Skip to content
Z Zendikt
D
Threat Intelligence Software · Rank #10 of 10

DomainTools Iris Investigate review and pricing

DNS and domain-anchored intelligence investigation.

By DomainTools · Founded 2002 · Seattle, WA · private

DomainTools Iris Investigate is the category leader for domain, DNS, WHOIS, passive DNS, and infrastructure pivot investigations. Where a general TIP gives an IOC indicator, DomainTools gives full historical infrastructure context: registrant history, name-server pivots, SSL fingerprints, hosting relationships. The Farsight Security acquisition (2021) brought DNSDB passive DNS depth in-house. Best-fit as a specialist tool layered into a broader intel stack rather than a primary TIP.

Visit DomainTools Iris Investigate Compare to Silobreaker
Best for

CTI and incident-response teams needing deep domain, DNS, WHOIS, and infrastructure pivot capability as a specialist layer in a broader intel stack.

Worst for

Buyers wanting a primary TIP (Recorded Future, Anomali, ThreatConnect win), dark-web depth (Flashpoint wins), or organizations without enrichment plumbing.

Vendor Trust Score

Is DomainTools Iris Investigate a trustworthy vendor?

7.7/10
Mixed
Pricing transparency
Published rates; no hidden fees
6.5
Contract fairness
Reasonable terms; no auto-renew traps
7.5
Incident response
How they handle outages and breaches
8.0
Post-acquisition behavior
Customer treatment after M&A or PE
8.0
Executive stability
Leadership churn over 24 months
8.0
Roadmap honesty
Public commitments held
8.0
Trust signal log
  • 2021-04-21
    DomainTools acquired Farsight Security; DNSDB passive DNS in-house
  • 2024-09-10
    Iris Detect newly-observed-domain monitoring expanded
Vendor Trust is scored independently of product quality. A great product from an unfair vendor still earns a low trust score.
Review Intelligence

What 110 reviews actually say

Synthesized from G2, Capterra, Reddit, Trustpilot. Patterns >15% prevalence shown.

Last synthesized
2026-04-29

Praise patterns

  • Best-in-class for domain and DNS investigations
    87% →
  • Farsight DNSDB passive DNS depth
    71% →
  • Iris pivot graph genuinely differentiated
    64% →
  • Strong API for SOAR enrichment
    51% →

Complaint patterns

  • Not a primary TIP; layered tool only
    47% →
  • Narrow scope outside DNS and infrastructure
    41% →
  • Less curated adversary research than competitors
    38% →
  • Best value requires SOAR enrichment plumbing
    31% →
Sentiment trend (6 months)
86/100 +2 pts
12
01
02
03
04
05
Patterns are extracted from review corpus and human-verified. We surface trends, not anecdotes.
Verified Pricing

What buyers actually pay

31 anonymized deal disclosures · last updated 2026-05-01

Contribute your deal price
Company size Median annual
500-2,000 employees $42,000
2,000-10,000 employees $108,000
Verified pricing is crowdsourced from buyers under anonymity guarantees. Vendor-listed prices are validated against actual deals quarterly.
Compliance & Security

Auto-verified certifications

Verified 2026-05-01
SOC 2 Type II
ISO 27001
HIPAA
GDPR
CCPA
PCI DSS
FedRAMP

Editorial: Strengths

  • Best-in-class for domain, DNS, WHOIS, and passive DNS
  • Farsight DNSDB passive DNS depth (post-2021 acquisition)
  • Iris Investigate pivot graph is genuinely differentiated
  • Strong API and bulk enrichment for SOAR pipelines
  • Mature reputation among DNS researchers and law enforcement
  • Reasonable pricing relative to TIPs

Editorial: Weaknesses

  • Not a primary TIP; layered tool only
  • Narrow scope outside DNS and infrastructure
  • Less curated adversary research than Mandiant or Recorded Future
  • Smaller integration ecosystem than mainstream TIPs
  • Best value requires SOAR enrichment plumbing

Key features & integrations

  • +Iris Investigate pivot graph
  • +WHOIS history and registrant intelligence
  • +Farsight DNSDB passive DNS
  • +SSL certificate intelligence
  • +Hosting and infrastructure relationships
  • +Domain risk scoring
  • +Bulk API for SOAR enrichment
  • +Iris Detect newly-observed domain monitoring
  • +STIX/TAXII export
  • +Phishing kit and brand-abuse monitoring
70+ integrations
SplunkMicrosoft SentinelPalo Alto Cortex XSOARCrowdStrike FalconAnomali ThreatStreamThreatConnect
Geography supported
Global
Best fit
500-50,000+ employees · CTI and IR teams needing DNS specialist layer
Editorial deep-dive

Read our full ranking of Threat Intelligence Software

DomainTools Iris Investigate ranks #10 in our editorial review of 10 threat intelligence software platforms. The deep-dive covers methodology, comparison tables, decision matrix, migration scoring, and FAQs.

Read the full ranking

Closest alternatives in Threat Intelligence Software

#9
Silobreaker
OSINT-heavy intelligence platform with geopolitical depth.
★ 4.4 partial
#8
Dragos
OT/ICS threat intelligence specialist.
★ 4.6 opaque
#7
ThreatQuotient ThreatQ
Lean TIP focused on threat library curation and customization.
★ 4.4 opaque
Help the next buyer

Contribute your verified deal price

Pricing in B2B software is opaque because vendors want it that way. Verified buyer prices fix that, anonymously. Share what you actually paid for DomainTools Iris Investigate; we’ll add it to the verified pricing dataset on this page (with company size band only, no identifying details).

Submit anonymously