██████╗ ██╗ ██╗ ██████╗ ███████╗████████╗███╗ ███╗ █████╗ ██████╗
██╔════╝ ██║ ██║██╔═══██╗██╔════╝╚══██╔══╝████╗ ████║██╔══██╗██╔══██╗
██║ ███╗███████║██║ ██║███████╗ ██║ ██╔████╔██║███████║██████╔╝
██║ ██║██╔══██║██║ ██║╚════██║ ██║ ██║╚██╔╝██║██╔══██║██╔═══╝
╚██████╔╝██║ ██║╚██████╔╝███████║ ██║ ██║ ╚═╝ ██║██║ ██║██║
╚═════╝ ╚═╝ ╚═╝ ╚═════╝ ╚══════╝ ╚═╝ ╚═╝ ╚═╝╚═╝ ╚═╝╚═╝
Multi-module OSINT reconnaissance CLI. IP intel. Domain recon. Email breach check. People search. AI-powered threat summary.
GhostMap is a terminal-based OSINT tool built for cybersecurity analysts, bug bounty hunters, and researchers. Feed it a target — IP, domain, email, or name — and it pulls intelligence from multiple sources, scores the risk, and gives you an AI-generated threat assessment. All from one CLI.
osint/
├── main.py # Interactive menu + ASCII banner
├── ai.py # OpenRouter AI threat summary
├── modules/
│ ├── base.py # Recon base class
│ ├── ip.py # IP recon (async)
│ ├── domain.py # Domain recon
│ ├── email.py # Email breach check
│ └── people.py # People / username search
└── output/
├── terminal.py # Rich table display
└── pdf.py # PDF export (coming soon)
| Module | Sources | Output |
|---|---|---|
| IP Recon | AbuseIPDB, Shodan, VirusTotal | Abuse score, open ports, CVEs, ASN, risk score |
| Domain Recon | Whois, DNS, crt.sh, VirusTotal | Registrar, A/MX/TXT records, subdomains, risk score |
| Email Recon | Hudson Rock (infostealer DB) | Breach count, infection details, risk score |
| People Search | Sherlock (username), DDG dork (full name) | Social profile URLs across 300+ sites |
| AI Summary | OpenRouter (free tier) | Threat assessment, suspicious flags, risk verdict |
# Clone
git clone https://github.com/Parin070/GhostMap.git
cd GhostMap
# Create venv
python3 -m venv .venv
source .venv/bin/activate # Windows: .venv\Scripts\activate
# Install
pip install -e .
# Setup keys
cp .env.example .env
nano .envABUSEIPDB_API_KEY= # https://www.abuseipdb.com/api
SHODAN_API_KEY= # https://account.shodan.io
VIRUSTOTAL_API_KEY= # https://www.virustotal.com/gui/my-apikey
OPENROUTER_API_KEY= # https://openrouter.ai/keysAll free tier. No paid keys needed.
python -m osint.main ██████╗ ██╗ ██╗ ██████╗ ███████╗████████╗███╗ ███╗ █████╗ ██████╗
...
What do you want to recon?
1. IP
2. Domain
3. Email
4. People
0. Exit
# IP recon
Enter your choice: 1
Enter IP: 8.8.8.8
# Domain recon
Enter your choice: 2
Enter domain: google.com
# Email breach check
Enter your choice: 3
Enter email: target@example.com
# Username search (Sherlock)
Enter your choice: 4
Enter username or full name: johndoe
# Full name search (DDG dork)
Enter your choice: 4
Enter username or full name: John DoeGhostMap calculates a risk score per module:
| Score | Verdict |
|---|---|
| 0–30 | Low risk |
| 31–60 | Medium risk |
| 61–100 | High risk |
IP — weighted average of AbuseIPDB confidence, VirusTotal detections, Shodan CVEs
Domain — VirusTotal malicious/total engine ratio
Email — tiered by infostealer breach count (0 / <10 / <50 / 50+)
Python 3.10+ asyncio / aiohttp Typer Rich
Shodan API AbuseIPDB API VirusTotal API
Hudson Rock crt.sh DDG Search
Sherlock OpenRouter AI python-whois / dnspython
- IP recon (async)
- Domain recon
- Email breach check
- People search (username + full name)
- AI threat summary
- Rich terminal output
- PDF export
- Facial recognition module (Phase 10)
- Full async across all modules
GhostMap queries publicly available data only. No authentication bypass. No private data access. Built for authorized security research, penetration testing, and OSINT investigations.
Use responsibly. The author is not liable for misuse.
Stay in the shadows. Leave no trace. GhostMap.