Iris Investigate Screenshot History panel
The Screenshot History panel provides an index of archived website screenshots for a domain, showing visual changes over time. Browse through historical captures to understand how a website has evolved.
What’s included
Section titled “What’s included”The Screenshot History panel displays:
- Screenshot index: Dates when screenshots were captured
- Current screenshot: Most recent website capture
- Historical screenshots: Previous captures with timestamps
- Navigation controls: Browse through screenshot history
View screenshots
Section titled “View screenshots”Current screenshot
Section titled “Current screenshot”By default, the panel displays the most recent screenshot captured for the domain.
Historical screenshots
Section titled “Historical screenshots”When multiple historical screenshots are available:
- Use the < or > navigation controls.
- Browse through screenshots chronologically.
- View the capture date for each screenshot.
Request new screenshots
Section titled “Request new screenshots”If Screenshot History is empty or outdated, request a new screenshot:
- Navigate to the Screenshot History panel.
- Select the Update Content button.
- The web crawler queues the domain for screenshot capture.
Screenshots are typically available:
- Within 5 minutes for most domains
- Up to 24 hours in some cases
Screenshot collection
Section titled “Screenshot collection”DomainTools captures screenshots as part of web crawler operations:
Automatic collection:
- Upon first discovery of a domain
- Every 3 months for domains with risk scores of 70 or higher
- Daily for domains watched in Iris Detect
Manual collection:
- Via the Update Content button in Screenshot History
- Via the Update Content button in Domain Profile
Use cases
Section titled “Use cases”Track website changes
Section titled “Track website changes”Monitor visual evolution of websites:
- Content updates
- Design changes
- Branding modifications
- Functionality changes
Investigate suspicious activity
Section titled “Investigate suspicious activity”Identify patterns indicating malicious use:
- Rapid content changes
- Phishing page deployment
- Brand impersonation
- Parked domain transitions
Verify legitimacy
Section titled “Verify legitimacy”Confirm website authenticity:
- Consistent branding over time
- Professional design
- Appropriate content
- Expected functionality
Document campaigns
Section titled “Document campaigns”Track threat campaign lifecycle:
- Initial deployment
- Active period
- Takedown or modification
- Post-takedown state
Best practices
Section titled “Best practices”Efficient analysis
Section titled “Efficient analysis”- Start with current: Review the most recent screenshot.
- Compare with historical: Identify significant changes.
- Note dates: Correlate changes with other intelligence.
- Cross-reference: Compare with Domain History and WHOIS History.
Investigation workflow
Section titled “Investigation workflow”- Review Domain Profile: Get overview including current screenshot.
- Open Screenshot History: Examine visual timeline.
- Identify changes: Note significant modifications.
- Correlate with data: Compare with DNS, WHOIS, SSL changes.
- Document findings: Capture key observations.
What to look for
Section titled “What to look for”Legitimate patterns:
- Gradual, planned design updates
- Consistent branding
- Professional appearance
- Appropriate content for domain purpose
Suspicious patterns:
- Rapid, frequent changes
- Phishing or impersonation content
- Parked domain pages
- Malicious redirects
- Content mismatched with registration
Limitations
Section titled “Limitations”- Screenshot availability depends on web crawler access
- Some domains may not be accessible for screenshot capture
- Historical screenshot coverage varies by domain
- Screenshots show only the landing page, not full site
See also
Section titled “See also”- Domain Profile: Includes current screenshot
- Domain History: Track all domain changes
- Web Content Updates: Manual update process