# pirxthepilot/wtfis

Passive hostname, domain and IP lookup tool for non-robots

Repository: https://github.com/pirxthepilot/wtfis
Canonical: https://ross.abutalabs.com/products/wtfis
Language: Python
License: MIT
License Family: permissive
Last push: 2026-04-21T03:56:01+00:00

## Health v2 (maintenance only)
Score: 74/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 78, release rhythm 54, longevity 100
- inputs: {"age_days": 1500, "days_push": 134, "days_rel": 149, "gap_med": 94.5, "n_releases_24m": 7}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1827, forks 83 (observed 2026-08-28T04:05:41.535814+00:00)

## What it is
wtfis is a Python command-line tool that performs passive lookups of hostnames, domains, and IP addresses using OSINT services like VirusTotal, Shodan, AbuseIPDB, and Greynoise. It presents results in a human-readable format and minimizes API calls to stay within free-tier quotas.

## Use cases
- look up who owns a domain from the terminal
- check if an IP address is malicious
- get whois and reputation info for a hostname
- investigate suspicious domains during incident response
- geolocate an IP address and find its ASN
- check domain resolutions and analysis stats from VirusTotal

## When to choose
- you want readable OSINT lookup results designed for humans rather than scripts
- you rely on free-tier API accounts and need to conserve quota
- you want a single tool aggregating multiple threat intel sources
- you need quick passive reconnaissance from the command line

## When to avoid
- you need fully automated, high-volume programmatic lookups
- you require active scanning or deep Shodan-style port data without a paid Shodan key
- you need a GUI or web interface

## Facets
- artifact type: cli-tool
- maturity: active
- function: osint, security, cli, developer-tools
- domain: security, osint, networking
- platform: python, cli, cross-platform
- tags: whois, virustotal, shodan, abuseipdb, greynoise, ipinfo, threat-intelligence, passive-lookup, domain-lookup, ip-lookup, command-line

## Member repositories
- pirxthepilot/wtfis (main) score 74

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:05:41.535814+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T03:19:25.998045+00:00, confidence not recorded.
  - readme: https://github.com/pirxthepilot/wtfis (fetched 2026-08-28T04:05:41.535814+00:00, sha c33351cc34a6)
  - registry_pypi: https://pypi.org/pypi/wtfis/json (fetched 2026-08-29T10:58:39.220643+00:00, sha 016926d0ce23)
- Data as of 2026-08-30T08:39:29.467469+00:00.