GitHub - rix4uni/originiphunter: A powerful Go tool for finding origin IPs of domains by querying multiple security APIs and validating results with built-in HTTP client.

OriginipHunter

A powerful Go tool for finding origin IPs of domains by querying multiple security APIs and validating results with built-in HTTP client.

Supported Search Engines

Engine	Status	Methods
Shodan	✅ Active	Favicon hash, Title, SSL certificate
Hunter	✅ Active	Favicon hash, Title, Certificate
SecurityTrails	✅ Active	DNS history
ViewDNS	✅ Active	IP history
Censys	🚧 Coming Soon	-
FOFA	🚧 Coming Soon	-

Installation

Install via Go

go install github.com/rix4uni/originiphunter@latest

Download Prebuilt Binaries

wget https://github.com/rix4uni/originiphunter/releases/download/v0.0.5/originiphunter-linux-amd64-0.0.5.tgz
tar -xvzf originiphunter-linux-amd64-0.0.5.tgz
rm -rf originiphunter-linux-amd64-0.0.5.tgz
mv originiphunter ~/go/bin/originiphunter

Or download the latest release for your platform.

Compile from Source

git clone --depth 1 https://github.com/rix4uni/originiphunter.git
cd originiphunter; go install

Note: You can add multiple Free API keys per service for load balancing and rate limit management.

Get `Free` API Keys

SecurityTrails: https://securitytrails.com/
Shodan: https://www.shodan.io/
ViewDNS: https://viewdns.info/
Hunter: https://hunter.how/

Configuration

Default Config Location

The tool uses ~/.config/originiphunter/config.yaml by default.

Create Config File

Create config directory:

mkdir -p ~/.config/originiphunter

Create config.yaml:

securitytrails:
  - YOUR_SECURITYTRAILS_API_KEY_1
  - YOUR_SECURITYTRAILS_API_KEY_2
shodan:
  - YOUR_SHODAN_API_KEY_1
  - YOUR_SHODAN_API_KEY_2
viewdns:
  - YOUR_VIEWDNS_API_KEY_1
  - YOUR_VIEWDNS_API_KEY_2
hunter:
  - YOUR_HUNTER_API_KEY_1
  - YOUR_HUNTER_API_KEY_2
censys: []
fofa: []

Usage

Usage of originiphunter:
      --config string         Custom config file path (default: ~/.config/originiphunter/config.yaml)
      --concurrent int        Number of concurrent IP validations (default: 50)
  -C, --content-length        Match content length in Origin IPs Found section
      --engine strings        Specific search engines to use (comma-separated). Available: shodan,securitytrails,viewdns,hunter,censys,fofa
  -H, --useragent string      HTTP User-Agent header (default: Mozilla/5.0 Chrome/141.0.0.0)
      --json                  Output results in JSON format
  -p, --parallel              Run search engines in parallel for faster execution
      --silent                Silent mode.
  -S, --status-code           Match status code in Origin IPs Found section
      --verbose               Show detailed information about the scanning process
      --version               Print the version of the tool and exit.

Basic Usage

Process a single domain:

echo "example.com" | originiphunter

Process multiple domains:

cat domains.txt | originiphunter

Command Line Options

Flag	Shorthand	Description
`--engine`	-	Specify which search engines to use (comma-separated: shodan,securitytrails,viewdns,hunter,censys,fofa)
`--config`	-	Use a custom config file path
`--verbose`	-	Show detailed information about the scanning process
`--useragent`	`-H`	HTTP User-Agent header (default: Mozilla/5.0 Chrome/141.0.0.0)
`--silent`	-	Silent mode (no banner)
`--version`	-	Print version and exit
`--json`	-	Output results in JSON format
`--parallel`	`-p`	Run search engines in parallel for faster execution
`--concurrent`	-	Number of concurrent IP validations (default: 50)
`--content-length`	`-C`	Match content length in Origin IPs Found section
`--status-code`	`-S`	Match status code in Origin IPs Found section

Examples

# Use all configured engines (default)
echo "example.com" | originiphunter

# Use specific engines only
echo "example.com" | originiphunter --engine shodan,hunter

# Enable verbose mode for detailed output
echo "example.com" | originiphunter --verbose

# Use custom config file
echo "example.com" | originiphunter --config /path/to/config.yaml

# Custom User-Agent
echo "example.com" | originiphunter -H "MyBot/1.0"

# Process multiple domains silently
cat domains.txt | originiphunter --silent

# Output results in JSON format
echo "example.com" | originiphunter --json

# Run search engines in parallel for faster execution
echo "example.com" | originiphunter --parallel

# Adjust concurrent IP validation limit
echo "example.com" | originiphunter --concurrent 100

# Match content length and status code in Origin IPs
echo "example.com" | originiphunter --content-length --status-code

# Combine multiple flags
echo "example.com" | originiphunter --parallel --json --concurrent 100 --silent

# Show version
originiphunter --version

Features

Performance Optimizations

Parallel Engine Execution: Use --parallel flag to run multiple search engines concurrently, significantly speeding up the discovery process
Concurrent IP Validation: By default, validates 50 IPs concurrently. Adjust with --concurrent flag to balance speed and resource usage

Filtering Options

Content Length Matching: Use --content-length flag to show only IPs that match the original domain's content length
Status Code Matching: Use --status-code flag to show only IPs that match the original domain's status code
Both flags work together with title matching (all criteria must match when both flags are set)

