Iris Detect user guide

Iris Detect rapidly discovers and helps you triage lookalike domains that impersonate your brands, partners, and infrastructure. It continuously monitors for newly registered or observed domain names containing typo-squatting variations of your keywords, enabling proactive brand protection and network defense.

Iris Detect is an Internet infrastructure detection, monitoring, and enforcement tool. It rapidly discovers malicious domains that are engaged in brand impersonation, risk-scores them within minutes, and supports your automation of detection, escalation, and enforcement actions.

For a complete overview of capabilities and use cases, see the Iris Detect overview.

What you’ll learn

This guide covers:

Core concepts: Understanding monitors, watchlists, and domain matching
Monitors: Creating, configuring, and managing monitors
Working with domains: Viewing, analyzing, and taking action on domains
API usage: Authenticating and integrating with the Iris Detect API
Reference: Settings and detailed matching algorithm specifications

Getting started

Access Iris Detect at https://iris.domaintools.com/detect.

Prerequisites

Iris Detect requires:

An Enterprise Account with DomainTools, accessible at https://account.domaintools.com/my-account/
Provisioned access for Iris Detect
The ability to interact with the web interface and, if required, the REST API

Contact enterprisesupport@domaintools.com for assistance.

User access roles

Your organization’s administrators provision users with the following access tiers:

User role	Additional information
Viewer	Read access
Manage Iris Detect Monitors	Create, edit, delete Iris Detect Monitors
Add to Watchlist and Ignore domains	Add domain to watched
Escalate domains	Escalate and ignore domains; requires “Add to Watchlist and Ignore domains”

Quick start

Create a monitor: Enter a keyword in the search bar to monitor for domain variations.
Refine results: Configure match variations and exclusions to optimize detection.
Review domains: Examine new domains as Iris Detect discovers them in near real-time.
Take action: Add domains to your watchlist, escalate threats, or mark false positives as ignored.
Track changes: Monitor watched domains for infrastructure changes that may indicate weaponization.

Feature highlights

Near real-time detection

Iris Detect updates monitors continuously with newly registered or observed domains, enabling rapid response to emerging threats before they’re weaponized.

Advanced matching algorithms

Discover domain variations using sophisticated algorithms including fuzzy matching, homoglyphs, character substitutions, and more. Configure matching sensitivity to balance detection coverage with false positive rates.

Learn more: Core concepts

Domain Risk Score

Assess the risk level of discovered domains using DomainTools’ proprietary Domain Risk Score, which evaluates multiple factors including registration patterns, infrastructure, and behavioral indicators.

Learn more: Risk Score user guide

Watchlist and change tracking

Monitor domains for infrastructure changes including IP addresses, nameservers, registrars, and screenshots. Receive alerts when watched domains experience changes that may indicate malicious activity.

Learn more: Working with domains

Escalation and enforcement

Flag domains as malicious and optionally submit them to Google Web Risk for broader protection across Chrome, Safari, and Firefox browsers.