Developed by OGT
IPScope is a production-quality, zero-API-key CLI tool for IP intelligence and reconnaissance.
Gather detailed information including geolocation, WHOIS/RDAP data, reverse DNS, port scanning, DNSBL blacklist checks, and generate professional HTML, CSV, and JSON reports from a single command.
⭐ Star this repository if you find it useful for security research!
| Feature | Details |
|---|---|
| Primary IP Lookup | ip-api.com - country, city, ISP, ASN, timezone, proxy/hosting flags |
| Enrichment | ipwho.is - capital, currency, flag emoji, calling code, Tor/VPN/anonymizer |
| Reverse DNS | socket.gethostbyaddr() with fallback |
| RDAP / WHOIS | rdap.org - handle, name, type, CIDR ranges |
| TCP Port Scan | 30 common ports, ThreadPoolExecutor (80 workers), configurable timeout |
| DNSBL Blacklist | Spamhaus, SpamCop, DroneBL, Barracuda via reversed-octet DNS |
| Google Maps Link | Auto-generated from lat/lon |
| Batch Mode | .txt file with one IP/domain per line |
| Private IP Detection | RFC1918, loopback, link-local, multicast warnings |
| Export: JSON | Structured nested JSON (indent=2) |
| Export: CSV | Flat row per target |
| Export: HTML | Dark professional theme, badge verdict |
| Zero API keys | Works out of the box |
# Clone or download ipscope.py, then install optional dependencies:
pip install colorama rich
# Make executable (Linux/macOS):
chmod +x ipscope.pyRequirements: Python 3.8+. colorama and rich are optional - the tool degrades gracefully if they are absent.
ipscope <IP|DOMAIN|FILE.txt> [options]
# Basic IP lookup
python3 ipscope.py 8.8.8.8
# Resolve a domain then look it up
python3 ipscope.py google.com
# Full scan: ports + RDAP + DNSBL blacklist
python3 ipscope.py 8.8.8.8 --all
# Port scan + blacklist only
python3 ipscope.py 8.8.8.8 --scan --dnsbl
# Save an HTML report
python3 ipscope.py 8.8.8.8 --html report.html
# Batch scan from file + export CSV
python3 ipscope.py targets.txt --csv results.csv
# Output raw JSON to stdout
python3 ipscope.py 1.2.3.4 --json
# Quiet mode (key findings only)
python3 ipscope.py 8.8.8.8 --quiet
# Full scan with all exports
python3 ipscope.py 8.8.8.8 --all --json --html report.html --csv results.csv| Option | Description |
|---|---|
--all |
Enable --scan + --rdap + --dnsbl together |
--scan |
TCP port scan 30 common ports |
--rdap |
Fetch RDAP/WHOIS owner info |
--dnsbl |
Check DNSBL blacklists (Spamhaus, SpamCop, DroneBL, Barracuda) |
--json |
Save ipscope_results.json |
--csv FILE |
Export flattened CSV report |
--html FILE |
Export styled dark-theme HTML report |
--raw |
Print raw JSON to stdout |
--quiet |
Minimal output: target + key findings only |
--timeout N |
Override API + socket timeout in seconds (default: 10) |
--ports N1,N2 |
Override port list (comma-separated) |
--threads N |
Override batch thread count (default: 6) |
--help / -h |
Show help screen and exit |
Each target gets a full report with these sections (in order):
- IDENTITY - input, IP, reverse DNS, API status
- GEOLOCATION - country, continent, city, zip, coordinates, timezone, capital, currency, flag, calling code
- NETWORK - ISP, org, ASN, connection domain/type, hosting indicator
- WHOIS / RDAP - handle, name, type, country, start/end address, CIDRs
- OPEN PORTS - sorted list with service names (only shown when
--scanused) - SECURITY FLAGS - proxy, hosting, mobile, Tor, VPN, anonymizer badges
- BLACKLIST - per-list CLEAN ✔ or LISTED ✖ result
- MAP - Google Maps link
Final verdict per target: CLEAN / SUSPICIOUS / HIGH RISK
8.8.8.8
1.1.1.1
208.67.222.222
example.com
185.220.101.1
Run with: python3 ipscope.py targets.txt --all --html report.html
The HTML report uses a dark professional theme (#1a1a2e background, #0f3460 headers, #e94560 accents) with color-coded verdict badges (CLEAN / SUSPICIOUS / HIGH RISK) and a generation timestamp.
- Rate limiting: ip-api.com allows ~45 requests/minute. In batch mode, IPScope adds a 1.4-second delay between targets automatically.
- No API keys required for any feature.
- Private/reserved IPs (RFC1918, loopback, link-local, multicast) are detected and flagged with a warning.
- All network calls have a configurable timeout; failed API calls never abort the scan.
Developed by OGT - IPScope v1.0