A domain embedded with or referenced by multiple known malicious web properties through redirect chains and shared scripts.
“Decline. The web graph places the asset inside an active malicious cluster through operator-level connections. Treat as hostile.”