#analysis #ip #cli #security #domain

bin+lib goran

Goran is a CLI tool for analyzing domains and IP addresses

7 releases

new 0.1.6 May 1, 2025
0.1.5 May 1, 2025

#993 in Network programming

Download history

121 downloads per month

Custom license

63KB
1.5K SLoC

Goran - Domain & IP Analysis CLI

image

Goran is a Rust-based command-line tool designed to gather detailed information about domain names and IP addresses. It integrates several data sources such as WHOIS, Geolocation, DNS, SSL certificates, and VirusTotal reputation checks. Goran uniquely utilizes a Gemini to generate concise, readable reports and analyses.

image

Features

  • Geolocation: Retrieve geographic and ISP data.
  • WHOIS & RDAP: Detailed domain registration data.
  • DNS Lookup: Information about DNS records (A, AAAA, MX, NS).
  • SSL Check: Certificate issuer, validity dates, and DNS names.
  • VirusTotal: Security analysis and reputation scoring.
  • LLM Analysis: AI-generated concise report summarizing findings and providing a verdict.

Why Use Goran?

Unlike traditional WHOIS queries, Goran:

  • Integrates multiple data sources into a single, comprehensive report.
  • Enhances readability with colored output and clear summaries.
  • Utilizes AI (Gemini) to interpret and succinctly analyze results, providing meaningful insights.

Installation

brew tap beowolx/goran
brew install goran

Using Cargo

Make sure you have Rust installed, then run:

cargo install goran

Usage

goran example.com

CLI Flags Explained

Flag Description
--vt Enable VirusTotal reputation checks (requires API key).
--vt-api-key Provide VirusTotal API key directly via CLI.
--json Output results in JSON format.
--no-whois Skip WHOIS lookup step.
--no-dns Skip DNS lookup step.
--no-ssl Skip SSL certificate checks.
--llm-report Generate an AI-based narrative report (requires Gemini API).
--llm-api-key Provide Gemini API key directly via CLI.
--save-keys Persist provided API keys in local config.
--config-show Display current merged configuration settings.

Obtaining API Keys

  • Gemini API Key:

  • VirusTotal API Key:

    • Register at VirusTotal.
    • Obtain your free API key from the settings panel.

Using VirusTotal

Goran uses VirusTotal to check the reputation of the domain and IP address. VirusTotal is a cloud-based antivirus engine for detecting malicious software but it can also be used to check the reputation of a domain or IP address.

To use VirusTotal, run:

goran example.com --vt --vt-api-key <VT_API_KEY>

image

Generating Gemini Analysis

Goran uses gemini-2.0-flash to generate an AI-powered report. The goal is to provide a concise and readable report that is easy to understand.

To generate an AI-powered report, run:

goran example.com --llm-report --llm-api-key <GEMINI_API_KEY>

image

Saving API Keys

To avoid having to provide your API keys every time you run Goran, you can save them in the config file.

goran example.com --vt --vt-api-key <VT_API_KEY> --llm-report --llm-api-key <GEMINI_API_KEY> --save-keys

Subsequent executions will use these saved keys automatically.

To list the current saved keys, run:

goran --config-show

Configuration File

Configuration settings and saved keys are stored here:

  • Linux: ~/.config/rs.goran/default-config.toml
  • macOS: ~/Library/Application Support/rs.goran/default-config.toml
  • Windows: %APPDATA%\rs.goran\default-config.toml

Contributions

Feel free to open issues and submit pull requests on GitHub.

License

Distributed under the MIT License. See LICENSE for details.

Dependencies

~39–78MB
~1.5M SLoC