What Kind of Data Does GhostTrack Collect? Complete OSINT Analysis

GhostTrack collects publicly available IP geolocation details, phone number carrier metadata, social media presence indicators across 23 platforms, and local public IP addresses using open-source intelligence APIs.

GhostTrack is a Python-based OSINT utility developed by HunxByts that aggregates publicly accessible information from internet sources without persistent storage. The tool queries external APIs and performs HTTP requests to gather target intelligence, displaying all results locally in the console.

Types of Data Collected by GhostTrack

IP Address Geolocation and Network Intelligence

The IP_Track() function in GhostTR.py (lines 45-77) retrieves comprehensive network and location data by calling the free ipwho.is API (http://ipwho.is/<IP>).

When analyzing a target IP address, GhostTrack extracts:

• Network details: IP type (IPv4/IPv6), ASN, ISP name, organization, and domain
• Geographic coordinates: Country, city, region, continent, latitude/longitude, postal code, and capital city
• Timezone information: Timezone ID, UTC offset, DST status, and current local time
• Regional metadata: Calling code, country borders, flag emoji, and EU membership status

The implementation parses the JSON response from ipwho.is and renders these fields in a formatted console table.

# Inside the interactive menu, choose option 1 (IP Tracker)

# Then enter the target IP address when prompted.

# Example call:

IP_Track()   # see implementation in GhostTR.py, lines 45-77

Phone Number Metadata and Validation

For telephone number investigation, the phoneGW() function (lines 80-119 of GhostTR.py) utilizes the phonenumbers library to parse and validate international numbers.

This module collects:

• Regional identifiers: ISO-3166 region codes and country calling codes
• Carrier information: Service provider name via carrier.name_for_number
• Geolocation: City and region descriptions via geocoder.description_for_number
• Timezone associations: Relevant timezones via timezone.time_zones_for_number
• Validation flags: Boolean indicators for valid and possible number status
• Format variations: International, mobile dialing, and E.164 standard formats
• Line type classification: Mobile, fixed-line, or other designations

The library processes data locally without external API calls beyond its internal dataset.

# Choose option 3 (Phone Number Tracker) from the menu

# Provide a number in international format, e.g. +628123456789

phoneGW()    # defined in GhostTR.py, lines 80-119

Social Media Username Presence

The TrackLu() function (lines 121-166 of GhostTR.py) performs username enumeration across 23 social media platforms by checking profile URL availability.

GhostTrack queries platforms including Facebook, Twitter/X, Instagram, LinkedIn, GitHub, YouTube, and TikTok by substituting the supplied username into hard-coded URL templates and executing HTTP GET requests.

For each platform, the tool identifies:

• Account existence: HTTP status 200 responses indicating active profiles
• Direct profile URLs: Complete URLs where the username is detected

This allows rapid identification of platform presence without scraping profile content or personal data.

# Choose option 4 (Username Tracker) from the menu

# Input a username, e.g. "alice"

TrackLu()    # defined in GhostTR.py, lines 121-166

Local Public IP Identification

The showIP() function (lines 69-76 of GhostTR.py) identifies the public IP address of the machine running GhostTrack by querying https://api.ipify.org/.

This feature returns the user's current external IP address, useful for verifying VPN connections or network configurations during investigations.

# Choose option 2 (Show Your IP) from the menu

showIP()     # defined in GhostTR.py, lines 69-76

Technical Implementation and Data Flow

According to the HunxByts/GhostTrack source code, each data collection method follows a distinct architectural pattern:

• IP tracking relies on the requests library to fetch JSON from ipwho.is, parsing fields like asn, isp, country, and flag into a structured dictionary
• Phone analysis leverages the phonenumbers library's offline database, calling methods like name_for_number() and description_for_number() without network requests
• Username enumeration iterates through a hard-coded list of 23 URL templates, substituting usernames and checking HTTP status codes to confirm presence
• Public IP detection makes a simple GET request to api.ipify.org to retrieve the external address

Data Privacy and Storage

GhostTrack operates as a privacy-respecting tool that never stores collected data on disk or transmits information to remote servers beyond the public APIs it queries. All API responses from ipwho.is, ipify.org, and social media platforms are processed in memory and displayed immediately in the console for user inspection. No forensic remnants of investigation targets remain on the system after execution.

Summary

GhostTrack collects four categories of open-source intelligence:

• IP Address Data: Geolocation, ASN, ISP, timezone, and regional metadata via the ipwho.is API
• Phone Number Data: Carrier, location, timezone, validation status, and formatting via the phonenumbers library
• Social Media Data: Account presence indicators and URLs across 23 platforms via HTTP status checking
• Network Identity: Local public IP address via the ipify.org API

The tool retrieves only publicly available information through standard API calls and library functions, displaying results locally without persistent storage.

Frequently Asked Questions

Does GhostTrack store the data it collects?

No. According to the implementation in GhostTR.py, GhostTrack does not write data to files or external databases. All API responses are processed in memory and displayed immediately in the console, ensuring no cache or log of your OSINT queries remains on the system.

Which social media platforms does GhostTrack check?

The TrackLu() function checks 23 platforms including Facebook, Twitter/X, Instagram, LinkedIn, GitHub, YouTube, and TikTok. The complete list is hard-coded in the URL template array within GhostTR.py (lines 121-166), covering social networks, professional sites, and content platforms.

Is GhostTrack legal to use for investigations?

GhostTrack queries only publicly available information through open APIs and standard HTTP requests. It retrieves the same data visible to any web browser visiting ipwho.is or viewing public social media profiles. Users must still comply with local laws regarding OSINT activities and respect platform terms of service.

What are the system requirements to run GhostTrack?

GhostTrack requires Python 3 and the dependencies listed in requirements.txt, specifically the requests library for HTTP calls and the phonenumbers library for parsing telephone metadata. The tool functions on any system capable of executing Python and making outbound HTTPS connections to the referenced APIs.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}