Maltego: WHOIS, History, and Reputation transforms

These transforms expose the DomainTools WHOIS, WHOIS History, reverse-lookup, hosting-history, and domain-reputation APIs inside Maltego. They complement the Iris Investigate transforms by providing the raw WHOIS record, historical WHOIS snapshots, and reverse pivots across shared hosting, nameservers, and registrants.

Note

The labels shown in these tables are descriptive. The Maltego client’s context menu shows each transform’s display name (set by the Transform Hub listing), which may be lightly different; the underlying transform endpoint name is a third identifier and isn’t customer-facing. Match on a transform’s inputs, outputs, and description rather than on the label.

Current WHOIS

Start from a Domain entity.

Transform	Output	Description
Domain to WHOIS Record	WHOIS	Returns the current WHOIS record as a WHOIS entity. The raw record text is attached to the entity’s display information. The properties panel is populated with Create, Update, and Expire dates when available.
Domain to WHOIS Emails (raw)	Email Address	Extracts email addresses from the raw WHOIS record via pattern matching (handles both user@example.com and user at example dot com variants). Entities are link-labeled with the WHOIS record date.
Domain to WHOIS Emails (parsed)	Email Address	Returns email addresses from the parsed WHOIS record broken out by contact role (registrant, administrative, technical, billing). Entities are link-labeled with the contact role and record date.
Domain to WHOIS Name Servers (raw)	NS Record	Returns the list of name servers from the current WHOIS record.
Domain to WHOIS Name Servers (parsed)	NS Record	Returns the list of name servers from the parsed WHOIS record.
Domain to WHOIS Registrant (raw)	Domain Registrant	Returns the registrant name from the current WHOIS record.
Domain to WHOIS Registrant (parsed)	Domain Registrant	Returns the registrant name from the parsed WHOIS record.
Domain to WHOIS Registrar (raw)	Registrar	Returns the registrar from the current WHOIS record.
Domain to WHOIS Registrar (parsed)	Registrar	Returns the registrar from the parsed WHOIS record.
Domain to WHOIS Server IP	IPv4 Address	Returns the IPv4 address of the WHOIS server that answered the query.

WHOIS History

Start from a Domain entity. Historical WHOIS transforms return multiple time-stamped entities; each result is link-labeled with the date of the historical record.

Transform	Output	Description
Domain to Historical WHOIS Emails	Email Address	Returns every email address seen in the domain’s WHOIS history.
Domain to Historical WHOIS Registrants	Domain Registrant	Returns every registrant name seen in the domain’s WHOIS history.

Hosting History

Start from a Domain entity. Hosting history transforms return time-stamped IP, nameserver, or registrar changes. Entity weights are reduced for older records so recent changes rank higher.

Transform	Output	Description
Domain to Historical IP Addresses	IPv4 Address	Returns each IP address the domain has resolved to over time.
Domain to Historical Name Servers	NS Record	Returns each name server the domain has delegated to over time, with a link label describing the action (added/removed).
Domain to Historical Registrars	Registrar	Returns each registrar the domain has used over time.

Reverse lookups

Shared hosting

Start from a Domain or IPv4 Address entity.

Transform	Output	Description
Shared Domains	Domain	From a Domain, returns other domains that share the same hosting IP. From an IPv4 address, returns domains hosted at that IP. Entities are link-labeled with the IP.

Reverse nameserver

Start from a name server hostname entity.

Transform	Output	Description
Name Server to Domains (via reverse-NS)	Domain	Returns primary domains that delegate to this name server.

Reverse WHOIS

Start from a Domain or a phrase / registrant entity containing text to search on.

Transform	Output	Description
Reverse WHOIS (historic)	Domain	Returns domains that historically had WHOIS records matching the input term.
Reverse WHOIS (current)	Domain	Returns domains whose current WHOIS records match the input term.

Domain Reputation

Start from a Domain entity.

Transform	Output	Description
Domain Reputation	Domain (enriched)	Adds a Risk property with the DomainTools reputation risk score and a Reasons property listing the reputation reasons.

Notes on rate and volume

The WHOIS History, hosting history, reverse IP, reverse nameserver, and reverse WHOIS transforms draw on heavier endpoints than a current WHOIS lookup. Transforms against large result sets may take noticeably longer than a single-domain lookup. If a transform feels slow, scope the input — reverse lookups on common values return large result sets. See Troubleshooting.