False positive

A false positive is an incorrect alert or match: a system reports a problem even though the specific activity or item it flagged is not the threat the system was looking for. In a domain check, this might mean a harmless domain or message is mistakenly identified as malicious or unwanted.

Why can a false positive happen?

Security systems make decisions from signals, rules, and data that may be incomplete or shared across many users. A legitimate website can be taken over by an attacker, share servers or network systems with an abusive service, or be caught by a broad rule. A blocklist can also cover a particular type of risk that a user misunderstands as a general verdict about the domain.

For example, if an email provider places a legitimate order confirmation in spam, the filtering decision may be a false positive for that message. The fact that it was filtered does not prove the message is dangerous, just as finding a message in the inbox does not prove it is safe. Check the specific evidence and the list or product that produced the result.

Is a false positive the same as a false negative?

No. A false positive is a false alarm: the system flags something that is not the targeted threat. A false negative is a threat that the system fails to detect. Both can happen because detection systems cannot perfectly classify every case, and different systems use different data and cutoffs for deciding when to flag a threat.

Related terms

• Blocklist — one possible source of a match
• Domain reputation — service-specific assessment
• Spam — filtering can misclassify messages
• Malware — an example of a threat category