinates
  

Below is a simple Python script demonstrating how to perform these lookups automatically.
Disclaimer: This tutorial is for educational, legal OSINT usage. Always ensure you have the right to gather or analyze data about an IP or domain in your jurisdiction.

---

1. Basic OSINT Queries

1. IP Address
   • Where is the IP physically located?
     
   • Who is the ISP or hosting provider?
     
2. Domain
   • Does the domain resolve to multiple IPs?
     
   • Are there suspicious subdomains pointing to unusual IPs?
     
3. Use Cases
   • Quick triage on suspicious traffic or logs
     
   • Geolocating potential threats or spam sources
     
   • Simple reconnaissance during the early phases of OSINT investigations
     

---

2. Complete Python Script
Below is a fully functional Python script that accepts an IP address or domain from the user, queries ip-api.com, and prints a short report.


+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""
OSINT Basics: Quick IP/Domain Recon with Python
Author: YourName
Date: 2025-01-24

Description:
    This script demonstrates how to retrieve basic OSINT-related information
    (e.g., geolocation, ISP, region, etc.) about an IP address or domain
    using the free ip-api.com service.

Disclaimer:
    This script is for EDUCATIONAL and LEGAL OSINT usage ONLY.
"""

import requests
import sys

API_URL = "http://ip-api.com/json/"  # Base endpoint for IP geolocation

def ip_lookup(target):
    """
    Queries ip-api.com to get geolocation and network info for an IP or domain.
    Returns JSON data or None on error.
    """
    url = API_URL + target
    try:
        response = requests.get(url, timeout=10)
        response.raise_for_status()
        data = response.json()
        if data["status"] == "fail":
            print(f"[!] Failed lookup for {target}: {data['message']}")
            return None
        return data
    except Exception as e:
        print(f"[!] Error performing lookup on {target}: {e}")
        return None

def print_report(data):
    """
    Prints a short text report based on the JSON data from ip-api.
    """
    print("\n--- IP/Domain Report ---")
    print(f"Query        : {data.get('query', 'N/A')}")
    print(f"Country      : {data.get('country', 'N/A')}")
    print(f"Region/State : {data.get('regionName', 'N/A')}")
    print(f"City        : {data.get('city', 'N/A')}")
    print(f"ISP          : {data.get('isp', 'N/A')}")
    print(f"Org          : {data.get('org', 'N/A')}")
    print(f"ASN          : {data.get('as', 'N/A')}")
    print(f"Timezone    : {data.get('timezone', 'N/A')}")
    print(f"Latitude    : {data.get('lat', 'N/A')}")
    print(f"Longitude    : {data.get('lon', 'N/A')}")
    print("------------------------\n")

def main():
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <IP-or-Domain>")
        sys.exit(1)

    target = sys.argv[1]
    print(f"
[*]Looking up: {target}")
    data = ip_lookup(target)
    if data:
        print_report(data)
    else:
        print("[!] No data to display.")

if __name__ == "__main__":
    try:
        main()
    except KeyboardInterrupt:
        print("\n[!] Script interrupted by user.")
        sys.exit(1)
    except Exception as e:
        print(f"[!] An error occurred: {e}")
        sys.exit(1)

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

How It Works

1. User Input
   • python ip_recon.py 8.8.8.8
     or
     python ip_recon.py example.com
     
2. API Query
   • The script appends the target to
     ip-api.com/json/{target}
     .
     
3. JSON Parsing
   • If the query is successful, the JSON response includes location, ISP, and other data.
     
4. Reporting
   • A short summary prints out in plain text.
     

---

3. Tips & Best Practices

1. Respect API Limits
   • The free tier allows up to 45 requests per minute per IP—use responsibly.
     
2. Extend the Script
   • Integrate with domain WHOIS lookups.
     
   • Combine with subdomain finders or reverse DNS lookups.
     
3. Cache Results
   • Store results in a local database or CSV for large-scale investigations.
     
4. Verify Accuracy
   • IP-based geolocation is approximate. For critical investigations, use multiple sources.
     
5. Legal & Ethical
   • Gathering geolocation or ISP data about an IP is typically public info.
     
   • Still, ensure compliance with relevant laws or organizational policies.
     

---

Conclusion
This quick script exemplifies how easy it is to gather fundamental OSINT details on an IP address or domain using a free API. In real investigations, you’d likely chain this with more thorough checks—DNS records, WHOIS data, and host-based scanning for advanced recon. Nevertheless, it’s a great starting point for beginners who need a fast, reliable way to get basic geolocation and ISP info.
Happy OSINTing!

[TheBanano21]

How is this any useful? You are just calling a random API... There isn't even a need for having a script like this.