Automated digital reconnaissance
Switch branches/tags
Nothing to show
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Failed to load latest commit information.


Automated basic digital reconnaissance. Great for getting an initial footprint of your targets and discovering additional subdomains. InstaRecon will do:

  • DNS lookups (A, PTR, MX, NS)
  • DNS lookups recursively on all hosts discovered
  • Whois (on domain and IP) lookups
  • Google dorks looking for subdomains and URLs
  • Shodan lookups
  • Reverse DNS lookups on entire CIDRs (only if target is a network)

...all printed nicely on your console or csv file.

InstaRecon will never scan a target directly. Information is retrieved from DNS/Whois servers, Google, and Shodan.


To install simply do:

./ install

Dependencies should be automatically installed. Then go: <target>

Tested on Ubuntu 14.04 and Kali-Rolling (2016.1).


  • Shodan robots.txt
  • Improve output files - use xlsx instead of csv, as width can be controlled.
  • Improve Google crawler performance, implement random headers and user-agents.
  • Scan threading.
  • LinkedIn page scraping. Possibly other sources?
  • Pip installable? (
  • Allow proxy settings to be set.


$ -v -s <shodan_key> -o ~/ 
# InstaRecon v0.1.2 - by Luis Teixeira (
# Scanning 1/1 hosts
# Shodan key provided - <shodan_key>

# ____________________ Scanning ____________________ #

# DNS lookups
[*] Domain:

[*] IPs & reverse DNS: -

[*] NS records: - - - -

[*] MX records: - - - - -

# Whois lookups

[*] Whois domain:
Domain Name:
Registry Domain ID: 1264983250_DOMAIN_COM-VRSN
Registrar WHOIS Server:
Registrar URL:
Updated Date: 2015-01-08T04:00:18-0800
Creation Date: 2007-10-09T11:20:50-0700
Registrar Registration Expiration Date: 2020-10-09T11:20:50-0700
Registrar: MarkMonitor, Inc.
Registrar IANA ID: 292
Registrar Abuse Contact Email:
Registrar Abuse Contact Phone: +1.2083895740
Domain Status: clientUpdateProhibited (
Domain Status: clientTransferProhibited (
Domain Status: clientDeleteProhibited (
Registry Registrant ID: 
Registrant Name: GitHub Hostmaster
Registrant Organization: GitHub, Inc.
Registrant Street: 88 Colin P Kelly Jr St, 
Registrant City: San Francisco
Registrant State/Province: CA
Registrant Postal Code: 94107
Registrant Country: US
Registrant Phone: +1.4157354488
Registrant Phone Ext: 
Registrant Fax: 
Registrant Fax Ext: 
Registrant Email:
Registry Admin ID: 
Admin Name: GitHub Hostmaster
Admin Organization: GitHub, Inc.
Admin Street: 88 Colin P Kelly Jr St, 
Admin City: San Francisco
Admin State/Province: CA
Admin Postal Code: 94107
Admin Country: US
Admin Phone: +1.4157354488
Admin Phone Ext: 
Admin Fax: 
Admin Fax Ext: 
Admin Email:
Registry Tech ID: 
Tech Name: GitHub Hostmaster
Tech Organization: GitHub, Inc.
Tech Street: 88 Colin P Kelly Jr St, 
Tech City: San Francisco
Tech State/Province: CA
Tech Postal Code: 94107
Tech Country: US
Tech Phone: +1.4157354488
Tech Phone Ext: 
Tech Fax: 
Tech Fax Ext: 
Tech Email:
Name Server:
Name Server:
Name Server:
Name Server:
DNSSEC: unsigned
URL of the ICANN WHOIS Data Problem Reporting System:
>>> Last update of WHOIS database: 2015-06-17T19:49:18-0700

[*] Whois IP for
asn: 36459
asn_country_code: US
asn_date: 2012-11-15
asn_registry: arin
net 0:
    range: -
    name: GITHUB-NET4-1
    description: GitHub, Inc.
    handle: NET-192-30-252-0-1
    address: 88 Colin P Kelly Jr Street
    city: San Francisco
    state: CA
    postal_code: 94107
    country: US
    created: 2012-11-15 00:00:00
    updated: 2013-01-05 00:00:00

# Querying Shodan for open ports
[*] Shodan:
Organization: GitHub
ISP: GitHub

Port: 80
Banner: HTTP/1.1 301 Moved Permanently
    Content-length: 0
    Connection: close
Port: 22
Banner: SSH-2.0-libssh-0.6.0
    Key type: ssh-rsa
    Fingerprint: 16:27:ac:a5:76:28:2d:36:63:1b:56:4d:eb:df:a6:48

# Querying Google for subdomains and Linkedin pages, this might take a while
[*] Possible LinkedIn page:
[*] Subdomains: - - - - - - - - - -

# Saving output csv file
# Done