IpHack: a thin Python wrapper for IP geolocation and subdomain lookup

The name promises more than the code delivers

IpHack is described in one line as a tracking tool for both IP location and tracking testing, and the repository description says it tracks location with live address and city in Termux. The topic list is where the marketing lives: allhackingtool, hacking, hacking-tool, ip-tracker, iphack, termux-hacking, termux-tool. The code itself is much narrower than that framing.

What the documentation actually describes is a Python package with a small set of lookups. Find the location information for an IP address, resolve a domain name, get the current machine's own address, list the subdomains of a domain, and list directories on a domain. There is no exploit, no credential handling, no scanning engine and no payload delivery described anywhere.

So who is it for? Two groups fit. The first is someone working from an Android phone with Termux who wants a one line lookup rather than a web page, which is the scenario the description and the termux-api topic point at. The second is a Python developer who wants subdomain enumeration and directory discovery in a script and does not want to assemble the HTTP and DNS plumbing by hand.

Judged as a tool, it is a convenience layer. Judged as a repository, it is thin in a way that matters, and the rest of this article is mostly about that.

Five calls and a JSON switch

The API surface is small enough to describe in one paragraph, and that is the point of the design. Everything is reached through a single `ip` object imported from the package.

from iphack import ip
ip.address("ip", output_json=False)

That call takes an IP address and returns location information, with an `output_json` flag that switches the return format. The package also has a call for your own address, which is the one the Termux framing is built around.

from iphack import ip
ip.my(output_json=False)

Domain resolution is a separate entry point that takes a hostname rather than an address.

from iphack import ip
ip.domain("google.com")

The last two calls are the reconnaissance-shaped ones. The first enumerates subdomains of a domain, and the second enumerates directories.

from iphack import ip
ip.subdomains("amazon.com")

from iphack import ip
ip.directory("amazon.com")

Underneath, the documentation says the package uses multiple APIs to retrieve information, and it claims two things as new features: that you can find out in which country the person is, and that you get a lot of detail information about the IP. Multiple providers is a sensible design choice for a geolocation service, because public IP databases disagree with each other and a lookup that hits more than one is more likely to return something. It is also a dependency on services this repository does not control, and the documentation does not say which providers are used, how they are weighted, or what happens when one of them is unreachable.

Installing with pip, and the install.sh sitting next to the README

The documented install path is pip.

pip install iphack

That is the whole instruction. The package is then imported as shown above. There is no configuration file, no API key to obtain and no environment variable to set, which is unusual for anything that calls network services, and it means the provider selection is baked into the package rather than chosen by the caller.

The repository layout adds a second, separate route. The top level of the repository holds only four entries: the LICENSE file, the README, a screenshot and a shell script called install.sh. The presence of install.sh next to a pip-installable package suggests the script exists for the Termux or shell workflow that the description and the topics point at, and the primary language of the repository is recorded as Shell.

That said, the README does not document what install.sh does, what it installs, or what it expects to be present on the device. The documentation section covers pip only, and the reference to documentation at the project page and the wiki is a link rather than an explanation. If you are installing on Termux, the honest summary is that the README's install section is not a complete guide for that path.

For a first real use, the sensible order is: install into a throwaway environment, call `ip.my(output_json=False)` to see the shape of the data for your own connection, and only then point it at other addresses. That way you learn the output format without involving anyone else.

The subdomain and directory calls need a different permission than the rest

It is worth separating the two halves of this package, because they carry different levels of risk and the repository presents them in the same list.

The IP and domain lookups are passive. You ask a public service about an address and it tells you what its database holds. The person behind the address has not been contacted, and the answer is about a network, not a person.

The subdomain and directory calls are active requests against someone else's server. The README's own examples point them at amazon.com, and the second one is described in the documentation as checking directories on that site. A directory listing is a request pattern that many site owners would object to if it came from an unexpected client, and a sustained enumeration from a single IP is exactly the kind of traffic that gets an address blocked or reported.

This is not a reason to refuse the tool, but it is a reason to use it deliberately. Scope it to systems you are authorised to assess, keep the volume low, and remember that a subdomain list is only useful against a host you already have permission to test. The README does not document any rate limiting, request throttling, robots handling, or a user agent policy, so if you need those behaviours, check the implementation before you rely on them.

The same caution applies to the location side. An IP address is frequently shared, and a result pointing to a city identifies a network exit, not a person. Treating the city and address fields as if they identify an individual is the fastest way to be wrong in a way that matters.

A repository with a README, a licence, a screenshot and a script

The repository contents are the reason to be careful here. The top level holds the LICENSE file, the README, an image file named Screenshot_2022-08-13_21-33-49.png, and install.sh. There is no package directory, no source tree, no test directory and no CI configuration in that listing.

The screenshot file name carries a date of August 2022, and the README badges reference 2022 as well. The README also states in Russian that no responsibility is accepted for your actions and that downloading the software means agreeing to the licence.

So the code you would install with `pip install iphack` comes from a published package rather than from this repository, and the repository is documentation for it. That is a real distinction for anyone doing due diligence: reviewing the README is not the same as reviewing the source of the thing that runs on your machine.

The recent release history is also empty. The repository has no GitHub releases, so there is no tagged version history to audit and no changelog to consult. Version tracking happens on the package index, and the README does not document a mapping between the package version and the repository state.

The picture that emerges is of a small utility maintained alongside a much larger collection of similar scripts, with the README pointing readers to a list of other projects by the same author, including a tool described as finding website IPs behind Cloudflare, an OSINT tool for finding profiles by username, and a distributed denial of service tool. Those links say more about the ecosystem this repository sits in than about IpHack itself, and the DDoS reference in particular is a reason to keep any association with the collection at arm's length.

Licence, upkeep, and the questions to answer first

The licence field on the repository says Apache-2.0, and the README links to the licence file for the full terms. Apache-2.0 is a permissive licence with an explicit patent grant, and reading it is straightforward; how it interacts with your own use is a question for whoever handles licence review at your organisation, not something this article can answer.

On upkeep, the repository is not archived and the last push was on 2026-09-10, which puts the most recent change a little over a month before this writing. There are no GitHub releases, so there is no versioned upgrade path to follow. For a pip-installed dependency, the upgrade cost is a matter of watching the package index, and the cost of an unwanted upgrade landing between two runs of your script is real, which is the practical argument for pinning the version in any project that depends on it.

Four things are worth verifying before this goes into anything you care about. First, which upstream APIs the package calls, since the documentation does not name them and they are the source of both the data and the failure modes. Second, what the package does with the IP address you pass in, given that a lookup is a disclosure to a third party. Third, whether the subdomains and directory calls honour rate limits, which the documentation does not mention. Fourth, whether the pip package you install matches the code you expect, given the repository listing above.

If any of those four checks comes back badly, the fallback is straightforward: a public IP lookup service in the browser and a DNS query in a shell do the same work for the passive half, without a dependency, without a third party wrapper, and without an unreviewed Python package in your environment.

Editorial conclusion

Adopt IpHack only if you want a small Python convenience layer over public IP and DNS lookups and can accept that the project is thinly specified, that the accuracy of the location data is someone else's to guarantee, and that the repository itself contains almost no source. Do not treat it as a security tool or as a way to find out where another person is, since a shared IP says little about the person using it. Before installing, run `pip install iphack` in a throwaway environment and check the four calls you actually need against the output the upstream APIs return, because the README documents the function names and not their behaviour.

Frequently asked questions

Official sources

1. Issues
2. License: Apache-2.0
3. mishakorzik/IpHack on GitHub
4. README