DomainTools Iris Investigation Platform

Iris is a proprietary threat intelligence and investigation platform that combines enterprise-grade domain intelligence and risk scoring with passive DNS data from Farsight Security and other top-tier providers. An intuitive web interface and API atop these data sources help security teams quickly and efficiently investigate potential cybercrime and cyberespionage. Key Benefits

• Comprehensive Data Sources
• Investigation Workflow Management
• Infrastructure Risk Assessment

Features: Domain Risk Score Identify dangerous infrastructure with Domain Risk Score

• Quickly assess whether to allow, conditionally allow, or deny various types of connections.
• Know whether a domain is going to cause harm the moment it's registered.
• Gain visibility into what type of risk the domain represents.

DNS History Look back in time for more information about domains, registrants, and infrastructure

• Mine 10+ years of Whois records to find connections that may not be apparent in current records.
• See historical as well as current infrastructure associated with a domain, with access to extensive passive DNS records.
• Track the evolution of threat actor campaigns via the domains and IP addresses they have used.

SSL Profiles SSL and TLS certificates are one of the most useful datasets for profiling and connecting domains

• Analyze the contents of the certificate to assess trustworthiness or risk level of the domain hosting the certificate.
• Find other domains that share the same certificate.
• Pivot to other domains shown in the Subject Alternative Name section.