01 · Product name
DomainTools
DNS intelligence that now opens as a demo page.
Published by DomainTools.
In short
DomainTools is the DNS intelligence product whose old Iris Investigate path no longer stays on that name. On 19 Oct 2026 https://www.domaintools.com/products/iris-investigate redirected to https://www.domaintools.com/platform. The word Iris was not in the page text. The page says to leverage 20 years of Internet intelligence, and the action on it is Request a Demo. It describes historic Whois and RDAP records, a domain risk score, and over a decade of historic DNS resolution data. No dollar, euro, or pound amount was printed. This listing did not receive a demo.
Product pricing strategy
02
Premium
The platform page that loaded on 19 Oct 2026 did not print a dollar, euro, or pound price. The public action is Request a Demo. There was no seat count, no credit pack, and no monthly figure in the text this listing extracted. The phrases 20 years of Internet intelligence and over a decade of historic DNS resolution data are scope claims on that page. They are not a rate. This listing did not complete the demo form and did not receive a quote. A quote you receive later should name the modules, the historic depth, and the user count. Until it does, write demo and the date. Do not borrow a SecurityTrails or Shodan price for this page. The Iris Investigate path redirected. Absence of the word Iris is not a price either.
Utility and features
03
The URL practitioners still pass around for Iris Investigate, with or without a trailing slash, landed on the DomainTools platform page. Chrome and a scripted request both ended at https://www.domaintools.com/platform with HTTP 200. A search of that page's text found the word Investigate inside ordinary sentences about investigations. It did not find the word Iris. The headline line was Cyber Resilience Starts With DNS, followed by leverage 20 years of Internet intelligence. The page then lists five steps, from a malicious domain being detected through rules and monitoring. Those steps are the page's marketing sequence. They are not a case this listing ran.
- The Iris path redirects. On 19 Oct 2026 /products/iris-investigate ended at /platform. The loaded text did not contain the word Iris.
- The action is a demo. The page says Request a Demo. No currency amount was printed next to 20 years or over a decade.
- No profile was opened. Historic Whois, RDAP, and a risk score are described. None of them was retrieved for a domain in this review.
The capabilities block says an analyst can access domain profiles, trace past activity with historic Whois and RDAP records, and view a domain's risk score. It also says the service has over a decade of historic DNS resolution data and can show pivots across domains, IP addresses, and name servers. The phrase over a decade, and the phrase 20 years, are the page's. They were not audited against a database export. The only call to action in the text extracted here was Request a Demo, plus a public-sector link and a theme toggle. No currency amount appeared. A demo wall is not a workspace, so no domain profile is filed. SecurityTrails and other DNS products remain separate listings. Do not paste their prices here.
- 1
Cite the platform URL that loads, and mention the Iris path only as the redirect you checked.
- 2
Ask for a quote that names modules and history, and do not invent a number from the marketing steps.
- 3
When a workspace later returns a record, open the Whois or DNS row it cites.
Caveats
04
The product name on the page that loaded is DomainTools, on the platform URL. Iris Investigate is the path that redirected. If a contract still says Iris, ask the quote whether that name is the platform page you can open today. Do not tell a reader the path 404s. It returned the platform page.
The five steps are a story about an analyst. This listing did not look up a domain inside the product and does not have a risk score, a Whois history, or a pivot to report. Over a decade and 20 years are the page's phrases. They are not a measurement of one domain's history. A demo request is not access. Historic Whois can be wrong, and a risk score is the vendor's score. Neither one is a finding until the underlying record is opened.
Potential use cases
06
- A citation still says Iris Investigate. On 19 Oct 2026 the path /products/iris-investigate redirected to https://www.domaintools.com/platform. The loaded text did not contain the word Iris. It said leverage 20 years of Internet intelligence and Request a Demo, and it described over a decade of historic DNS resolution data. Use the URL that loaded, and mention the old path as a redirect.
- A budget line needs a number before the quote. The platform page printed no dollar, euro, or pound amount. The five steps are a marketing sequence, not a case. Do not borrow a SecurityTrails price. Write demo and 19 Oct 2026 until the quote names modules, historic depth, and seats. Twenty years and over a decade stay the page's phrases.
- Someone wants a domain profile from this review. None was opened. Historic Whois, RDAP, and a risk score are sentences on the marketing page. They are not a record for a domain this listing typed. When a later workspace returns a row, open the underlying record before you brief the score.
Hard cases
The case where the first result is easy to over-read.
The redirect is called a 404
The Iris Investigate URL did not 404 on 19 Oct 2026. It returned the platform page, HTTP 200, and the word Iris was absent from the text. A memo that says the product page is gone should say where the path now lands. Request a Demo is the action. It is not a price and not a workspace.
Practitioners using it
Posts on X from people describing a concrete use. The quote is the post. Likes and reposts are the counts saved with it, not a live total. A label marks a creator, a maintainer, a vendor, a partner, a data partner, or an investor.
Really enjoying watching @timhelming from @DomainTools pull apart adversary infrastructure using Iris. He's pulling apart Ryuk and other recently released adversary infrastructure in real time. From 1 domain to 103 potentially related domains in seconds. https://t.co/ZlC4uL7yfU pic.twitter.com/XBbhKSv9Xt
I ran the data through DomainTools Iris and some other sources and came up with this list of linked domains, registration information, and SSL certificate fingerprints FWIW: https://t.co/NRkWxEwMBJ
Vendor
Hey Kyle killer work! Researcher from @DomainTools here. Not sure which products of ours you have, but put together a little search hash for IRIS API that crops up these domains plus a little grep for PositiveSSL since we can't search "contains" on SSL Subject just yet. 1/3
Partner
Discover new domains and mitigate risks with @DomainTools Iris Investigate. Stay ahead with instant @SlackHQ notifications tailored to your query. Explore this feature more @tines_io 🔽 https://t.co/2jmU4S2d5r
Questions
Does Iris Investigate still have its own page?
On 19 Oct 2026 the Iris Investigate URL redirected to https://www.domaintools.com/platform. The word Iris was not in that page's text. The action was Request a Demo.
What does DomainTools cost?
The platform page did not print a currency amount. Write demo, and the date, until a quote names a price.
Citations
07
Titled sources. These public pages are what the quotes on this listing come from.
Product
DomainTools platform
https://www.domaintools.com/platformPricing
DomainTools Iris Investigate path
https://www.domaintools.com/products/iris-investigate