Block malicious domains before attacks begin

Frequently Asked Questions

What is the First Watch API?

The First Watch API provides access to the First Watch predictive threat intelligence database designed to identify malicious domains within hours of registration. Unlike traditional systems that wait for a domain to be weaponized or used in an active attack, First Watch uses a proprietary deep learning neural network to analyze data points and predict intent. It specifically targets high-risk categories like phishing, malware, and command-and-control (C2) infrastructure.

The engine processes roughly 300,000 daily registrations in under five minutes, enabling the API to provide security teams with a high-confidence list of domains created with malicious intent within an hour of their creation. This allows organizations to move from reactive defense to proactive offense, blocking dangerous infrastructure before it starts to interact with their network.

The First Watch API acts as an early warning system, closing the window of opportunity that attackers typically exploit during the first few days of a domain's life.

What makes First Watch different from traditional threat intelligence tools?

Traditional threat intelligence systems are reactive. They wait for a domain to launch an attack, get reported, and undergo manual verification before adding it to a list. This delay creates a dangerous window where users are unprotected.

First Watch API flips this model by using a predictive neural network. Instead of waiting for malicious activity, it analyzes registration patterns and structural indicators for thousands of domains daily to catch malicious ones the moment they are created.

First Watch stops attacks before they start, rather than just recording them after the damage is done.

What are the benefits of using the First Watch API?

The primary benefits of the First Watch API are:

• Preemptive threat detection: The tool identifies malicious domains within an hour of registration using a deep-learning neural network that analyzes registration patterns to flag intent before an attack launches.
• High-precision intelligence: First Watch cuts through the noise with 98% accuracy. Maintaining a low false positive rate ensures that SOC teams stay focused on verified threats rather than chasing ghosts or legitimate marketing infrastructure.
• Massive infrastructure coverage: The tool leverages billions of historical WHOIS and DNS records to uncover entire malicious infrastructures, including related IP netblocks and registrant patterns that standard blocklists miss.
• Smooth operational integration: The API is designed for high-speed automation with enterprise reliability. It supports standard data formats and integrates with common security workflows. It also includes features that help maintain stable, efficient performance in automated environments.

How does the First Watch API detect typosquatting and impersonation?

The First Watch API detects typosquatting and impersonation through a multi-layered automated approach.

Instead of waiting for a domain to host malicious content, the system uses a recursive deep learning neural network to analyze the "domain DNA" at the moment of registration. This identifies high-risk infrastructure by assessing registrar reputation, DNS record patterns, and links to known threat actors.

To catch impersonation, the API performs fuzzy search logic using approximate string matching. This catches the following:

• Homoglyphs: Visually similar characters from different alphabets.
• Combosquatting: Brands paired with keywords like "-support" or "-verify."
• Character swaps: Common typos and doubled letters.

The script logic allows an exact lookup to automatically fall back to a fuzzy search if it doesn't find a direct match, ensuring that even subtle variations intended to bypass human eyes are flagged.

Why do I need First Watch when I already have a threat intelligence solution?

Most traditional threat intelligence solutions are reactive, meaning they only flag a domain after it has been seen in an actual attack. This leaves a "patient zero" problem where the first few victims are always compromised before the threat is recognized. First Watch eliminates this gap by identifying threats before the first attack even begins.

First Watch monitors close to 15,000 registrars and nameservers in real time, detecting infrastructure that traditional tools might not catch until 14 months later. It serves as a first line of defense, enriching your existing security stack with predictive data that helps your team prioritize real dangers over stale alerts.

How do I get started with the First Watch API?

To start using the First Watch API, or if you have any questions, please contact us and our team will get back to you.