Install wtfis with Homebrew, Nix

Project links

• Homepage
• Upstream docs
• Package manager page

Commands and aliases

• wtfis

Project history

The author introduced wtfis publicly in a 2022-08-13 blog post, explaining that it was written to replace repeated manual website lookups for FQDN and domain information with one terminal command. The README keeps the same design framing: the tool is for non-robots, organized into readable panels, and named as a play on `whois`.

The earliest PyPI release with files is version 0.0.3 on 2022-08-12, one day before the author's announcement post. By 2026-04-06, PyPI listed 0.15.0 as the current release, showing that the project continued beyond the initial personal utility into a maintained OSINT CLI.

Adoption history

wtfis was adopted in the security-tooling niche because it wraps several common reputation and enrichment services behind one readable terminal output. The README documents VirusTotal, AbuseIPDB, GreyNoise, IP2Location, IP2Whois, IPinfo, IPWhois, Shodan, and URLhaus, with many optional so users can stay within quotas or add richer context when they have keys.

A Hacker News submission in May 2025 described it as a passive hostname, domain, and IP lookup tool for non-robots and drew visible discussion, which is a useful secondary signal that the project had moved beyond the author's personal workflow into the broader security-operations audience.

How it is used

The basic workflow is `wtfis FQDN_OR_DOMAIN_OR_IP`, with optional flags to enable all enrichments or specific services such as Shodan, GreyNoise, AbuseIPDB, and URLhaus. It accepts defanged input, can limit displayed resolutions, can turn off color, and can present one-column output for terminals where layout matters.

Credentials are optional and are loaded from environment variables or `~/.env.wtfis`. That design matches its free-tier posture: useful defaults work without every service configured, while analysts can add API keys for more complete enrichment.

Why package nerds care

wtfis is significant as a compact example of modern security CLI ergonomics: it does not try to be a full SIEM or threat-intelligence platform, but it packages the first few minutes of domain/IP triage into a readable terminal command.

Timeline

• 2022-08-12: Earliest PyPI file-backed release, 0.0.3.
• 2022-08-13: The author announced wtfis as a passive FQDN and domain lookup tool.
• 2023: The README documented GreyNoise support as quota-sensitive and off by default.
• 2025-05-12: wtfis appeared on Hacker News as a passive lookup tool for non-robots.
• 2026-04-06: PyPI listed release 0.15.0.

Related projects

• wtfis aggregates data from VirusTotal, AbuseIPDB, GreyNoise, IP2Location, IP2Whois, IPinfo, IPWhois, Shodan, and URLhaus.
• The author describes the project name as a play on the traditional `whois` command.

Sources

• https://github.com/pirxthepilot/wtfis#readme
• https://news.ycombinator.com/item?id=43967962
• https://pirx.io/posts/2022-08-13-wtfis-passive-fqdn-and-domain-lookup-tool/
• https://pypi.org/pypi/wtfis/json