Skip to content

URL Linking

Create URLs that link directly to specific searches or data panels in Iris Investigate. Use these URLs to share searches, bookmark investigations, or integrate with external tools.

Basic format

https://iris.domaintools.com/investigate/search/?q={SEARCH_VALUE}

Simple domain or IP searches

Append the domain name or IP address directly:

https://iris.domaintools.com/investigate/search/?q=domaintools.com

Field-specific searches

Use shortcodes for precise searches:

https://iris.domaintools.com/investigate/search/?q=ip.asn:"209242"

Format: shortcode:"value"

Common examples

Search Type URL
Domain https://iris.domaintools.com/investigate/search/?q=example.com
IP Address https://iris.domaintools.com/investigate/search/?q=4.2.2.2
ASN https://iris.domaintools.com/investigate/search/?q=ip.asn:"209242"
Email https://iris.domaintools.com/investigate/search/?q=em:"admin@example.com"
Registrar https://iris.domaintools.com/investigate/search/?q=reg:"GoDaddy"

For a complete list of shortcodes, see Search Reference.

Basic format

https://iris.domaintools.com/investigate/search/?q={DOMAIN or IP}&tab=panel-{IDENTIFIER}

Panel identifiers

For domain names:

Panel Identifier
Domain Profile domain-profile
Domain History domain-history
Screenshot History screenshot-history
WHOIS History whois-history
SSL Profile ssl-profile

For IP addresses:

Panel Identifier
IP Profile ip-profile
IP Tools ip-tools

Examples

Link to domaintools.com Screenshot History: 

https://iris.domaintools.com/investigate/search/?q=domaintools.com&tab=panel-screenshot-history

Link to 141.193.213.20 IP Profile: 

https://iris.domaintools.com/investigate/search/?q=141.193.213.20&tab=panel-ip-profile

Link to example.com WHOIS History: 

https://iris.domaintools.com/investigate/search/?q=example.com&tab=panel-whois-history

Use cases

Bookmarking

Save frequently used searches:

  • Monitoring specific domains.
  • Tracking infrastructure.
  • Regular threat hunting queries.

Sharing

Share searches with team members:

  • Investigation starting points.
  • Interesting findings.
  • Reproducible queries.

Integration

Integrate with external tools:

  • SIEM platforms.
  • Ticketing systems.
  • Threat intelligence platforms.
  • Custom dashboards.

Documentation

Include in documentation:

  • Investigation procedures.
  • Threat reports.
  • Training materials.
  • Runbooks.

Best practices

URL encoding

When constructing URLs programmatically, ensure proper URL encoding:

  • Spaces → %20.
  • Special characters → URL-encoded equivalents.
  • Quotes → %22.

Shortcode usage

Always use shortcodes for field-specific searches to avoid ambiguity:

  • ✅ ?q=ip.asn:"209242": Searches ASN field.
  • ❌ ?q=209242: May match multiple field types.

Testing

Test URLs before sharing:

  • Verify the search returns expected results.
  • Confirm the correct panel opens.
  • Check for proper encoding.

Limitations

  • URLs reflect search parameters, not investigation state.
  • Tags and notes aren't included in URLs.
  • Historical search settings use global defaults.
  • Advanced search filters may require complex URL construction.

See also