---
title: "Comment by Furqan Ashraf on \"IPQS False Positive: How a Legitimate New Domain Got a 95 Risk Score\n\" | Hashnode"
description: "Your point about \"unknown\" outcomes and clear reason codes is fair. A score with no explanation is hard to dispute. One format that helps is when each flagged d"
url: "https://hashnode.com/posts/ipqs-false-positive-how-a-legitimate-new-domain-got-a-95-risk-score/6a93a27ff0dc907bc96474b8/comment/6ace0924a8aea7e40b5e76f3"
---

[Discussion](https://hashnode.com/posts/ipqs-false-positive-how-a-legitimate-new-domain-got-a-95-risk-score/6a93a27ff0dc907bc96474b8)

Comment [IPQS False Positive: How a Legitimate New Domain Got a 95 Risk Score](https://hashnode.com/posts/ipqs-false-positive-how-a-legitimate-new-domain-got-a-95-risk-score/6a93a27ff0dc907bc96474b8)

[Oct 13](https://hashnode.com/posts/ipqs-false-positive-how-a-legitimate-new-domain-got-a-95-risk-score/6a93a27ff0dc907bc96474b8/comment/6ace0924a8aea7e40b5e76f3)

Your point about "unknown" outcomes and clear reason codes is fair. A score with no explanation is hard to dispute. One format that helps is when each flagged domain comes with its evidence: a confidence value, first and last seen dates, and how many infrastructure links tied it to a known threat. The WhoisFreaks feed schema (https//whoisfreaks.com/documentation/threat-intelligence-feed) is built that way, so a user can see why a domain was listed rather than only a number.