WhoisXML API is proud to announce that the false positive rate of its First Watch Malicious Domains Data Feed went down from 3% to 1.66%. This significant reduction in false alarms translates directly into a more efficient, reliable, and trustworthy predictive threat intelligence solution for users, allowing them to block upcoming threats with higher confidence and fewer interruptions.

The improvement in detection accuracy comes from refining and expanding the machine learning models behind the First Watch Malicious Domains Data Feed. Specifically, the WhoisXML API team has implemented the following:

• Expanded training data: The model’s training dataset has been significantly broadened to include billions of additional data points. It now covers a wide range of legitimate websites as well as an extensive set of malicious examples sourced from domain takedown records, abuse reports, threat intelligence feeds, and other relevant datasets. This expansion improves the model’s ability to distinguish between benign and harmful domains.
• Refined domain reputation signals: WhoisXML API significantly improved the algorithm that assesses the reputation of registrars and top-level domains (TLDs). More accurately weighing these factors means the system can better differentiate between domains registered by credible, established entities and those from sources frequently associated with abuse.
• Addressed name-based biases: The data feed underwent a major review to avoid name-based biases that could penalize legitimate domain naming conventions, ensuring that valid domains are not mistakenly flagged due to common or descriptive keywords they contain.

“A false positive rate of 3% was already highly competitive, but 1.66% sets a new benchmark for precision in predictive cybersecurity,” said Jonathan Zhang, CEO at WhoisXML API. “In cybersecurity, every fraction of a percent matters. Reducing our false positive rate by a further 45% means giving our customers back valuable time, increasing their operational efficiency, and allowing their security teams to focus on the real threats rather than investigating false alarms.”

With this update, First Watch sets a new standard in predictive threat intelligence, giving security teams earlier, cleaner signals to stay ahead of emerging threats.

Download a First Watch sample file or contact us now to learn more about the First Watch Malicious Domains Data Feed.