# What Kind of Data Does GhostTrack Collect? Complete OSINT Analysis

> Discover what data GhostTrack collects for OSINT analysis including IP geolocation, carrier metadata, social media presence, and public IP addresses. Learn more now.

- Repository: [K1LLU/GhostTrack](https://github.com/HunxByts/GhostTrack)
- Tags: deep-dive
- Published: 2026-04-29

---

**GhostTrack collects publicly available IP geolocation details, phone number carrier metadata, social media presence indicators across 23 platforms, and local public IP addresses using open-source intelligence APIs.**

GhostTrack is a Python-based OSINT utility developed by HunxByts that aggregates publicly accessible information from internet sources without persistent storage. The tool queries external APIs and performs HTTP requests to gather target intelligence, displaying all results locally in the console.

## Types of Data Collected by GhostTrack

### IP Address Geolocation and Network Intelligence

The **IP_Track()** function in [`GhostTR.py`](https://github.com/HunxByts/GhostTrack/blob/main/GhostTR.py) (lines 45-77) retrieves comprehensive network and location data by calling the free **ipwho.is** API (`http://ipwho.is/<IP>`).

When analyzing a target IP address, GhostTrack extracts:

- **Network details**: IP type (IPv4/IPv6), ASN, ISP name, organization, and domain
- **Geographic coordinates**: Country, city, region, continent, latitude/longitude, postal code, and capital city
- **Timezone information**: Timezone ID, UTC offset, DST status, and current local time
- **Regional metadata**: Calling code, country borders, flag emoji, and EU membership status

The implementation parses the JSON response from ipwho.is and renders these fields in a formatted console table.

```python

# Inside the interactive menu, choose option 1 (IP Tracker)

# Then enter the target IP address when prompted.

# Example call:

IP_Track()   # see implementation in GhostTR.py, lines 45-77

```

### Phone Number Metadata and Validation

For telephone number investigation, the **phoneGW()** function (lines 80-119 of [`GhostTR.py`](https://github.com/HunxByts/GhostTrack/blob/main/GhostTR.py)) utilizes the **phonenumbers** library to parse and validate international numbers.

This module collects:

- **Regional identifiers**: ISO-3166 region codes and country calling codes
- **Carrier information**: Service provider name via `carrier.name_for_number`
- **Geolocation**: City and region descriptions via `geocoder.description_for_number`
- **Timezone associations**: Relevant timezones via `timezone.time_zones_for_number`
- **Validation flags**: Boolean indicators for valid and possible number status
- **Format variations**: International, mobile dialing, and E.164 standard formats
- **Line type classification**: Mobile, fixed-line, or other designations

The library processes data locally without external API calls beyond its internal dataset.

```python

# Choose option 3 (Phone Number Tracker) from the menu

# Provide a number in international format, e.g. +628123456789

phoneGW()    # defined in GhostTR.py, lines 80-119

```

### Social Media Username Presence

The **TrackLu()** function (lines 121-166 of [`GhostTR.py`](https://github.com/HunxByts/GhostTrack/blob/main/GhostTR.py)) performs username enumeration across **23 social media platforms** by checking profile URL availability.

GhostTrack queries platforms including Facebook, Twitter/X, Instagram, LinkedIn, GitHub, YouTube, and TikTok by substituting the supplied username into hard-coded URL templates and executing HTTP `GET` requests.

For each platform, the tool identifies:

- **Account existence**: HTTP status `200` responses indicating active profiles
- **Direct profile URLs**: Complete URLs where the username is detected

This allows rapid identification of platform presence without scraping profile content or personal data.

```python

# Choose option 4 (Username Tracker) from the menu

# Input a username, e.g. "alice"

TrackLu()    # defined in GhostTR.py, lines 121-166

```

### Local Public IP Identification

The **showIP()** function (lines 69-76 of [`GhostTR.py`](https://github.com/HunxByts/GhostTrack/blob/main/GhostTR.py)) identifies the public IP address of the machine running GhostTrack by querying `https://api.ipify.org/`.

This feature returns the user's current external IP address, useful for verifying VPN connections or network configurations during investigations.

```python

# Choose option 2 (Show Your IP) from the menu

showIP()     # defined in GhostTR.py, lines 69-76

```

## Technical Implementation and Data Flow

According to the HunxByts/GhostTrack source code, each data collection method follows a distinct architectural pattern:

- **IP tracking** relies on the `requests` library to fetch JSON from ipwho.is, parsing fields like `asn`, `isp`, `country`, and `flag` into a structured dictionary
- **Phone analysis** leverages the `phonenumbers` library's offline database, calling methods like `name_for_number()` and `description_for_number()` without network requests
- **Username enumeration** iterates through a hard-coded list of 23 URL templates, substituting usernames and checking HTTP status codes to confirm presence
- **Public IP detection** makes a simple GET request to api.ipify.org to retrieve the external address

## Data Privacy and Storage

GhostTrack operates as a privacy-respecting tool that **never stores collected data** on disk or transmits information to remote servers beyond the public APIs it queries. All API responses from ipwho.is, ipify.org, and social media platforms are processed in memory and displayed immediately in the console for user inspection. No forensic remnants of investigation targets remain on the system after execution.

## Summary

GhostTrack collects four categories of open-source intelligence:

- **IP Address Data**: Geolocation, ASN, ISP, timezone, and regional metadata via the ipwho.is API
- **Phone Number Data**: Carrier, location, timezone, validation status, and formatting via the phonenumbers library
- **Social Media Data**: Account presence indicators and URLs across 23 platforms via HTTP status checking
- **Network Identity**: Local public IP address via the ipify.org API

The tool retrieves only publicly available information through standard API calls and library functions, displaying results locally without persistent storage.

## Frequently Asked Questions

### Does GhostTrack store the data it collects?

No. According to the implementation in [`GhostTR.py`](https://github.com/HunxByts/GhostTrack/blob/main/GhostTR.py), GhostTrack does not write data to files or external databases. All API responses are processed in memory and displayed immediately in the console, ensuring no cache or log of your OSINT queries remains on the system.

### Which social media platforms does GhostTrack check?

The **TrackLu()** function checks 23 platforms including Facebook, Twitter/X, Instagram, LinkedIn, GitHub, YouTube, and TikTok. The complete list is hard-coded in the URL template array within [`GhostTR.py`](https://github.com/HunxByts/GhostTrack/blob/main/GhostTR.py) (lines 121-166), covering social networks, professional sites, and content platforms.

### Is GhostTrack legal to use for investigations?

GhostTrack queries only publicly available information through open APIs and standard HTTP requests. It retrieves the same data visible to any web browser visiting ipwho.is or viewing public social media profiles. Users must still comply with local laws regarding OSINT activities and respect platform terms of service.

### What are the system requirements to run GhostTrack?

GhostTrack requires Python 3 and the dependencies listed in [`requirements.txt`](https://github.com/HunxByts/GhostTrack/blob/main/requirements.txt), specifically the `requests` library for HTTP calls and the `phonenumbers` library for parsing telephone metadata. The tool functions on any system capable of executing Python and making outbound HTTPS connections to the referenced APIs.