Case Study: Whalebone strengthens predictive malicious domain detection with WhoisXML API First Watch

Whalebone detects 74.5% of malicious new domains first with WhoisXML API

Whalebone, a cybersecurity company providing protection for telcos, ISPs, enterprises, and governments, sought to strengthen its early, predictive detection of newly emerging domain-based threats. The challenge was to identify malicious domains earlier in their lifecycle before they generated significant DNS traffic. To address this, Whalebone turned to the vendor WhoisXML API and its First Watch Malicious Domains Data Feed.

By implementing WhoisXML API's First Watch feed, which focuses on the domain registration stage, Whalebone significantly enhanced its predictive detection capabilities. The results were substantial, with the feed identifying 74.5% of malicious new domains before any other source and flagging over 116,000 malicious domains in a single month. This solution provided broader coverage, enabled faster proactive blocking, and allowed Whalebone to redirect internal resources toward other high-value priorities.

Whalebone