Maltego: Iris Investigate transforms

Iris Investigate transforms surface the DomainTools Iris Investigate dataset directly inside Maltego. Use them for enrichment (add context to an entity already on the graph) and for pivoting (discover new related entities).

The transforms below are organized by the entity you start from. Each section lists the transform, the input it consumes, the output entities it produces, and a short description.

Note

The labels shown in this table are descriptive. The Maltego client’s context menu shows each transform’s display name (set by the Transform Hub listing), which may be lightly different; the underlying transform endpoint name used internally is a third identifier and isn’t customer-facing. Match on a transform’s inputs, outputs, and description rather than on the label. If you’re unsure which transform in the menu corresponds to a given entry, contact your DomainTools representative.

Supported input entities

You can start from any of the following Maltego entity types:

• Domain (apex or publicly registered domain)
• Email address
• IPv4 address (including entities produced by Maltego as Hosting IP, Name Server IP, or Mail Server IP)
• Name server hostname
• Mail server hostname
• Registrant name
• Registrant organization
• Registrar
• SSL organization
• SSL subject field contents
• SSL certificate SHA hash
• Google Adsense code (as a phrase entity)
• Google Analytics code (as a phrase entity)
• Iris Search Hash (a phrase entity populated with the Iris Search Export value)
• Redirect domain

Transforms from a Domain entity

Enrichment

Transform	Output	Description
Domain to Domain Profile	Domain (enriched)	Populates the properties view with Alexa rank, create date, expiration date, and DomainTools Risk Score. Adds a link back to the matching Iris search.
Domain to Risk Components	Domain (enriched)	Populates the properties view with the four component scores that make up the Domain Risk Score: Proximity, Threat Profile, and Threat Profile malware/phishing/spam sub-scores.
Domain to Contact Email Addresses	Email Address	Returns aggregated contact email addresses from the WHOIS record.
Domain to Contact Aliases	Alias	Returns aggregated contact names (administrative, billing, technical) from the WHOIS record.
Domain to Registrant	Domain Registrant	Returns the registrant name from the WHOIS record.
Domain to Registrant Organization	Organization	Returns the registrant organization from the WHOIS record.
Domain to Registrar	Registrar	Returns the registrar that registered the domain.
Domain to IP Addresses	IPv4 Address	Returns the IPv4 addresses hosting the domain.
Domain to ASN	AS	Returns the Autonomous System Numbers associated with the domain’s hosting IPs.
Domain to ISPs	Company	Returns the internet service providers hosting the domain.
Domain to NS Records	NS Record	Returns the nameserver hostnames delegated by the domain.
Domain to MX Records	MX Record	Returns the mail server hostnames in the domain’s MX record.
Domain to SOA Email	Email Address	Returns the DNS/SOA email address associated with the domain.
Domain to SSL Email	Email Address	Returns email addresses extracted from SSL certificates associated with the domain.
Domain to SSL Hash	Hash	Returns the SHA hashes of SSL certificates resolving to the domain via SNI.
Domain to SSL Organization	Organization	Returns the parsed issuer organization from SSL certificates associated with the domain.
Domain to SSL Subjects	Phrase	Returns the subject-field contents from SSL certificates associated with the domain.
Domain to Email Domains	Domain	Breaks out the apex domains of every WHOIS/SOA/SSL email address associated with the domain.
Domain to Adsense Code	Phrase	Returns the Google Adsense code observed in the www. subdomain’s page source.
Domain to Analytics Code	Phrase	Returns the Google Analytics code observed in the www. subdomain’s page source.
Domain to Redirect Domain	Domain	Returns the destination domain of any HTTP 301 redirect configured for the domain when DomainTools first observed it.
Domain to Redirect Domain (recursive)	Domain	Follows a chain of redirects recursively from the domain until no further redirects are found.

Transforms from an IP address

Transform	Output	Description
IP to Domains	Domain	Returns domains hosted at this IPv4 address (DNS A records).
Name Server IP to Name Server Domains	Domain	From a name server’s IP, returns the apex domains of every name server hostname that resolves to this IP.
Mail Server IP to Email Domains	Domain	From a mail server’s IP, returns apex email domains of WHOIS records of domains hosted at this IP.

Returned domain entities are enriched with DomainTools Risk Score, create date, expiration date, and an Iris-search link.

Note

If you have an IPv4 entity sitting in a property field (Hosting IP, Name Server IP, Mail Server IP) rather than on the graph, use Extract IP Address to promote the property value to its own entity on the graph before running any IP-based transforms.

Transforms from an email address

Transform	Output	Description
Email to Domains	Domain	Returns every domain with a WHOIS, DNS/SOA, or contact email matching this address.
Email to Domains (SSL)	Domain	Returns every domain whose SSL certificate contains this email address.

Transforms from WHOIS/contact entities

Transform	Output	Description
Registrant to Domains	Domain	Returns domains whose WHOIS registrant name matches this value.
Registrant Organization to Domains	Domain	Returns domains whose WHOIS registrant organization matches this value.
Registrar to Domains	Domain	Returns domains registered by this registrar.

Transforms from SSL entities

Transform	Output	Description
SSL Organization to Domains	Domain	Returns domains whose SSL certificate issuer organization matches this value.
SSL Subject to Domains	Domain	Returns domains whose SSL certificate subject field contains this value.
SSL Hash to Domains	Domain	Returns domains whose SSL certificate has this SHA hash.

Transforms from DNS hostname entities

Transform	Output	Description
Name Server to Domains	Domain	Returns apex domains using this name server hostname for their DNS NS delegation.
Mail Server to Domains	Domain	Returns domains whose MX record is this mail server hostname.

Transforms from Adsense / Analytics codes

Transform	Output	Description
Adsense Code to Domains	Domain	Returns domains observed sharing this Google Adsense code.
Analytics Code to Domains	Domain	Returns domains observed sharing this Google Analytics code.

Transforms from an Iris Search Hash

Transform	Output	Description
Iris Search Hash to Domains	Domain	Reverses an Iris Search Export (search hash phrase) to the list of domains matching that Iris query. Use this to replay Iris UI research inside Maltego.

Property fields set on returned entities

Many transforms add a DT Count property to result entities. This represents the number of times the attribute co-occurred with the input across DomainTools’ data, and is a useful signal when ranking pivots.

Enriched Domain entities produced by Iris transforms include an IRIS Link in the display-information panel that deep-links to the matching Iris search at research.domaintools.com.