How Does GhostTrack Track Ghosts? Inside the Python OSINT Tool

GhostTrack is a Python-based command-line OSINT utility that tracks "ghosts" by querying public APIs for IP geolocation, parsing phone number metadata with the phonenumbers library, and enumerating username presence across 23 social media platforms via HTTP status checks.

GhostTrack, hosted in the HunxByts/GhostTrack repository, is a lightweight open-source intelligence (OSINT) tool designed to aggregate publicly available information about digital identifiers. The entire application resides in a single script, GhostTR.py, which implements a modular menu system to dispatch tracking functions for IP addresses, phone numbers, and social media handles.

IP Geolocation via the ipwho.is API

The IP_Track() function in GhostTR.py handles IP address intelligence by consuming the ipwho.is JSON API. When a user inputs a target IP, the function performs a GET request to https://ipwho.is/{ip}, extracting geolocation data including country, city, latitude, longitude, ISP, and organization.

The function then constructs a Google Maps deep link using the returned coordinates (https://www.google.com/maps/@{lat},{long},8z) and renders the data in a formatted table. This implementation performs no active scanning; it simply parses the public API response.

# Conceptual flow from GhostTR.py

def IP_Track():
    ip = input("Enter IP target : ")
    response = requests.get(f"https://ipwho.is/{ip}")
    data = response.json()
    # Extracts: data['country'], data['city'], data['latitude'], etc.

    # Generates: https://www.google.com/maps/@{lat},{long},8z

Phone Number Metadata Extraction

For phone number intelligence, GhostTrack implements the phoneGW() function, which leverages the phonenumbers Python library to parse and validate international numbers. The function accepts input in E.164 format (e.g., +628123456789) and extracts carrier information, geographic location, region code, timezone, number type (mobile/fixed-line), and validation status.

Unlike the IP tracker, this module performs local computation using the phonenumbers parsing engine rather than external API calls, though it still relies on the library's embedded metadata for carrier and location lookups.

# Example interaction targeting an Indonesian number

Enter phone number target Ex [+6281xxxxxxxxx] : +628123456789

========== SHOW INFORMATION PHONE NUMBERS ===========
Location             : Jakarta
Region Code          : ID
Timezone             : Asia/Jakarta
Operator             : Telkomsel
Valid number         : True

Username Enumeration Across Social Platforms

The TrackLu() function implements username osintification by iterating over a hard-coded list of 23 social media URL patterns. For each platform (including Facebook, Twitter, Instagram, GitHub, and others), the function interpolates the supplied username into the platform's profile URL pattern and executes a GET request.

A 200 HTTP status code indicates the profile exists, while other responses trigger a "Username not found" placeholder. The results are aggregated into a dictionary and displayed line-by-line. This method relies on the fact that most social platforms return consistent status codes for non-existent profiles.

# Simplified logic from GhostTR.py TrackLu()

urls = {
    "Facebook": f"https://www.facebook.com/{username}",
    "Instagram": f"https://www.instagram.com/{username}",
    # ... 21 additional platforms

}

for platform, url in urls.items():
    response = requests.get(url)
    if response.status_code == 200:
        print(f"[ + ] {platform} : {url}")
    else:
        print(f"[ - ] {platform} : Username not found !")

CLI Architecture and Utility Functions

GhostTrack employs a simple menu-driven architecture centered around the options list and the option() function. The option() function renders an ANSI-colored ASCII banner and presents four tracking modes plus an exit command. User input is validated via is_in_options() and dispatched through execute_option() and call_option() to the appropriate handler.

Additional utility functions include:

• showIP(): Retrieves the user's public IP via https://api.ipify.org/ to display the host machine's address.
• clear(): Abstracts terminal clearing across Windows (cls) and Unix (clear) systems.
• run_banner(): Generates the colorful CLI banner displayed on startup.

Dependencies are managed through requirements.txt, which declares requests for HTTP operations and phonenumbers for telephony parsing.

# Installation and execution

pip install -r requirements.txt
python GhostTR.py

Summary

• GhostTrack aggregates public data only, using read-only API queries and HTTP status checks without hidden probing or intrusive scanning.
• IP tracking relies on the ipwho.is service to convert addresses into geographic coordinates and map links.
• Phone tracking uses the local phonenumbers library to decode carrier, timezone, and validity data from E.164 formatted numbers.
• Username tracking checks 23 hard-coded social platforms via GET requests, correlating HTTP 200 responses with account existence.
• The entire tool is contained within GhostTR.py, utilizing a simple menu system (option(), execute_option()) to route user selections to specific tracking functions.

Frequently Asked Questions

What is GhostTrack and who maintains it?

GhostTrack is an open-source OSINT utility maintained by the GitHub user HunxByts. It is published under the HunxByts/GhostTrack repository and distributed as a single Python script (GhostTR.py) designed for command-line operations.

Is GhostTrack legal to use?

GhostTrack only queries publicly available data sources and APIs (ipwho.is, social media profile URLs, and public IP services). It performs no exploits, brute-forcing, or unauthorized access. However, users must comply with local laws regarding data collection and privacy when using OSINT tools.

What dependencies does GhostTrack require?

According to requirements.txt, GhostTrack requires two third-party libraries: requests (for HTTP API calls and web requests) and phonenumbers (for parsing and validating international phone number formats).

How accurate is the location data provided by GhostTrack?

IP geolocation accuracy depends on the ipwho.is database, which typically provides city-level precision for most IPs but may vary for VPNs, proxies, or mobile carriers. Phone number location data is derived from the number's country code and area code metadata, not real-time GPS tracking.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}