Goreport: All reports the location is coming as unknown

General Support
, , , ,
1

Goreport: All reports the location is coming as unknown

This issue was originally posted here: https://github.com/chrismaddalena/Goreport/issues/35

Goreport is a Python script to collect campaign data from Gophish and generate a report.

:link: https://github.com/chrismaddalena/Goreport

Goreport uses IPinfo.io as its primary IP geolocation service. And they require an API key for the location information. You must add the API key in the Gophish.config file.

If the IPinfo API is not correctly configured, users will get a location unknown error. Like this:

location unknown error goreport gophish
location unknown error goreport gophish2000×3436 247 KB

-supportbot

2 Likes
2

You must configure your gophish.config correctly and add your IPinfo token there.

  1. Signup for a free account: Sign up - IPinfo.io
  2. You get 50k requests/month. You can sign up for the next Basic tier and get 150k requests per month and $20 per extra 10k requests.
  3. Then get your access token from: Log in to your account - IPinfo.io
  4. Modify the gophish.config config file:
[ipinfo.io]
ipinfo_token: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Then run the script.

kpomeroy1979 on GitHub writes in the issue:

The location comes up as unknown because you have not set up the ipinfo OR google geolocate APIs which are used to get the geo-location for the IP addresses. Check your gophish.config file in your goreport directory

# more gophish.config

[Gophish]
gp_host: https://xxxxxxxxxxxxxx.com:65333
api_key: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

[[ipinfo.io](http://ipinfo.io)]
ipinfo_token: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

[Google]
eolocate_key: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Additional Information

Gophish performs it’s own geolocation lookups with IP addresses and returns latitude and longitude. This works alright, but may fail and return coordinates of 0,0 or may return old information.

Goreport has two options that might be used to improve location results. The first, and recommended option, is the ipinfo.io API. API access is free as long as you make less than 1,000 queries per 24 hour period. That should not be too difficult for a phishing campaign.

If an ipinfo.io API key is added to the config file Goreport will automatically use ipinfo.io to gather current geolocation in formation for each unique IP address.

1 Like