Whalebone & WhoisXML API: Strengthening Predictive Domain Detection for Large-Scale User Protection

Detecting Domain Threats Earlier in the Threat Lifecycle

Whalebone’s threat intelligence capabilities already supported protection for a broad global customer base. However, the company saw a strategic opportunity to strengthen visibility into newly emerging domain-based threats earlier in their lifecycle.

The priority was clear: identify suspicious domains when they are newly registered or newly observed, before they generate meaningful DNS traffic or become activated as part of larger threat campaigns. This earlier visibility supported Whalebone’s broader focus on zero-day and newly emerging domain threats.

Expanding this kind of predictive coverage entirely in-house would have required significant time and resources. Whalebone needed an efficient way to extend early-domain intelligence while keeping its internal team focused on customer-driven priorities and other parts of the threat lifecycle.

Augmenting Predictive Detection with First Watch

Whalebone selected WhoisXML API’s First Watch Malicious Domains Feed to augment its existing threat intelligence stack.

First Watch stood out because it operates at an early and strategic point in a threat’s lifecycle: at the domain registration stage. That focus made it a strong fit for Whalebone’s predictive detection strategy.

The feed complemented Whalebone’s internal capabilities by expanding early-domain coverage and strengthening the foundation its team had already built. It allowed Whalebone to combine its own targeted threat intelligence work with a wider predictive data source focused on newly emerging domain threats.

The solution also fits Whalebone’s operational needs, combining ease of implementation with responsive communication and collaborative support from the WhoisXML API team.

Faster Detection, Broader Coverage, and Better Resource Focus

With First Watch, Whalebone strengthened its ability to identify potentially malicious domains earlier and support proactive blocking before threats reached users.

A 30-day evaluation* across various sources showed:

• First to report: 74.5% of the malicious newly registered domains observed in Whalebone's DNS traffic were reported by First Watch before any other feed.
• Earliest, most often: Across the evaluation, First Watch held the top position for early threat awareness more often than any other source in Whalebone’s stack.
• Exclusive coverage: Around 87% of First Watch's detections came from no other feed, over 100,000 malicious domains in a single month.
• Built for proactive blocking: First Watch surfaced more than 116,000 malicious domains in Whalebone's traffic in 30 days.

Beyond the metrics, First Watch gave Whalebone a more efficient buy-versus-build approach to predictive coverage. By augmenting its existing stack with First Watch, Whalebone could redirect internal resources toward other high-value threat intelligence priorities.

* Whalebone production evaluation, June 7 to July 7, 2026, of newly registered domain IOCs with hits on Whalebone's resolvers. Sources evaluated include third-party feeds and Whalebone's own tooling, not all focused on NRDs or comparable in scale.