A computer-implemented method for removing false positives from domain discovery analysis, comprising: generating (206, 605) based on a list of known legitimate domains, a baseline dataset comprising feature vectors corresponding to the known legitimate domains; receiving (211, 610) information identifying a first domain for analysis; determining feature vectors corresponding to the first domain; executing (212-223, 615-645) one or more machine learning algorithms to compare the feature vectors corresponding to the first domain to the baseline dataset comprising the feature vectors corresponding to the known legitimate domains; based on execution (212-223, 615-645) of the one or more machine learning algorithms, generating first domain classification information indicating that the first domain is a legitimate domain; and in response to determining that the first domain is a legitimate domain, sending (230, 650) one or more commands directing a domain identification system to remove the first domain from a list of indeterminate domains maintained by the domain identification system; wherein determining feature vectors corresponding to the first domain and executing (212-223, 615-645) the one or more machine learning algorithms to compare the feature vectors corresponding to the first domain to the baseline dataset comprising the feature vectors corresponding to the known legitimate domains comprises: determining (218, 635) feature vectors corresponding to an HTML tag structure of one or more pages associated with the first domain; comparing the feature vectors corresponding to the HTML tag structure to the feature vectors corresponding to the known legitimate domains, resulting in one or more structure analysis values; and determining (220, 640) that the one or more structure analysis values exceed one or more predetermined structure analysis threshold values; and wherein the one or more structure analysis values comprise averages of top-N similarity scores for a plurality of selected N values. generating (206, 605) based on a list of known legitimate domains, a baseline dataset comprising feature vectors corresponding to the known legitimate domains; receiving (211, 610) information identifying a first domain for analysis; determining feature vectors corresponding to the first domain; executing (212-223, 615-645) one or more machine learning algorithms to compare the feature vectors corresponding to the first domain to the baseline dataset comprising the feature vectors corresponding to the known legitimate domains; based on execution (212-223, 615-645) of the one or more machine learning algorithms, generating first domain classification information indicating that the first domain is a legitimate domain; and in response to determining that the first domain is a legitimate domain, sending (230, 650) one or more commands directing a domain identification system to remove the first domain from a list of indeterminate domains maintained by the domain identification system; wherein determining feature vectors corresponding to the first domain and executing (212-223, 615-645) the one or more machine learning algorithms to compare the feature vectors corresponding to the first domain to the baseline dataset comprising the feature vectors corresponding to the known legitimate domains comprises: determining (218, 635) feature vectors corresponding to an HTML tag structure of one or more pages associated with the first domain; comparing the feature vectors corresponding to the HTML tag structure to the feature vectors corresponding to the known legitimate domains, resulting in one or more structure analysis values; and determining (220, 640) that the one or more structure analysis values exceed one or more predetermined structure analysis threshold values; and wherein the one or more structure analysis values comprise averages of top-N similarity scores for a plurality of selected N values. determining (218, 635) feature vectors corresponding to an HTML tag structure of one or more pages associated with the first domain; comparing the feature vectors corresponding to the HTML tag structure to the feature vectors corresponding to the known legitimate domains, resulting in one or more structure analysis values; and determining (220, 640) that the one or more structure analysis values exceed one or more predetermined structure analysis threshold values; and wherein the one or more structure analysis values comprise averages of top-N similarity scores for a plurality of selected N values.