Domain Tools

DomainTools is one of the most comprehensive domain intelligence platforms available, providing WHOIS data with extensive history, reverse WHOIS searches, infrastructure correlation, and domain monitoring capabilities. Used by fraud investigators, threat analysts, law enforcement, and corporate security teams, DomainTools connects domain ownership data across time to reveal the full context behind any domain registration.

What investigators use DomainTools for: tracing historical WHOIS ownership to identify who registered a domain before privacy protection was applied, performing reverse WHOIS searches to find all domains registered by the same entity, analyzing domain risk scores, discovering domain infrastructure connections, and monitoring domains for changes in registration or configuration.

What DomainTools exposes: current and historical WHOIS records with registrant, technical, and administrative contact data, reverse WHOIS results linking domains by shared registrant email, phone, or name, hosting history showing IP addresses a domain has resolved to over time, registrar transfer history, domain risk scores based on registration patterns and infrastructure, and the Iris Investigate platform for visual link analysis across domain portfolios.

Reverse WHOIS is DomainTools' most powerful OSINT capability. Investigators search by registrant email, phone number, or name to find all domains ever registered with that identifier. This technique reveals the full scope of an actor's domain portfolio — including domains used in previous campaigns, domains that have since expired, and active infrastructure not yet associated with the actor.

For threat actor attribution: when a registrant uses a distinctive email address or phone number across multiple domain registrations, DomainTools links those registrations into a coherent actor profile. Even when registrants use privacy services, historical WHOIS records from before privacy protection was enabled often contain real contact information.

Access model: DomainTools requires a paid subscription for most features. The free WHOIS lookup at whois.domaintools.com provides basic current registration data, while the Iris Investigate platform and reverse WHOIS capabilities require enterprise access.

In a workflow: after identifying a suspicious domain from threat intelligence or phishing analysis, use DomainTools to check registration history before privacy protections. Run a reverse WHOIS search on any discovered email or phone number to map related domains. Feed the resulting domain portfolio into DNS History and Shodan to enumerate the full infrastructure.