Output Formats

Colored Text Output: Default human-readable format with color-coded status codes
JSON Output: Use --json flag for structured JSON output, perfect for automation and scripting

Output

Example Output

                _         _         _         __                   __
  ____   _____ (_)____ _ (_)____   (_)____   / /_   __  __ ____   / /_ ___   _____
 / __ \ / ___// // __  // // __ \ / // __ \ / __ \ / / / // __ \ / __// _ \ / ___/
/ /_/ // /   / // /_/ // // / / // // /_/ // / / // /_/ // / / // /_ /  __// /
\____//_/   /_/ \__, //_//_/ /_//_// .___//_/ /_/ \__,_//_/ /_/ \__/ \___//_/
               /____/             /_/

                     Current originiphunter version v0.0.5

Processing: aiaqa.visa.com
https://aiaqa.visa.com [200] [12746] [Visa - Public Key Infrastructure]

Origin IPs Found:
http://198.241.171.81 [200] [12746] [Visa - Public Key Infrastructure]
http://198.241.169.249 [200] [12746] [Visa - Public Key Infrastructure]

Other IPs:
http://104.18.157.147 [403] [16]
http://104.18.158.147 [403] [16]
http://3.7.198.7 [301] [134] [301 Moved Permanently]
http://31.210.5.60 [Failed]

Verbose Output Example

Processing: aiaqa.visa.com
https://aiaqa.visa.com [200] [12746] [Visa - Public Key Infrastructure]
Shodan favicon hash: 708578229
Hunter favicon hash: f3418a443e7d841097c714d69ec4bcb8
Page title: Visa - Public Key Infrastructure

Searching Shodan favicon: https://api.shodan.io/shodan/host/search?key=YOUR_APIKEY&query=http.favicon.hash:"708578229"
Shodan favicon search found 2 IPs
Searching Shodan title: https://api.shodan.io/shodan/host/search?key=YOUR_APIKEY&query=http.title:"Visa - Public Key Infrastructure"
Shodan title search found 4 IPs
Searching Shodan SSL: https://api.shodan.io/shodan/host/search?key=YOUR_APIKEY&query=ssl:"aiaqa.visa.com"
Shodan SSL search found 32 IPs
Shodan total unique IPs: 17

For Browser - Hunter favicon: favicon_hash=="f3418a443e7d841097c714d69ec4bcb8"
Searching Hunter favicon: https://api.hunter.how/search?api-key=YOUR_APIKEY&query=ZmF2aWNvbl9oYXNoPT0iZjM0MThhNDQzZTdkODQxMDk3YzcxNGQ2OWVjNGJjYjgi...
Hunter favicon search found 10 IPs
Hunter total unique IPs: 4

Total unique IPs: 21

Origin IPs Found:
http://198.241.171.81 [200] [12746] [Visa - Public Key Infrastructure]
http://198.241.169.249 [200] [12746] [Visa - Public Key Infrastructure]

Other IPs:
http://104.18.157.147 [403] [16]
...

JSON Output Example

{
  "domain": "example.com",
  "origin_domain": {
    "URL": "https://example.com",
    "StatusCode": 200,
    "ContentLength": 12345,
    "Title": "Example Domain"
  },
  "origin_ips": [
    {
      "URL": "http://1.2.3.4",
      "StatusCode": 200,
      "ContentLength": 12345,
      "Title": "Example Domain"
    }
  ],
  "other_ips": [
    {
      "URL": "http://5.6.7.8",
      "StatusCode": 200,
      "ContentLength": 67890,
      "Title": "Other Site"
    }
  ]
}

Filtering with Content Length and Status Code

# Show only IPs matching both content length and status code
echo "example.com" | originiphunter --content-length --status-code

# Show only IPs matching content length (title matching still required)
echo "example.com" | originiphunter --content-length

# Show only IPs matching status code (title matching still required)
echo "example.com" | originiphunter --status-code

# Recommended
cat subs.subs | httpx -duc -silent -mc 200 -cdn -server -td | grep -iE "Akamai|Cloudflare" | awk '{print $1}' | originiphunter --silent --content-length --json | jq -r '.origin_ips[]?.URL // empty'

Name		Name	Last commit message	Last commit date
Latest commit History 15 Commits
.github		.github
banner		banner
README.md		README.md
config.example.yaml		config.example.yaml
go.mod		go.mod
go.sum		go.sum
originiphunter.go		originiphunter.go

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Repository files navigation

OriginipHunter

Supported Search Engines

Installation

Install via Go

Download Prebuilt Binaries

Compile from Source

Get `Free` API Keys

Configuration

Default Config Location

Create Config File

Usage

Basic Usage

Command Line Options

Examples

Features

Performance Optimizations

Filtering Options

Output Formats

Output

Example Output

Verbose Output Example

JSON Output Example

Filtering with Content Length and Status Code

About

Uh oh!

Releases 5

Packages

Languages

rix4uni/originiphunter

Folders and files

Latest commit

History

Repository files navigation

OriginipHunter

Supported Search Engines

Installation

Install via Go

Download Prebuilt Binaries

Compile from Source

Get Free API Keys

Configuration

Default Config Location

Create Config File

Usage

Basic Usage

Command Line Options

Examples

Features

Performance Optimizations

Filtering Options

Output Formats

Output

Example Output

Verbose Output Example

JSON Output Example

Filtering with Content Length and Status Code

About

Topics

Resources

Uh oh!

Stars

Watchers

Forks

Releases 5

Packages 0

Languages

Get `Free` API Keys

Packages