---
title: "Discussion on \"IPQS False Positive: How a Legitimate New Domain Got a 95 Risk Score\n\" | Hashnode"
description: "Discussion on \"IPQS False Positive: How a Legitimate New Domain Got a 95 Risk Score\n\". IPQS flagged my brand-new, legitimate domain as phishing with a 95 risk score. Here’s what happened and why false positives matter."
url: "https://hashnode.com/posts/ipqs-false-positive-how-a-legitimate-new-domain-got-a-95-risk-score/6a93a27ff0dc907bc96474b8"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [IPQS False Positive: How a Legitimate New Domain Got a 95 Risk Score](https://ipqs.hashnode.dev/ipqs-false-positive-how-a-legitimate-new-domain-got-a-95-risk-score?utm_source=hashnode&utm_medium=feed)

IPQS flagged my brand-new, legitimate domain as phishing with a 95 risk score. Here’s what happened and why false positives matter.

Aug 30 · 22 min read · ipqs.hashnode.dev  
Read the article

-   [#security](https://hashnode.com/tag/security)
-   [#cybersecurity](https://hashnode.com/tag/cybersecurity)
-   [#websecurity](https://hashnode.com/tag/websecurity)
-   [#phishing](https://hashnode.com/tag/phishing)
-   [#fraud-detection](https://hashnode.com/tag/fraud-detection)
-   [#devops](https://hashnode.com/tag/devops)
-   [#webdev](https://hashnode.com/tag/webdev)
-   [#email-security](https://hashnode.com/tag/email-security)

## Written by

[Pred Gray](https://hashnode.com/@predgray)

@predgray

  
[View profile](https://hashnode.com/@predgray)

Just a guy whose domain got labeled phishing by IPQS. Now I’m digging into why.

## Responses 1

Markdown supported · ⌘↵ to post

[Furqan Ashraf](https://hashnode.com/@jfreaks)

[Oct 13](https://hashnode.com/posts/ipqs-false-positive-how-a-legitimate-new-domain-got-a-95-risk-score/6a93a27ff0dc907bc96474b8/comment/6ace0924a8aea7e40b5e76f3)

Your point about "unknown" outcomes and clear reason codes is fair. A score with no explanation is hard to dispute. One format that helps is when each flagged domain comes with its evidence: a confidence value, first and last seen dates, and how many infrastructure links tied it to a known threat. The WhoisFreaks feed schema (https//whoisfreaks.com/documentation/threat-intelligence-feed) is built that way, so a user can see why a domain was listed rather than only a number.